Users Guide

ManualsBrandsDell ManualsAccess PlatformsW-Series Controller AOS

161

162

163

164

165

166

167

168

169

170

Table Of Contents

Contents
- Revision History
About this Guide
- What's New In ArubaOS 6.5.x
- Fundamentals
- Related Documents
- Conventions
- Contacting Dell
The Basic User-Centric Networks
- Understanding Basic Deployment and Configuration Tasks
- Controller Configuration Workflow
- Connect the Controller to the Network
- W-7000 Series and W-7200 Series Controllers
- Using the LCD Screen
- Configuring a VLAN to Connect to the Network
- Enabling Wireless Connectivity
- Enabling Wireless Connectivity
- Configuring Your User-Centric Network
- Replacing a Controller
Control Plane Security
- Control Plane Security Overview
- Configuring Control Plane Security
- Managing AP Whitelists
- Managing Whitelists on Master and Local Controllers
- Working in Environments with Multiple Master Controllers
- Replacing a Controller on a Multi-Controller Network
- Configuring Control Plane Security after Upgrading
- Troubleshooting Control Plane Security
Software Licenses
- Getting Started with ArubaOS Licenses
- License Types and Usage
- Licensing Best Practices and Limitations
- Centralized Licensing Overview
- Configuring Centralized Licensing
- Installing a License
- Deleting a License
- Monitoring and Managing Centralized Licenses
Network Configuration Parameters
- Campus WLAN Workflow
- Understanding VLAN Assignments
- Configuring VLANs
- Configuring Ports
- Configuring Static Routes
- Configuring the Loopback IP Address
- Configuring the Controller IP Address
- Configuring GRE Tunnels
- Configuring GRE Tunnel Groups
- Jumbo Frame Support
IPv6 Support
- Understanding IPv6 Notation
- Understanding IPv6 Topology
- Enabling IPv6
- Enabling IPv6 Support for Controller and APs
- Filtering an IPv6 Extension Header (EH)
- Configuring a Captive Portal over IPv6
- Working with IPv6 Router Advertisements (RAs)
- RADIUS Over IPv6
- TACACS Over IPv6
- DHCPv6 Server
- Understanding ArubaOS Supported Network Configuration for IPv6 Clients
- Understanding ArubaOS Authentication and Firewall Features that Support IPv6
- Managing IPv6 User Addresses
- Understanding IPv6 Exceptions and Best Practices
Link Aggregation Control Protocol
- Understanding LACP Best Practices and Exceptions
- Configuring LACP
- LACP Sample Configuration
OSPFv2
- Understanding OSPF Deployment Best Practices and Exceptions
- Understanding OSPFv2 by Example using a WLAN Scenario
- Understanding OSPFv2 by Example using a Branch Scenario
- Configuring OSPF
- Sample Topology and Configuration
Tunneled Nodes
- Understanding Tunneled Node Configuration
- Configuring a Wired Tunneled Node Client
- Limitations
Authentication Servers
- Understanding Authentication Server Best Practices and Exceptions
- Understanding Servers and Server Groups
- Configuring Authentication Servers
- Managing the Internal Database
- Configuring Server Groups
- Assigning Server Groups
- Configuring Authentication Timers
- Authentication Server Load Balancing
MAC-based Authentication
- Configuring MAC-Based Authentication
- Configuring Clients
Branch Controller Config for Controllers
- Branch Deployment Features
- Scalable Site-to-Site VPN Tunnels
- Layer-3 Redundancy for Branch Controller Masters
- WAN Failure (Authentication) Survivability
- WAN Health Check
- WAN Optimization through IP Payload Compression
- Interface Bandwidth Contracts
- Branch Integration with a Palo Alto Networks (PAN) Portal
- Branch Controller Routing Features
- Cloud Management
- Zero-Touch Provisioning
- Using Smart Config to create a Branch Config Group
- PortFast and BPDU Guard
- Preventing WAN Link Failure on Virtual APs
- Branch WAN Dashboard
802.1X Authentication
- Understanding 802.1X Authentication
- Configuring 802.1X Authentication
- Enabling 802.1X Supplicant Support on an AP
- Sample Configurations
- Performing Advanced Configuration Options for 802.1X
- Application Single Sign-On Using L2 Authentication
- Device Name as User Name for Non-802.1X Authentication
Stateful and WISPr Authentication
- Working With Stateful Authentication
- Working With WISPr Authentication
- Understanding Stateful Authentication Best Practices
- Configuring Stateful 802.1X Authentication
- Configuring Stateful NTLM Authentication
- Configuring Stateful Kerberos Authentication
- Configuring WISPr Authentication
Certificate Revocation
- Understanding OCSP and CRL
- Configuring the Controller as an OCSP Client
- Configuring the Controller as a CRL Client
- Configuring the Controller as an OCSP Responder
- Certificate Revocation Checking for SSH Pubkey Authentication
- OCSP Configuration for VIA
Captive Portal Authentication
- Understanding Captive Portal
