Users Guide

222| BranchController Config for Controllers Dell Networking W-Series ArubaOS 6.5.x| User Guide
Inbound Interface Access Lists
In a branch controller environment, where an IPsec map defines the connections between the local branch
controllers and a master controller, the global routing ACL master-boc-traffic is applied to all IPsec maps
between the master and the branch controllers. If any branch controller requires a different ACL, access the
command-line interface of that branch controller and issue the command routing-policy-map branch <mac-
addr> access-list <acl> to associate a different ACL to the L3 GRE tunnel between that one branch controller
and its master. This local setting will override the global settings defined in the master-boc-traffic ACL.For more
information on configuring routing ACLs, see
Creating a Firewall Policy on page 371.
To immediately associate a branch controller to the secondary master without waiting for the switchover
timeout period to elapse, navigate to the Network>Controller>System settings page of the branch
controller WebUI, and click the Switchover link.
If a branch controller detects that the link to the primary master controller is active but the branch cannot properly
connect to the primary master due to a configuration error, the branch controller will wait for 10 minutes, then
reboot and attempt to reconnect to the primary master. After 10 failed reboot and reconnect attempts, the branch
controller will return to a factory default state and restart the provisioning process.
Cloud Management
ArubaOS enables the W-7000 Series controllers to be managed by Aruba Central at a future date.
All communication between the controllers and Central will be secured. The controllers can establish
connection with Central even if the controllers are behind NAT servers.
If the topology includes master and local controllers, a single master controller can communicate with Central.
In a master-local cluster topology, a local controller can communicate with both the master controller and
Central. The master controller will be the source for configuration data of the local controllers. Central manages
the local configuration on the local controller.
Zero-Touch Provisioning
Traditionally, the deployment of controllers was a multiple step process where the master controller
information and local configurations were first pre-provisioned. After the local controller connected to the
network, it established a secure tunnel to the master and downloaded the global configuration.
Zero touch provisioning makes the deployment of local controllers plug-n-play. The local controller now learns
the required information from the network and provisions itself automatically. A W-7000 Series branch
controller is a zero-touch provision (ZTP) controller that automatically gets its local and global configuration
and license limits from a central controller.
A controller does not need to be configured as a branch controller to be provisioned using ZTP.
ZTP offers the following advantages over a standard local controller:
l simple deployment
l reduced operational cost
l limits to provisioning errors
The main elements of ZTP are:
l auto discovery of the primary master (and optionally, backup master) controller.
l configuration download from the master controller