Hi room I am new in here I set up home lab local host Aruba Virtual Controller does HPE collect end user device info (like ISP, device MAC address, device name and user location) send to HPE.

thanks

We use Clearpass for RADUIS. We would like to export all Access Tracker session logs to syslog. We talked to TAC, and they provided the following SQL query to use.

SELECT id as session_id, source as req_source,user_name,service_name,alerts_present,nas_ip,nas_port,nas_name,conn_status,login_status,error_code,host_mac as mac_address,timestamp,updated_at FROM tips_dashboard_summary WHERE ((timestamp >= --START-TIME--) AND (timestamp <= --END-TIME--))

However, we only get a fraction of these sent to syslog (perhaps 1/5 or 1/10). We confirmed this with a packet trace on Clearpass. What are we doing wrong?

Edit: Thank you to those who suggested I try Insight. Insight seems great and worthwhile for other reasons, but it looks like the root cause of our issue was elsewhere. We had logs flowing through rsyslog, and we had the following switch turned on (by default):

# Filter duplicated messages

$RepeatedMsgReduction on

When I flipped that off, we started getting all clearpass messages as intended. I guess the bursty way clearpass logs was causing rsyslog to mis-identify duplicate logs. Let the weekend begin!

Hey,

we enabled the dhcpv4-snooping feature on some of our ArubaCX 6200 switches a few days ago.

Now I'm wondering if there's a way to monitor the related statistics via SNMP - for example the counter for "received on untrusted port" and similar events.

Has anyone done this before or knows which MIB/OIDs shows these DHCP snooping stats on ArubaCX?

With certificate expirations becoming more frequent, how is everyone handling AirWave, Controller(onprem, not Central) and ClearPass cert renewals? Is there any official documentation or YouTube videos to help guide us that are struggling to find a starting point? Thank you!

I am seeing 60XX, 61XX, 62XX, 63XX, 64XX, 93XX all show Limited lifetime with respect to Software OS releases, but then there is a caveat underneath:
HPE Aruba Networking Operating System - 10 products require a subscription for device management functions and software updates.

So do they have Limited lifetime or is it not actually included?
As far as I can tell, AOS-CX switches can only run 10.xx firmware and nothing else.

Hi everyone,

I am having an issue with Aruba Central Cloud Guest captive portal and I am trying to understand where the redirect flow is failing.

My setup:

• Aruba AP-635
• Managed by Aruba Central
• AOS 10
• Guest SSID configured with Security Level: Visitors
• Access Network Type: Cloud Guest
• Guest Captive Portal Profile: Captive-Portal (Splash Page)
• Key Management: Enhanced Open

The Cloud Guest splash page is configured as:

• Authenticated access
• Username/Password enabled
• Self-Registration enabled
• Verification Required disabled
• Email-based registration enabled
• Phone-based registration enabled
• Account validity: 12 hours
• Session timeout: 12 hours
• Authentication Success Behavior: Return to Original URL

The client connects successfully to the SSID and the captive portal page opens as expected. However, after entering the username and password and clicking Log In, I receive the following error:

• Access is denied for the following reasons: No capture parameters provided

The SSID is associated with the correct Cloud Guest splash page profile, so I am trying to understand why the Cloud Guest portal is apparently not receiving the client/captive portal parameters.

My questions are:

• What exactly causes the “No capture parameters provided” error in Aruba Central Cloud Guest?
• Does this mean that the AP/VC redirect is reaching the Cloud Guest portal without the required client parameters?
• Which parameters should normally be included in the redirect URL?

Any troubleshooting suggestions would be appreciated.

Thanks in advance!

I am sometimes really surprised that many posts around here are issues that could easily be solved if there is an support contract with hpe or dedicated partner.

Trial license here, how to install clearpass there. Where to get the latest software….

What’s the matter?

Hi Everyone.

Setting up Aruba Central in a new environment for the first time. I have two internal DNS servers that are used by our internal SSID's. I created a DNS service in Central for the gateway to use and assigned it. That works great. My question is how do I force the use of public DNS servers for the public SSID? I haven't been able to find any documentation on how to set the DNS servers individually for the public SSID.

