Aruba IAP-135 User guide

Instant Access Point

6.2.1.0-3.3

User Guide

2| Aruba Instant 6.2.1.0-3.3 | User Guide

Copyright

Networks®, the registered Aruba the Mobile Edge Company logo, Aruba Mobility Management System®, Mobile Edge

are the property of their respective owners.

Open Source Code

Certain Aruba products include Open Source software code developed by third parties, including software code subject to

the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open Source Licenses.

reserved.This product includes software developed by Lars Fenneberg et al. The Open Source code used can be found at

this site:

http://www.arubanetworks.com/open_source

Legal Notice

The use of Aruba Networks, Inc. switching platforms and software, by all individuals or corporations, to terminate other

vendors’ VPN client devices constitutes complete acceptance of liability by that individual or corporation for this action and

indemnifies, in full, Aruba Networks, Inc. from any and all legal actions that might be taken against it with respect to

infringement of copyright on behalf of those vendors.

Warranty

This hardware product is protected by the standard Aruba warranty of one year parts/labor. For more information, refer to

the ARUBACARE SERVICE AND SUPPORT TERMS AND CONDITIONS.

Altering this device (such as painting it) voids the warranty.

Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 3

Contents

Contents 3

About this Guide 21

Intended Audience 21

Related Documents 21

Conventions 21

Contacting Support 22

About Aruba Instant 23

Aruba Instant Overview 23

Supported Devices 23

Instant UI 24

Instant CLI 24

What is New in Aruba Instant 6.2.1.0-3.3 24

Initial Configuration 27

Setting up Instant Network 27

Connecting an IAP 27

Assigning an IP address to the IAP 27

Assigning a Static IP 27

Connecting to a Provisioning Wi-Fi Network 28

IAP Cluster 28

Disabling the Provisioning Wi-Fi Network 28

Logging in to the Instant UI 29

Specifying Country Code 29

Accessing the Instant CLI 30

Connecting to a CLI Session 30

Applying Configuration Changes 31

Example: 31

Using Sequence Sensitive Commands 31

Instant User Interface 33

Banner 33

4| Contents Aruba Instant 6.2.1.0-3.3 | User Guide

Search 33

Tabs 33

Networks Tab 34

Access Points Tab 34

Clients Tab 35

Links 35

New Version Available 35

System 36

RF 37

Security 38

Maintenance 39

Help 40

More 40

VPN 40

IDS 41

Wired 42

Services 42

DHCP Server 43

Support 44

Logout 44

Monitoring 44

Info 45

RF Dashboard 46

RF Trends 47

Usage Trends 48

Mobility Trail 52

Spectrum 53

Alerts 53

IDS 56

Configuration 57

AirGroup 57

Language 58

AirWave Setup 58

Pause/Resume 58
Views 58
Basic Configuration Procedures 61
Updating IP Address of an IAP 61
In the Instant UI 61
In the CLI 62
Modifying the IAP Name 62
In the Instant UI 62
In the CLI 62
Updating Location Details of an IAP 62
In the Instant UI 62
In the CLI 62
Configuring External Antenna 63
EIRP and Antenna Gain 63
Configuring Antenna Gain 63
In the Instant UI 63
In the CLI 64
Upgrading an IAP 64
Upgrading an IAP Using AirWave and Image Server 64
Image Management Using AirWave 64
Image Management Using Cloud Server 64
Upgrading anIAP Using Automatic Image Check 64
Upgrading to a New Version Manually 65
Upgrading an Image Using CLI 65
Enabling Terminal Access 66
In the Instant UI 66
In the CLI 66
Enabling Auto Join Mode 66
Disabling Auto Join Mode 66
Adding an IAP to the Network 66
Removing an IAP from the Network 67
Configuring a Preferred Band 67
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 5