- Configuring Captive Portal in the Base Operating System
- Using Captive Portal with a PEFNG License
- Sample Authentication with Captive Portal
- Configuring Guest VLANs
- Configuring Captive Portal Authentication Profiles
- Enabling Optional Captive Portal Configurations
- Personalizing the Captive Portal Page
- Creating and Installing an Internal Captive Portal
- Creating Walled Garden Access
- Enabling Captive Portal Enhancements
- Netdestination for AAAA Records
Virtual Private Networks
- Planning a VPN Configuration
- Working with VPN Authentication Profiles
- Configuring a Basic VPN for L2TP/IPsec
- Configuring a VPN for L2TP/IPsec with IKEv2
- Configuring a VPN for Smart Card Clients
- Configuring a VPN for Clients with User Passwords
- Configuring Remote Access VPNs for XAuth
- Working with Remote Access VPNs for PPTP
- Working with Site-to-Site VPNs
- Working with VPN Dialer
Roles and Policies
- Configuring Firewall Policies
- User Roles
- Assigning User Roles
- Understanding Global Firewall Parameters
- Using AppRF 2.0
ClearPass Policy Manager Integration
- Introduction
- Important Points to Remember
- Enabling Downloadable Role on a Controller
- Sample Configuration
Virtual APs
- Virtual AP Configuration Workflow
- Virtual AP Profiles
- Changing a Virtual AP Forwarding Mode
- Radio Resource Management (802.11k)
- BSS Transition Management (802.11v)
- Fast BSS Transition ( 802.11r)
- SSID Profiles
- WLAN Authentication
- High-Throughput Virtual APs
- Guest WLANs
- Changing a Virtual AP Forwarding Mode
Adaptive Radio Management
- Understanding ARM
- Client Match
- ARM Coverage and Interference Metrics
- Configuring ARM Profiles
- Assigning an ARM Profile to an AP Group
- Using Multi-Band ARM for 802.11a/802.11g Traffic
- Band Steering
- Dynamic Bandwidth Switch
- Enabling Traffic Shaping
- Spectrum Load Balancing
- Reusing Channels to Control RX Sensitivity Tuning
- Configuring Non-802.11 Noise Interference Immunity
- Troubleshooting ARM
Wireless Intrusion Prevention
- Working with the Reusable Wizard
- Monitoring the Dashboard
- Detecting Rogue APs
- Working with Intrusion Detection
- Configuring Intrusion Protection
- Configuring the WLAN Management System
- Understanding Client Blacklisting
- Working with WIP Advanced Features
- Configuring TotalWatch
- Administering TotalWatch
- Tarpit Shielding Overview
- Configuring Tarpit Shielding
Access Points
- Important Points to Remember
- Basic Functions and Features
- AP Settings Triggering a Radio Restart
- Naming and Grouping APs
- Understanding AP Configuration Profiles
- Before you Deploy an AP
- Enable Controller Discovery
- Enable DHCP to Provide APs with IP Addresses
- AP Provisioning Profiles
- Configuring Installed APs
- Optional AP Configuration Settings
- RF Management
- Optimizing APs Over Low-Speed Links
- AP Scanning Optimization
- Channel Group Scanning
- Configuring AP Channel Assignments
- Managing AP Console Settings
- Link Aggregation Support on W-AP220 Series, W-AP270 Series, and W-AP320 Series
- Recording Consolidated AP-Provisioned Information
- Service Tag
Secure Enterprise Mesh
- Mesh Overview Information
- Mesh Configuration Procedures
- Understanding Mesh Access Points
- Understanding Mesh Links
- Understanding Mesh Profiles
- Understanding Remote Mesh Portals (RMPs)
- Understanding the AP Boot Sequence
- Mesh Deployment Solutions
- Mesh Deployment Planning
- Configuring Mesh Cluster Profiles
- Creating and Editing Mesh Radio Profiles
- Creating and Editing Mesh High-Throughput SSID Profiles
- Configuring Ethernet Ports for Mesh
- Provisioning Mesh Nodes
- Verifying Your Mesh Network
- Configuring Remote Mesh Portals (RMPs)
Increasing Network Uptime Through Redundancy and VRRP
- High Availability
- VRRP-Based Redundancy
- High Availability Deployment Models
- Client State Synchronization
- High Availability Inter-Controller Heartbeats
- High Availability Extended Controller Capacity
- Configuring High Availability
- Migrating from VRRP or Backup-LMS Redundancy
- Configuring VRRP Redundancy
RSTP
- Understanding RSTP Migration and Interoperability
- Working with Rapid Convergence
- Configuring RSTP
- Troubleshooting RSTP
PVST+
- Understanding PVST+ Interoperability and Best Practices
- Enabling PVST+ in the CLI
- Enabling PVST+ in the WebUI
Link Layer Discovery Protocol
- Important Points to Remember
- LLDP Overview
- Configuring LLDP
- Monitoring LLDP Configuration
IP Mobility
- Understanding Dell Mobility Architecture
- Configuring Mobility Domains
- Tracking Mobile Users
- Configuring Advanced Mobility Functions
- Understanding Bridge Mode Mobility Deployments
- Enabling Mobility Multicast
External Firewall Configuration
- Understanding Firewall Port Configuration Among Dell Devices
