Author Archives: aek82

Aruba SD-Branch – Factory Reset and Initial Provisioning Debug Commands

Guidelines for factory resetting gateways or accessing the CLI during provisioning has changed quite a bit over the last few months. On a factory default gateway, you can log into the CLI with the following

If presented with the activate wizard, type: intdbg

If you have a username/password:

Username : branchsupport
Password: <mac address in lowercase with colons>

Factory Reset a Gateway

Easiest way if you have physical access is to hold down the reset button for 15 seconds

Unless its a model with no button. Last resort is to just format the boot partition via cpboot

format 0:2

Although, if you’re down this far the rabbit hole, I would contact TAC or an SE at this point.

References

https://community.arubanetworks.com/browse/articles/blogviewer?blogkey=0aef63d8-0668-4e5f-b41d-3f59409b9555

Troubleshooting Aruba SD-Branch DPS Policy

Commands for general telemetry

show wan session-counters 
show wan policy-list
show datapath wan probestats
show wan threshold-stats
show uplink stats
show user
show datapath session table | include <user ip>

In case you need to make sure things are still running

show boot history
show switchinfo
show process monitor statistics

AOS-S: Transceiver information

To display detailed interface transceiver diagnostic information, issue the following command:

(host) #show interface gigabitethernet 0/1/1 transceiver detail

To display detailed stacking interface transceiver diagnostic information, issue the following command:

(host) #show stacking interface stack 0/1 transceiver detail

To display basic transceiver information, issue the following command:

(host) #show interface transceiver brief 
#or... for a summary
#show tech transceivers

ArubaOS and Aruba SD-Branch Gateway: Packet Capturing on the Gateway’s CLI

packet-capture controlpath udp all
packet-capture copy-to-flash controlpath-pcap
dir

To Download

copy flash: <filename> tftp: <host> <destfilename>

To turn off

no packet-capture

To send to remote client with Wireshark. Make sure windows firewall is turned off.

Once the destination is set, the pcap will be streamed to the destination IP. Its assumed the client IP has permissions to receive traffic from the VLAN.

#get client mac
show user
#check if pcap is running
show packet-capture
#reset packet capture buffer
packet-capture reset-pcap datapath-pcap
#set target client
packet-capture datapath mac <clientmac addr> all
#set destination for pcap stream
packet-capture destination ip-address <client ip address>

Aruba Instant: IAP Packet Capture or Pcap

Get the BSSID first, part of pcap start command.

show ap monitor status

Start Pcap. @IPofcomputer is the ip address of the client that’s receiving the pcap stream.

pcap start BSSID @IPofcomputer UDPPort format size

Get pcap status

show pcap status

Stop pcap

pcap stop <bssid> <id>

Reference
https://community.arubanetworks.com/t5/Mobility-Hero-Tutorials/IAP-Using-remote-pcap-with-Wireshark/ta-p/178540


AOS-Switch PCAP with a SPAN port

Create “mirror” and interface to be used as the “SPAN” port or port used for packet capture. In this case port 8 will be used to receive packet captures

mirror 1 port 8

Mark ports to be monitored by SPAN port. Traffic from these ports will copied to the SPAN port for capture. In this example, interface or Ethernet port 1 will duplicate its traffic to the “mirror” or span port 1.

interface 1
monitor all both mirror 1

Connect a laptop to interface 8 on the switch and use wire shark or your PCAP client of choice to analyze traffic.

Aruba SD-Branch: Notes on Staging Dynamic Segmentation

These are a few notes that helped me configure tunneled node in a SD-Branch deployment

Access Switches on AOS Switch

The three types of VLANs:

Transit VLAN for GRE Tunnels – Keep in mind that the trunk ports for your APs and Switch to Switch uplinks should have the transit VLAN configured. (Jumbo frame, ip dhcp-client set)

Untagged (Native) VLAN for Client Access Ports – Some people leave it on VLAN 1 for various reasons. This is typically the “quarantine VLAN”. However, the VLAN ID and the initial role should be standardized. (no ip address, jumbo, ip helper address)

Client VLANs with no ip address – These VLANs are strictly layer 2 with no ip address. These are for segmenting clients into different subnets. Switch settings should be jumbo. (no ip address, jumbo, ip helper address)

Access Switch Protocol

This isn’t the official Aruba standard, but just a personal preference for standardizing access switch configuration.

