Aruba Excellence Programme Wlan Controllers - Part 1: Presented by Michael Owen

ARUBA EXCELLENCE PROGRAMME
WLAN CONTROLLERS – PART 1

Presented by Michael Owen
7/20/21
CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Agenda
• WLAN Controller Overview

• Connecting Access Points
• Configuring the WLAN Controller
– Basic Pre-shared Key
– Practical lab
– 802.1X authentication
– Practical lab
– Guest Captive Portal
– Practical lab
– Using the Wizard
• Questions and Answers

What is a WLAN Controller?
Manage Configure
Control Protect
Guest Monitor

Connecting Access Points
Discovering the Controller

GRE Tunnel
1) DNS Record for aruba-master

2) DHCP Option 43 and 60
3) ADP

My AP doesn’t connect to the controller….
ACCESS POINT
CONNECTS
ACCESS POINT MAY

FAIL TO CONNECT

Resolving the issue

Discovery using DHCP Options 43 and 60

Converting Instant to Campus AP
Set the Controller IP

Address to be on
the SAME Layer 3
subnet as the AP

CONFIGURING THE WLAN
CONTROLLER
Virtual AP Workflow
User Role Set roles

Firewall AAA SSID
– Assign within AAA
Policy Profile Profile
FW Policy profile
Create VLAN Create VAP

Set Wireless Associate Associate AAA
(if design and associate
Security Type SSID with VAP with VAP
requires it) to VLAN
Associate Associate
Create Provision
VAP with AP with Test
Group AP
Group Group

Example Run Through – Pre Shared Key
• Creating a Pre-shared key secured SSID

• Create a user specific VLAN
• Provision an AP to advertise the SSID
• Associate Client
• Test and confirm correct IP address used

ARUBA EXCELLENCE PROGRAMME Firewall
Policy

User Role
ARUBA EXCELLENCE PROGRAMME – Assign
FW Policy

AAA
ARUBA EXCELLENCE PROGRAMME Profile

Set roles
ARUBA EXCELLENCE PROGRAMME within AAA
profile

SSID

ARUBA EXCELLENCE PROGRAMME Set Wireless
Security Type

Create VLAN
ARUBA EXCELLENCE PROGRAMME (if design
requires it)

Create VAP
ARUBA EXCELLENCE PROGRAMME and associate
to VLAN

Create VAP
to VLAN

ARUBA EXCELLENCE PROGRAMME Associate
SSID with VAP

ARUBA EXCELLENCE PROGRAMME Associate AAA
with VAP

Create
ARUBA EXCELLENCE PROGRAMME Group

Associate
ARUBA EXCELLENCE PROGRAMME VAP with
Group

Provision
ARUBA EXCELLENCE PROGRAMME AP

Provision
ARUBA EXCELLENCE PROGRAMME AP

Your next question is probably………
Can I have a copy of those slides??

Practical Lab RULES……PLEASE BE CAREFUL
1) DO NOT make changes to other Teams configuration
2) Mark your Team Config CLEARLY using TeamX-AAAProf, TeamX-SSID etc
3) DO NOT change the Default Profiles. Create your own using SAVE AS
4) If in doubt…..ASK before clicking APPLY
5) If I have to reload the Controller, it affects everyone
Classmarker.com Questions 1 to 4

Information
• Controller IP – 192.168.2.240
• Username – admin Password – aruba123

Example Run Through - 802.1X Security
• Lets change the Pre-shared Key SSID to use 802.1X

• Internal RADIUS Server
• Change your Current VAP rather than create a new one
• You will need to create internal user accounts

AAA

Set roles
profile

Set roles
profile

Set roles
profile

ARUBA EXCELLENCE PROGRAMME Set Wireless
Security Type

ARUBA EXCELLENCE PROGRAMME Associate AAA
with VAP

ARUBA EXCELLENCE PROGRAMME CREATE
USERS

ARUBA EXCELLENCE PROGRAMME CREATE
USERS

802.1X certificates and Windows
• The answer to the problem is GET A PUBLIC CERTIFICATE..

• However…..
• Here is something you can do within lab and test environments


• Windows does not trust privately issued certificates


• It will just keep trying different methods, but will ultimately fail


• Manually create the Wireless Network


• Manually create the Wireless Network


• Enter the SSID information


• Change the connection settings


• Change the connection settings


• UNCHECK – Validate Server Certificate


• Configure MSCHAPv2 Properties and UNCHECK Use my Windows
name and password


• Advanced Settings – specify authentication mode and save
username and password for the SSID


• OR……….

Classmarker.com Questions 5 and 6

Example Run Through - Guest Captive Portal
• Lets create a NEW VAP

• Use the Controller VLAN 99 for Guest Client IP address
• Use the configured DHCP Scope 172.16.99.0
• Guest Portal Customisation

Virtual AP Workflow
User Role Set roles

Firewall AAA SSID
– Assign within AAA
Policy Profile Profile
FW Policy profile
Create VLAN Create VAP

Set Wireless Associate Associate AAA
(if design and associate
Security Type SSID with VAP with VAP
requires it) to VLAN
Associate Associate
Create Provision
VAP with AP with Test
Group AP
Group Group

User Role
ARUBA EXCELLENCE PROGRAMME – Assign
FW Policy

AAA

Set roles
profile

SSID

Create VAP
to VLAN

Create VAP
ARUBA EXCELLENCE PROGRAMME Associate
Associate
and
SSID
AAA
associate
withwith
VAP
to VLAN
VAP

DHCP
ARUBA EXCELLENCE PROGRAMME Server

DHCP

DHCP

DHCP

Create
ARUBA EXCELLENCE PROGRAMME Users

Creating a
ARUBA EXCELLENCE PROGRAMME Portal

Creating a

Creating a

Classmarker.com Questions 7 to 9

Aruba Excellence Programme Wlan Controllers - Part 1: Presented by Michael Owen

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Aruba Excellence Programme Wlan Controllers - Part 1: Presented by Michael Owen

Uploaded by

Copyright:

Available Formats

ARUBA EXCELLENCE PROGRAMME

WLAN CONTROLLERS – PART 1

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

• WLAN Controller Overview

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

What is a WLAN Controller?

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Connecting Access Points

Discovering the Controller

1) DNS Record for aruba-master

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

My AP doesn’t connect to the controller….

ACCESS POINT MAY

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Resolving the issue

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Discovery using DHCP Options 43 and 60

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Converting Instant to Campus AP

Set the Controller IP

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

User Role Set roles

Create VLAN Create VAP

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Example Run Through – Pre Shared Key

• Creating a Pre-shared key secured SSID

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Your next question is probably………

Can I have a copy of those slides??

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Practical Lab RULES……PLEASE BE CAREFUL

1) DO NOT make changes to other Teams configuration

2) Mark your Team Config CLEARLY using TeamX-AAAProf, TeamX-SSID etc

4) If in doubt…..ASK before clicking APPLY

5) If I have to reload the Controller, it affects everyone

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

Example Run Through - 802.1X Security

• Lets change the Pre-shared Key SSID to use 802.1X

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved

CONFIDENTIAL © Copyright 2014. Aruba Networks, Inc. All rights reserved