Users Guide

AP to verify that it is not compromised. If an AP is in this state due to connectivity problems, then the AP
recovers and is taken out of this hold state as soon as connectivity is restored.
Disabling Control Plane Security
If you disable control plane security on a standalone or local controller, all APs connected to that controller
reboot then reconnect to the controller over a clear channel.
If your disable control plane security on a master controller, APs directly connected to the master controller
reboot then reconnect to the master controller over a clear channel. However, its local controllers continue to
communicate with their APs over a secure channel until you save your configuration on the master controller.
Once you save the configuration, the changes are pushed down to the local controllers. At that point, any APs
connected to the local controllers also reboot and reconnect over a clear channel.
Verifying Whitelist Synchronization
To verify that a network of master and local controllers are correctly sharing their campus AP whitelists, check
the sequence numbers on the master and local controller whitelists.
l The sequence number value on a master controller should be the same as the remote sequence number on
the local controller.
l The sequence number value on a local controller should be the same as the remote sequence number on
the master controller.
Figure 8 Sequence numbers on Master and Local Controllers
Rogue APs
If you enable auto certificate provisioning enabled with the Auto Cert Allow All option, any AP that appears
on the network receives a certificate. If you notice unwanted or rogue APs connecting to your controller via an
IPsec tunnel, verify that automatic certificate provisioning has been disabled, then manually remove the
unwanted APs by deleting their entries from the campus AP whitelist.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Control Plane Security |
74