Latest revision as of 02:51, 12 February 2024

Mobility Master

Definitions

MM: Mobility Master
MD: Managed Device (e.g., a controller)
CAP: Campus AP
RAP: Remote AP
IAP: Instant AP

MDC (md-connect) to an MD

First, find out which MD an AP is on:

(ArubaMM) [mynode] # show ap database | include greenhouse
(ArubaMM) [mynode] # cd cam4
(ArubaMM) [ab:cd:ef:12:34:56] # mdc

Access Points

Show AP Details

(Cam4) [MDC] # show ap details ap-name rap_greenhouse.wireless.fsu.edu

Show AP Config

(Cam4) [MDC] # show ap config ap-name rap_greenhouse.wireless.fsu.edu

Show AP Port Status

(Cam4) [MDC] # show ap debug port status ap-name rap_greenhouse.wireless.fsu.edu

Move AP to a different group

This will reboot the AP.

(ArubaMM) [mynode] # ap-regroup wired-mac [MAC address] [AP Group]

Show down AP's

(ArubaMM) [mynode] # show ap database long status down

Show Unprovisioned AP's

(ArubaMM) [mynode] # show ap database long unprovisioned

Factory Reset an AP, remotely

(ArubaMM) [mynode] # provision-ap reset-bootinfo [ip-addr|wired-mac]

Delete an AP from AP database

(ArubaMM) [mynode] # clear gap-db ap-name [ap-name] OR clear gap-db wired-mac [mac address]

Terminal Full-Access on an AP

Disable AP Console Protection in the AP System, if needed

At the AP's console prompt (~ #): hit ESC and then CTRL-K

Users

Show a user in the global user table

(ArubaMM) [mynode] # show global-user-table list name [username]

Delete a user from the user db

Obtain Client MAC and Current Switch from global user table (above). Then run in MDC:

(Cam3) [MDC] # aaa user delete mac [MAC address]

Show VLAN Derivation

Obtain Client IP and Current Switch from global user table (above). Then run in MDC:

(Cam3) [MDC] # show aaa debug vlan user ip [client-ip]

Debug User Auth Issues

config t
logging level debugging security process authmgr
logging level debugging security subcat aaa
wr mem
show log security 50

Packet Capture

The Controlpath contains packets destined for the MD. The Datapath contains packets that are being forwarded by the controller, i.e., packets from a wireless client.

Receive packet-capture from Aruba Controller

Aruba controller sends the remote packet-capture GRE-encapsulated.

On receiving box (e.g., 10.186.255.198): sudo tcpdump -ni ens224 proto gre -w capture.pcap
On controller: packet-capture destination ip-address 10.186.255.198
On controller: packet-capture datapath ipsec
On controller, when done: no packet-capture datapath ipsec

Cluster Redundancy

Check for Cluster L2 Redundancy

Must be executed on an MD that is part of a cluster; not on the MM.

show lc-cluster vlan-probe status

Exclude a VLAN from L2 Redundancy Check

Must be individually added to the config of every md in the cluster.

lc-cluster exclude-vlan "1,1607"

Convert CAP to IAP

Source: https://blog.theitrebel.com/2020/04/28/two-simple-words/

Campus AP Keeps Rebooting / Upgrade Failed

If a Campus AP keeps rebooting, and its serial console output shows:

SAPD: Reboot after image upgrade failed: 65280

Interrupt the AP boot and execute:

 apboot> osinfo
 Partition 0 does not contain a valid OS image
 
 Partition 1:
     image type: 0
   machine type: 40
           size: 7211308
        version: 6.4.4.0-wave2
   build string: ArubaOS version 6.4.4.0-wave2 for 32x (p4build@cyprus) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #49847 SMP Thu Apr 30 14:49:32 PDT 2015
          flags: preserve factory
            oem: aruba
 
 Image is signed; verifying checksum... passed
 Signer Cert OK
 Policy Cert OK
 RSA signature verified.

This means the problem is the old 6.4.4.0 firmware. You need to clear it:

apboot> clear all Checking OS image and flags Invalid image format version: 0x0 Continuing with OS clear 512 bytes written to volume aos0 Erasing flash sector @ 0x3a0000...OK

Device 0: nand0... is now current device Erasing UBIFS ...OK Remove UBI volume ubifs (id 0) Creating dynamic volume ubifs of size 63361024 Device 1: nand1... is now current device

Now tell the AP to boot and it should find mama (the Master):

apboot> boot

AirWave

ampcli

/usr/local/airwave/bin/ampcli

Restart AirWave services

amp_disable

amp_enable

Monitor services

Useful after a restart.