6| Contents Aruba Instant 6.2.1.0-3.3 | User Guide
In the Instant UI 67
In the CLI 67
Configuring Radio Profiles for an IAP 67
Configuring ARMAssigned Radio Profiles for an IAP 67
Configuring Radio Profiles Manually for an IAP 68
In the CLI 68
Configuring Inter-user Bridging and Local Routing 68
In the Instant UI 68
In the CLI 69
Configuring Uplink for an IAP 69
In the Instant UI 69
In the CLI 69
Configuring an NTP Server 69
In the Instant UI 70
In the CLI 70
Virtual Controller Configuration 71
Virtual Controller Overview 71
Master Election Protocol 71
Preference to an IAP with 3G/4G Card 71
Preference to an IAP with Non-Default IP 71
Virtual Controller IP Address Configuration 71
Configuring Name and IP Address for Virtual Controller 72
In the Instant UI 72
In the CLI 72
Mesh IAP Configuration 73
Mesh Network Overview 73
Mesh IAPs 73
Mesh Portals 73
Mesh Points 74
Setting up Instant Mesh Network 74
Wireless Network Profiles 75
Understanding Wireless Network Profiles 75

Network Types 75
Configuring WLAN Settings for an SSID Profile 76
In the Instant UI 76
In the CLI 78
Configuring VLAN Settings for a WLAN SSID Profile 79
VLAN Pooling 79
Configuring VLAN Settings for an SSID Profile 79
In the Instant UI 79
In the CLI 80
Configuring Security Settings for a WLAN SSID Profile 80
Configuring Security Settings for an Employee or Voice Network 81
In the Instant UI 81
Configuring Enterprise Security Level 81
Configuring Personal Security Level 83
Configuring Open Security Level 84
In the CLI 85
Configuring Security Settings for Guest Network 85
In the Instant UI 85
In the CLI 86
Configuring Access Rules for a WLAN SSID Profile 87
In the Instant UI 87
In the CLI 87
Editing Status of a WLAN SSID Profile 88
In the Instant UI 88
In the CLI 88
Configuring Additional WLAN SSIDs 88
Enabling the Extended SSID 89
In the Instant UI 89
In the CLI 89
Editing a WLAN SSID Profile 89
Deleting a WLAN SSID Profile 89
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 7

8| Contents Aruba Instant 6.2.1.0-3.3 | User Guide
Uplink Configuration 91
Understanding Uplink Interfaces 91
Ethernet Uplink 92
3G/4G Uplink 93
Types of Modems 93
Wi-Fi Uplink 95
Configuring Uplinks 95
Configuring Cellular Uplink Profiles 96
In the Instant UI 96
In the CLI 96
Configuring a Wi-Fi Uplink Profile 98
Configuring PPPoE Uplink Profile 99
In the Instant UI 99
In the CLI 99
Configuring Uplink Preferences and Switching 100
Enforcing Uplinks 100
In the Instant UI 100
In the CLI 100
Setting an Uplink Priority 100
In the Instant UI 100
In the CLI 101
Enabling Uplink Preemption 101
In the Instant UI 101
In the CLI 101
Switching Uplinks Based on VPN and Internet Availability 101
Switching Uplinks Based on VPN Status 101
Switching Uplinks Based on Internet Availability 102
In the Instant UI 102
In the CLI 102
Viewing Uplink Status and Configuration 102
Wired Profiles 105
Configuring a Wired Profile 105
Configuring Wired Settings 105

In the Instant UI 105
In the CLI 106
Configuring VLAN for a Wired Profile 106
In the Instant UI 106
In the CLI 107
Configuring Security Settings for a Wired Profile 107
Configuring Security Settings for a Wired Employee Network 107
In the Instant UI 107
In the CLI 108
Configuring Security Settings for a Wired Guest Network 108
In the Instant UI 108
In the CLI 109
Configuring Access Rules for a Wired Profile 109
In the Instant UI 109
In the CLI 110
Understanding Hierarchical Deployment 110
Configuring Wired Bridging on Ethernet 0 111
In the Instant UI 111
In the CLI 111
Assigning a Profile to Ethernet Ports 112
In the Instant UI 112
In the CLI 112
Editing a Wired Profile 112
Deleting a Wired Profile 112
Authentication 113
Understanding Authentication Methods 113
Supported Authentication Servers 115
External RADIUS Server 115
RADIUS Server Authentication with VSA 115
Internal RADIUS Server 115
Authentication Termination on IAP 116
Understanding Encryption Types 116
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 9