- Enabling Network Access
- Ports Used for Virtual Internet Access (VIA)
- Configuring Ports to Allow Other Traffic Types
Palo Alto Networks Firewall Integration
- Limitation
- Preconfiguration on the PAN Firewall
- Configuring PAN Firewall Integration
Remote Access Points
- About Remote Access Points
- Configuring the Secure Remote Access Point Service
- Deploying a Branch/Home Office Solution
- Enabling Remote AP Advanced Configuration Options
- Understanding Split Tunneling
- Understanding Bridge
- Provisioning Wi-Fi Multimedia
- Reserving Uplink Bandwidth
- Provisioning 4G USB Modems on Remote Access Points
- Provisioning RAPs at Home
- Configuring W-IAP3WN and W-IAP3WNP Access Points
- Converting an IAP to RAP or CAP
- Enabling Bandwidth Contract Support for RAPs
- RAP TFTP Image Upgrade
Virtual Intranet Access
Spectrum Analysis
- Understanding Spectrum Analysis
- Creating Spectrum Monitors and Hybrid APs
- Connecting Spectrum Devices to the Spectrum Analysis Client
- Configuring the Spectrum Analysis Dashboards
- Customizing Spectrum Analysis Graphs
- Working with Non-Wi-Fi Interferers
- Understanding the Spectrum Analysis Session Log
- Viewing Spectrum Analysis Data
- Recording Spectrum Analysis Data
- Troubleshooting Spectrum Analysis
Dashboard Monitoring
- WAN
- Performance
- Usage
- Potential Issues
- Traffic Analysis
- AirGroup
- Security
- UCC
- Controller
- WLANs
- Access Points
- Clients
- Firewall
Management Access
- Configuring Certificate Authentication for WebUI Access
- Secure Shell (SSH)
- WebUI Session Timer
- Enabling RADIUS Server Authentication
- Connecting to an W-AirWave Server
- Custom Certificate Support for RAP
- Implementing a Specific Management Password Policy
- Configuring AP Image Preload
- Configuring Centralized Image Upgrades
- Managing Certificates
- Configuring SNMP
- Enabling Capacity Alerts
- Configuring Logging
- Enabling Guest Provisioning
- Managing Files on the Controller
- Setting the System Clock
- ClearPass Profiling with IF-MAP
- Whitelist Synchronization
- Downloadable Regulatory Table
802.11u Hotspots
- Hotspot 2.0 Pre-Deployment Information
- Hotspot Profile Configuration Tasks
- Hotspot 2.0 Overview
- Configuring Hotspot 2.0 Profiles
- Configuring Hotspot Advertisement Profiles
- Configuring ANQP Venue Name Profiles
- Configuring ANQP Network Authentication Profiles
- Configuring ANQP Domain Name Profiles
- Configuring ANQP IP Address Availability Profiles
- Configuring ANQP NAI Realm Profiles
- Configuring ANQP Roaming Consortium Profiles
- Configuring ANQP 3GPP Cellular Network Profiles
- Configuring H2QP Connection Capability Profiles
- Configuring H2QP Operator Friendly Name Profiles
- Configuring H2QP Operating Class Indication Profiles
- Configuring H2QP WAN Metrics Profiles
Adding Local Controllers
- Moving to a Multi-Controller Environment
- Configuring Local Controllers
- Uplink Monitoring and Management
Voice and Video
- Voice and Video License Requirements
- Configuring Voice and Video
- Working with QoS for Voice and Video
- Unified Communication and Collaboration
- Understanding Extended Voice and Video Features
- Advanced Voice Troubleshooting
AirGroup
- Zero Configuration Networking
- AirGroup Solution
- AirGroup Deployment Models
- Features Supported in AirGroup
- ClearPass Policy Manager and ClearPass Guest Features
- Auto-association and Controller-based Policy
- Best Practices and Limitations
- Integrated Deployment Model
- Controller Dashboard Monitoring
- Configuring the AirGroup-CPPM Interface
- Bluetooth-Based Discovery and AirGroup
- AirGroup mDNS Static Records
- mDNS AP VLAN Aggregation
- mDNS Multicast Response Propagation
- Troubleshooting and Log Messages
Instant AP VPN Support
- Overview
- VPN Configuration
- Viewing Branch Status
External Services Interface
- Sample ESI Topology
- Understanding the ESI Syslog Parser
- Configuring ESI
- Sample Route-Mode ESI Topology
- Sample NAT-mode ESI Topology
- Understanding Basic Regular Expression (BRE) Syntax
External User Management
- Overview
- How the ArubaOS XML API Works
- Creating an XML Request
- XML Response
- Using the XML API Server
- Sample Scripts
Behavior and Defaults
- Understanding Mode Support
- Understanding Basic System Defaults
- Understanding Default Management User Roles
- Understanding Default Open Ports
DHCP with Vendor-Specific Options
- Configuring a Windows-Based DHCP Server
- Enabling DHCP Relay Agent Information Option (Option 82)
- Enabling Linux DHCP Servers
802.1X Configuration for IAS and Windows Clients
- Configuring Microsoft IAS
- Configuring Management Authentication using IAS
- Window XP Wireless Client Sample Configuration
Acronyms and Terms
- Acronyms
- Terms