SFP Ports and port 1 – set as switch to switch uplinks with transit VLAN as untagged.

Check and make sure client VLANs are set

Set native VLAN for client access ports

Set tunneled-node-server settings, and set interfaces between first and last as tunneled-node-server

Gateway, ClearPass Policy Manager and Device Insight Configuration

Its assumed basic setup has been completed prior.

Policy Manager – Create roles, role mapping, enforcement profile/policy

Device Insight – update tagging to profiled devices

Policy Manager – update role mapping to device insight tagging

Gateway – Match roles from policy manager and update associated policies

AOS-CX: Setting up management network on VRF and other basic setup

Aruba recommends setting up the management network on a VRF.

interface mgmt
no shutdown
ip static 10.251.1.4/24
default 10.251.1.254
exit

session-timeout 180
ssh server vrf mgmt
https-server vrf mgmt
https-server rest access-mode read-write
exit


session-timeout 0
user admin password

ip dns server-address 8.8.8.8 vrf mgmt
ntp server 10.251.1.15 iburst
ntp vrf mgmt
ntp enable
ntp authentication
ntp authentication-key 1 sha1 password trusted
clock timezone us/eastern
end

write memory
copy run checkpoint initial

AOS-CX: Configuring VSX

Configuring VSX is a bit more involved than VSF.

General Components:

  • ISL (Interswitch Link)
  • Keep Alive Mechanism
  • Active-Forwarding
  • Active-Gateway
  • Linkup-Delay
  • VSX LAG

On both members…make sure the two members are running the same port speeds:

system interface-group 4 speed 25g

sh int brief

Configure new LAG interface 10, add it to port 1/1/46

int lag 10
no routing
no shutdown
lacp mode active
lacp rate fast
vlan trunk allowed all
interface 1/1/46
no shutdown
lag 10

Configure VSX on LAG 10

On Primary

sh lacp interfaces
config t
vsx
system-mac 00:00:00:AB:CD:01
inter-switch-link lag 10
role primary

On Secondary

sh lacp interfaces
config t
vsx
system-mac 00:00:00:AB:CD:01
inter-switch-link lag 10
role secondary

On primary, check and see VSX members are peered and sync’d

show vsx brief
sh vsx status
sh vsx configuration inter-switch-link
SH VSX configuration inter-switch-link vsx-peer
show vsx config-consistency

For the keep alive, we’ll be using a VRF as part of the configuration. Keepalive will be configured on interface 1/1/47

On Primary

conf t
vrf keepalive
int 1/1/47
vrf attach keepalive
ip address 10.1.18.41/30
no shutdown
end
vsx
keepalive peer 10.1.18.42 source 10.1.18.41 vrf keepalive

On Secondary

conf t
vrf keepalive
int 1/1/47
vrf attach keepalive
ip address 10.1.18.42/30
no shutdown
end

vsx
keepalive peer 10.1.18.41 source 10.1.18.42 vrf keepalive

Next, configure the Active Gateway for vlan interface 14

On Primary

vlan 14
exit

int vlan 14
ip add 10.1.14.2/24
l3-counters
active-gateway ip 10.1.14.1 mac 00:00:00:00:10:FE
no shutdown
end

On Secondary

vlan 14
exit

int vlan 14
ip add 10.1.14.3/24
l3-counters
active-gateway ip 10.1.14.1 mac 00:00:00:00:10:FE
no shutdown


Last, configure LAG 12 from VSX Pair to VSF Stack or a switch via LACP. Tags VLAN 14

On Primary

int lag 12 multi-chassis
no routing
no shutdown
description To-VSF
vlan trunk allow all
lacp mode active
lacp rate fast
int 1/1/1-1/1/2
lag 12
no shutdown
end

On Secondary

int lag 12 multi-chassis
no routing
no shutdown
description To-VSF
vlan trunk allow all
lacp mode active
lacp rate fast
int 1/1/1-1/1/2
lag 12
no shutdown
end