10 | Contents Aruba Instant 6.2.1.0-3.3 | User Guide
WPA and WPA2 116
Recommended Authentication and Encryption Combinations 117
Understanding Authentication Survivability 117
Configuring Authentication Servers 120
Configuring an External Server for Authentication 120
In the Instant UI 120
In the CLI 122
Enabling RADIUS Server Support 123
In the Instant UI 123
In the CLI 123
Configuring Authentication Parameters for Virtual Controller Management Interface 123
In the Instant UI 123
In the CLI 124
Configuring Users 125
In the Instant UI 125
In the CLI 126
Configuring 802.1X Authentication for a Network Profile 126
Configuring 802.1X authentication for a Wireless Network Profile 126
In the Instant UI 127
In the CLI 127
Configuring 802.1X authentication for Wired Profiles 127
In the Instant UI 127
In the CLI 128
Configuring MAC Authentication for a Network Profile 128
Configuring MAC Authentication for Wireless Network Profiles 128
In the Instant UI 128
In the CLI 128
Configuring MAC Authentication for Wired Profiles 129
In the Instant UI 129
In the CLI 129
Configuring MAC Authentication with 802.1X Authentication 129
Configuring MAC and 802.1X Authentication for a Wireless Network Profile 129

In the Instant UI 129
In the CLI 130
Configuring MAC and 802.1X Authentication for Wired Profiles 130
In the Instant UI 130
In the CLI 130
Configuring Captive Portal Authentication 131
Configuring Internal Captive Portal for Guest Network 131
Configuring Internal Captive Portal Authentication for Wireless Network Profile 131
In the Instant UI 131
In the CLI 132
Configuring Internal Captive Portal Authentication for a Wired Profile 132
In the Instant UI 133
In the CLI 133
Customizing a Splash Page Design 133
In the Instant UI 134
In the CLI 134
Configuring External Captive Portal for a Guest Network 134
Configuring External Captive Portal Authentication for a Network Profile 135
In the Instant UI 135
In the CLI 136
Configuring External Captive Portal Authentication Using ClearPass Guest 137
Creating a Web Login page in the ClearPass Guest 137
Configuring the RADIUS Server in Instant 137
Disabling Captive Portal Authentication 138
Configuring MAC Authentication with Captive Portal Authentication 138
Configuring MAC Authentication with Captive Portal Authentication 138
In the Instant UI 138
In the CLI 138
Configuring Captive Portal Roles for an SSID with 802.1x authentication 139
In the Instant UI 139
In the CLI 141
Configuring Walled Garden Access 141
In the Instant UI 142
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 11

12 | Contents Aruba Instant 6.2.1.0-3.3 | User Guide
In the CLI 142
Configuring WISPr Authentication 142
In the Instant UI 143
In the CLI 143
Blacklisting Clients 143
Blacklisting Clients Manually 144
Adding a Client to the Blacklist 144
In the Instant UI 144
In the CLI 144
Blacklisting Users Dynamically 144
Authentication Failure Blacklisting 144
Session Firewall Based Blacklisting 144
Configuring Blacklist Duration 144
In the Instant UI 144
In the CLI 145
Uploading Certificates 145
Loading Certificates using Instant UI 145
Loading Certificates using AirWave 146
Roles and Policies 149
Instant Firewall Policies and Access Rules 149
Understanding Service Options 149
Understanding Destination Options 151
Extended Voice and Video Functionality 151
QoS for Microsoft Office OCS and Apple Facetime 151
Microsoft OCS 152
Apple Facetime 152
Configuring Access Rules 152
In the Instant UI 152
In the CLI 153
Configuring Source NAT 153
Enabling Source NAT 154
Configuring Source-Based Routing 154