logs

tailf service_watcher

Find large files

find / -type f -size +1000M | xargs du -h | sort -nr

Delete kernel log file

truncate -s 0 kernel

@@ Line 1: / Line 1: @@
+=Mobility Master=
+==Definitions==
+; MM : Mobility Master
+; MD : Managed Device (e.g., a controller)
+; CAP : Campus AP
+; RAP : Remote AP
+; IAP : Instant AP
+==MDC (md-connect) to an MD==
+First, find out which MD an AP is on:
+# <code>(ArubaMM) [mynode] # show ap database | include greenhouse</code>
+# <code>(ArubaMM) [mynode] # cd cam4</code>
+# <code>(ArubaMM) [ab:cd:ef:12:34:56] # mdc</code>
+==Access Points==
+===Show AP Details===
+<code>(Cam4) [MDC] # show ap details ap-name rap_greenhouse.wireless.fsu.edu</code>
+===Show AP Config===
+<code>(Cam4) [MDC] # show ap config ap-name rap_greenhouse.wireless.fsu.edu</code>
+===Show AP Port Status===
+<code>(Cam4) [MDC] # show ap debug port status ap-name rap_greenhouse.wireless.fsu.edu</code>
+===Move AP to a different group===
+''This will reboot the AP.''
+<code>(ArubaMM) [mynode] # ap-regroup wired-mac [MAC address] [AP Group]</code>
+===Show down AP's===
+<code>(ArubaMM) [mynode] # show ap database long status down</code>
+===Show Unprovisioned AP's===
+<code>(ArubaMM) [mynode] # show ap database long unprovisioned</code>
+===Factory Reset an AP, remotely===
+<code>(ArubaMM) [mynode] # provision-ap reset-bootinfo [ip-addr|wired-mac]</code>
+===Delete an AP from AP database===
+<code>(ArubaMM) [mynode] # clear gap-db ap-name [ap-name] OR clear gap-db wired-mac [mac address]</code>
+===Terminal Full-Access on an AP===
+Disable AP Console Protection in the AP System, if needed
+At the AP's console prompt (~ #): hit ESC and then CTRL-K
+==Users==
+===Show a user in the global user table===
+<code>(ArubaMM) [mynode] # show global-user-table list name [username]</code>
+===Delete a user from the user db===
+Obtain Client MAC and Current Switch from global user table (above). Then run in MDC:
+<code>(Cam3) [MDC] # aaa user delete mac [MAC address]</code>
+===Show VLAN Derivation===
+Obtain Client IP and Current Switch from global user table (above). Then run in MDC:
+<code>(Cam3) [MDC] # show aaa debug vlan user ip [client-ip]</code>
+===Debug User Auth Issues===
+# <code>config t</code>
+# <code>logging level debugging security process authmgr</code>
+# <code>logging level debugging security subcat aaa</code>
+# <code>wr mem</code>
+# <code>show log security 50</code>
+==Packet Capture==
+The ''Controlpath'' contains packets destined for the MD. The ''Datapath'' contains packets that are being forwarded by the controller, i.e., packets from a wireless client.
+===Receive packet-capture from Aruba Controller===
+''Aruba controller sends the remote packet-capture GRE-encapsulated.''
+# On receiving box (e.g., 10.186.255.198): <code>sudo tcpdump -ni ens224 proto gre -w capture.pcap</code>
+# On controller: <code>packet-capture destination ip-address 10.186.255.198</code>
+# On controller: <code>packet-capture datapath ipsec</code>
+# On controller, when done: <code>no packet-capture datapath ipsec</code>
+==Cluster Redundancy==
+===Check for Cluster L2 Redundancy===
+''Must be executed on an MD that is part of a cluster; not on the MM.''
+<code>show lc-cluster vlan-probe status</code>
+===Exclude a VLAN from L2 Redundancy Check===
+''Must be individually added to the config of every md in the cluster.''
+<code>lc-cluster exclude-vlan "1,1607"</code>
 =Convert CAP to IAP=
@@ Line 11: / Line 112: @@
 Interrupt the AP boot and execute:
-<code>
+  apboot> osinfo
-apboot> osinfo
+  Partition 0 does not contain a valid OS image
-Partition 0 does not contain a valid OS image
+  Partition 1:
-Partition 1:
+      image type: 0
-    image type: 0
+    machine type: 40
-  machine type: 40
+            size: 7211308
-          size: 7211308
+         version: 6.4.4.0-wave2
-       version: 6.4.4.0-wave2
+    build string: ArubaOS version 6.4.4.0-wave2 for 32x (p4build@cyprus) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #49847 SMP Thu Apr 30 14:49:32 PDT 2015
-  build string: ArubaOS version 6.4.4.0-wave2 for 32x (p4build@cyprus) (gcc version 4.6.3 20120201 (prerelease) (Linaro GCC 4.6-2012.02) ) #49847 SMP Thu Apr 30 14:49:32 PDT 2015
+           flags: preserve factory
-         flags: preserve factory
+             oem: aruba
-           oem: aruba
+  Image is signed; verifying checksum... passed
-Image is signed; verifying checksum... passed
+  Signer Cert OK
-Signer Cert OK
+  Policy Cert OK
-Policy Cert OK
+  RSA signature verified.
-RSA signature verified.
-</code>
 This means the problem is the old 6.4.4.0 firmware. You need to clear it:
@@ Line 50: / Line 149: @@
 <code>apboot> boot</code>
+=AirWave=
+===ampcli===
+<code>/usr/local/airwave/bin/ampcli</code>
+===Restart AirWave services===
+<code>amp_disable</code>
+<code>amp_enable</code>
+===Monitor services===
+''Useful after a restart.''
+<code>logs</code>
+<code>tailf service_watcher</code>
+===Find large files===
+<code>find / -type f -size +1000M | xargs du -h | sort -nr</code>
+===Delete kernel log file===
+<code>truncate -s 0 kernel</code>

Aruba Wireless: Difference between revisions