IP Mask Gateway Cost VLAN Flags

--------------- --------------- --------------- ---- ---- -----

0.0.0.0 0.0.0.0 10.15.149.25 0 0

0.0.0.0 128.0.0.0 192.100.2.3 0 0 T

128.0.0.0 128.0.0.0 192.100.2.3 0 0 T

192.168.10.0 255.255.254.0 192.168.10.1 0 3333 D

201.201.203.0 255.255.255.192 0.0.0.0 0 103 LP

10.15.149.24 255.255.255.248 10.15.149.30 0 1 L

10.15.231.186 255.255.255.255 10.15.149.25 0 0

Route Cache Entries

-------------------

Flags: L - local, P - Permanent, T - Tunnel, I - IPsec, M - Mobile, A - ARP, D - Drop

IP MAC VLAN Flags

--------------- ----------------- ----------- -----

202.202.202.6 00:00:00:00:00:00 0 T

192.100.2.3 00:00:00:00:00:00 0 PT

192.168.10.51 10:40:F3:98:80:94 1 PA

192.168.10.1 00:24:6C:C9:27:A3 3333 LP

201.201.203.8 00:26:C6:52:6B:14 103

201.201.203.1 00:24:6C:C9:27:A3 103 LP

10.1.1.50 00:00:00:00:00:00 0 T

5.5.0.2 00:24:6C:C9:27:A3 1 LP

10.15.149.30 00:24:6C:C9:27:A3 1 LP

10.15.149.25 00:0B:86:40:93:00 1 A

(host)# show clients

Client List

-----------

Name IP Address MAC Address OS Network Access Point Channel Type Role

Signal Speed (mbps)

---- ---------- ----------- -- ------- ------------ ------- ---- ----

------ ------------

201.201.203.8 00:26:c6:52:6b:14 149.30 00:24:6c:c9:27:a3 48- AN 149.30 43

(good) 6(poor)

Info timestamp :80259

RAPNG AP-3

(host)# show vpn status

profile name:default

--------------------------------------------------

current using tunnel :primary tunnel

ipsec is preempt status :disable

ipsec is fast failover status :disable

ipsec hold on period :600

ipsec tunnel monitor frequency (seconds/packet) :5

ipsec tunnel monitor timeout by lost packet cnt :2

ipsec primary tunnel crypto type :Cert

ipsec primary tunnel peer address :10.15.231.178

ipsec primary tunnel peer tunnel ip :192.100.2.2

ipsec primary tunnel ap tunnel ip :4.4.0.2

ipsec primary tunnel current sm status :Up

ipsec primary tunnel tunnel status :Up

ipsec primary tunnel tunnel retry times :13

ipsec primary tunnel tunnel uptime :1 hour 55 minutes 6 seconds

ipsec backup tunnel crypto type :Cert

ipsec backup tunnel peer address :10.15.231.186

ipsec backup tunnel peer tunnel ip :0.0.0.0

ipsec backup tunnel ap tunnel ip :0.0.0.0

ipsec backup tunnel current sm status :Init

ipsec backup tunnel tunnel status :Down

ipsec backup tunnel tunnel retry times :0

ipsec backup tunnel tunnel uptime :0

Dell Networking W-Series ArubaOS 6.5.x | User Guide OSPFv2 |

170