Examples for Access Rules 154
Allow POP3 Service to a Particular Server 154
Allow TCP Service to a Particular Network 155
Deny FTP Service except to a Particular Server 155
Deny bootp Service except to a Particular Network 155
Configuring ALG Protocols 156
In the Instant UI 156
In the CLI 157
Configuring Firewall Settings for Protection from ARP Attacks 157
In the Instant UI 157
In the CLI 158
Configuring User Roles 158
Creating a User Role 159
In the Instant UI 159
In the CLI 159
Configuring Machine and User Authentication Roles 159
In the Instant UI 159
In the CLI 160
Configuring Role Assignment Rules 160
Understanding Role Assignment Rules 160
MAC-Address Attribute 160
DHCP Option and DHCP Fingerprinting 160
802.1X-Authentication-Type 161
Creating Role Assignment Rules 161
In the Instant UI 161
In the CLI 162
Configuring VLAN Assignment Rules 162
Understanding VLAN Assignment 162
Vendor Specific Attributes (VSA) 162
Supported VSAs 163
VLAN Derivation Rule 167
User Role 167
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 13

14 | Contents Aruba Instant 6.2.1.0-3.3 | User Guide
VLANs Created for an SSID 167
Configuring VLAN Derivation Rules 167
In the Instant UI 167
In the CLI 168
Configuring a User Role for VLAN Derivation 169
Creating a User VLAN Role 169
In the Instant UI 169
In the CLI 170
Assigning User VLAN Roles to a Network Profile 170
In the Instant UI 170
In the CLI 171
Mobility and Client Management 173
Layer-3 Mobility Overview 173
Configuring L3-Mobility 174
Home Agent Load Balancing 174
Configuring a Mobility Domain for Instant 174
In the Instant UI 174
In the CLI 175
Spectrum Monitor 177
Understanding Spectrum Data 177
Device List 177
Non Wi-Fi Interferers 178
Channel Details 179
Channel Metrics 180
Spectrum Alerts 181
Configuring Spectrum Monitors and Hybrid IAP to Hybrid IAPs 182
Converting anIAP to Hybrid IAP 182
In the Instant UI 182
In the CLI 182
Converting anIAP to a Spectrum Monitor 183
In the Instant UI 183
In the CLI 183

Adaptive Radio Management 185
ARM Overview 185
Channel or Power Assignment 185
Voice Aware Scanning 185
Load Aware Scanning 185
Band Steering Mode 185
Spectrum Load Balancing 185
Airtime Fairness Mode 186
Access Point Control 186
Monitoring the Network with ARM 186
ARM Metrics 187
Configuring ARM Features on an IAP 187
In the Instant UI 187
In the CLI 189
Configuring Radio Settings for an IAP 191
In the Instant UI 191
In the CLI 192
Intrusion Detection 195
Detecting and Classifying Rogue APs 195
OS Fingerprinting 195
Configuring Wireless Intrusion Protection and Detection Levels 196
Containment Methods 200
Configuring IDSUsing CLI 200
Content Filtering 203
Content Filtering 203
Enabling Content Filtering 203
Enabling Content Filtering for a Wireless Profile 203
In the Instant UI 203
In the CLI 203
Enabling Content Filtering for a Wired Profile 204
In the Instant UI 204
In the CLI 204
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 15

16 | Contents Aruba Instant 6.2.1.0-3.3 | User Guide
Configuring Enterprise Domains 204
In the Instant UI 204
In the CLI 204
Configuring OpenDNS Credentials 204
In the Instant UI 205
In the CLI 205
DHCP Configuration 207
Understanding DHCP Assignment Modes 207
Configuring DHCP Scopes 208
Configuring Distributed DHCP Scopes 208
In the Instant UI 208
In the CLI 210
Configuring Local, Local,L3, and Centralized,L2 DHCP Scopes 211
In the Instant UI 211
In the CLI 213
Configuring DHCP Server for Client IP Assignment 213
In the Instant UI 213
In the CLI 214
VPN Configuration 215
Understanding VPN Features 215
Configuring a Tunnel from Virtual Controller to Aruba Mobility Controllers 215
In the Instant UI 215
In the CLI 216
Configuring Routing Profiles 217
In the Instant UI 217
In the CLI 218
IAP-VPN Configuration 219
Overview 219
Termination of IPSec and GRE VPNTunnels 219
L2/L3 Forwarding Modes 219
IAP-VPN Scalability Limits 220
OSPFConfiguration 220

VPN Configuration 221

Whitelist Database Configuration 222

Controller Whitelist Database 222

External Whitelist Database 222

VPN Local Pool Configuration 222

Role Assignment for the Authenticated IAPs 222

VPN Profile Configuration 223

Viewing Branch Status 223

Example 223

AirWaveIntegration and Management 225

AirWave Features 225

Image Management 225

IAP and Client Monitoring 225

Template-based Configuration 225

Trending Reports 226

Intrusion Detection System 226

Wireless Intrusion Detection System (WIDS) Event Reporting to AirWave 226

RF Visualization Support forInstant 226

Configuring AirWave 227

Configuring Organization String 227

Shared Key 227

Configuring AirWave Information 228

In the Instant UI 228

In the CLI 228

Configuring for AirWave Discovery through DHCP 229

Standard DHCP option 60 and 43 on Windows Server 2008 229

Alternate Method for Defining Vendor-Specific DHCP Options 232

AirGroup Configuration 235

AirGroup Overview 235

AirGroup with Instant 236

AirGroup Solution 237

AirGroup Features 238

Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 17

18 | Contents Aruba Instant 6.2.1.0-3.3 | User Guide
CPPM and ClearPass Guest Features 239
AirGroup Components 239
Configuring AirGroup for Instant 239
Enabling or Disabling AirGroup 239
In the Instant UI 239
In the CLI 240
Configuring AirGroup and CPPM interface in Instant 241
Creating a RADIUS Server 242
Assign a Server to AirGroup 242
Configure CPPM to Enforce Registration 242
Change of Authorization (CoA) 242
Real Time Location Server Configuration 243
Configuring RTLS 243
In the Instant UI 243
In the CLI 243
Hotspot Profiles 245
Understanding Hotspot Profiles 245
Generic Advertisement Service (GAS) 245
Access Network Query Protocol (ANQP) 246
Hotspot 2.0 Query Protocol (H2QP) 246
Information Elements (IEs) and Management Frames 246
Access Network Types 246
NAI Realm List 247
Venue Types 247
Advertisement Profiles for a Hotspot 248
Configuring an NAI Realm Profile 249
Configuring a Venue Name Profile 250
Configuring a Network Authentication Profile 251
Configuring a Roaming Consortium Profile 251
Configuring a 3GPP Profile 251
Configuring an IP Address Availability Profile 252
Configuring a Domain Profile 252

Configuring H2QP Profiles 252
Configuring an Operator-friendly Profile 252
Configuring a Connection Capability Profile 252
Configuring an Operating Class Profile 253
Configuring a WAN Metrics Profile 253
Configuring a Hotspot Profile 253
Creating a Hotspot Profile 254
Associating a Hotspot Profile with an Advertisement Profile 255
Enabling a Hotspot Profile on a WLAN SSID 256
IAP Management 257
Configuring LED Display 257
In the Instant UI 257
In the CLI 257
Backing up and Restoring IAP Configuration Data 257
Viewing Current Configuration 257
Backing up Configuration Data 257
Restoring Configuration 258
Converting an IAP to a Remote AP and Campus AP 258
Converting an IAP to Remote AP 258
Converting an IAP using CLI 260
Converting an IAP to Campus AP 260
Converting an IAP to Standalone Mode 261
Converting an IAP using CLI 262
Resetting a Remote AP or Campus AP to an IAP 262
Rebooting the IAP 262
Monitoring Devices and Logs 265
Configuring SNMP 265
SNMP Parameters for IAP 265
Configuring SNMP 266
Creating community strings for SNMPv1 and SNMPv2 Using Instant UI 266
Creating community strings for SNMPv3 Using Instant UI 266
Configuring SNMP Community Strings in the CLI 267
Aruba Instant 6.2.1.0-3.3 | User Guide Contents | 19