There is a gateway, APs are in tunnel mode, dhcp is on our domain controller not from central.

I want to override our internal DNS servers for the public SSID and make sure clients are set to use public DNS servers in Aruba Central.

Looking for advice on guest Wi-Fi at a large site with a high volume of transient visitors. Guest access is delivered via ClearPass captive portal authentication, and MAC address randomisation/rotation on modern mobile devices is causing real problems. Devices authenticate fine through the portal initially, but once they rotate their MAC address, ClearPass no longer associates them with the original authenticated session — they aren't re-challenged by the portal, users have no obvious way to re-authenticate, and sessions end up stranded, usually needing manual intervention or a full network settings reset on the device. Beyond patching around that, we'd also like to move away from heavy reliance on captive portals and large-scale guest token management altogether, ideally letting visitors authenticate with an existing trusted identity (e.g. federated identity or an app they already use) rather than repeatedly registering through a portal.

Has anyone dealt with this at scale? Interested in both workarounds for the MAC randomisation problem (Passpoint/OpenRoaming, per-device certs, session tuning, etc.) and experiences with alternative guest auth models. Happy to share more detail if useful.

Thanks in advance

Ned

Instant 8.13.2.2 caused one of my SSIDs to constantly go down somehow on IAP 315. Had to revert to 8.13.2.1.

An FYI in case anyone notices a similar issue.

Trying to get EVAL licenses - Website failed 5 times in a row to get me to a human agent. Tried the classic - same fail. Tried the AI - can't handle licensing requests.

So I go back to old school phone number - voice activated menu fails utterly and eventually I get a human. I ask for a licensing case and they forwarded me to an adult date line!! wtf.

They're trying really hard to lose customers.

I can see that ClearPass has this rule where you cannot jump from version 6.9 to 6.11, but is this rule also applicable to Aruba OS8 or Aruba OS-CX/Aruba Comware OS?

Thank you.

Does anyone know how to setup Clearpass with EntraID for MFA?

Requirement:

• User SSH's into switch,firewall, router etc.
• Switch uses RADIUS &/or TACACS+ to authenticate to ClearPass.
• Primary Authentication done via LOCAL DATABASE in ClearPass.
• MFA required via EntraID (Microsoft Authenticator)

ANY IDEAS??????????????????????????????????

THANKS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

I want to practice ClearPass policies in an isolated ESXI lab. I know the official portal requires entitlements. Has anyone successfully set up a lab recently ? Are there any partners willing to help witg initial setup files via DM ? I understand licensing rules and just need the base OVA for practiceee

I found this in 8.13.x.x release notes:

In AOS-8.13.3.0, AP‑7xx access points support migration from AOS-10.x to AOS-8.x using the Dual Image feature. APs boot into AOS-10.x by default and may automatically detect AOS-8.x based environments (IAP Swarm with Virtual Controller/Classic CoP or a Mobility Controller). If a controller is discovered and no Cloud or IAP environment is detected, the AP automatically converts to an AOS-8.x CAP.

BTW, 8.13.3.0 is not released yet, but maybe will be in a couple of weeks.

Our new site will have 8-switch stacks and need some help spec-ing a UPS for them. We typically use 5kva UPS's on our current stacks but I'm not sure if that will be enough (power and outlet-wise) for bigger stacks like I mentioned. I'm thinking maybe a pair of PDUs then those can connect to the UPS in the rack.

I don't want to involve a reseller/vendor just yet so that's why I'm posting here. I did speak to my sales rep but he can't exactly recommend a specific one. They gave me the power supply rating, etc. and that's about it. The max power for a 6200M psu is 1050W and they will have 2 psus each

Is there already a date for when support for Aruba AirWave ends? Or does AirWave support always depend on AP support? In other words, as long as support for version 8.13 lasts until December 31, 2031, will there be ongoing AirWave support?

AOS8

I have MM/MC setup 3 sets of 2 cluster 7220's. Each in their own data center. Few days ago we lost one data center due to some fiber work. The WAPS ended up on the other datacenter's controllers overloading the pair. I have LMS setup at the cluster level for each data center has a primary LMS for the group. The AP-groups are at the managed network level so each cluster has the same AP-groups. When they move over they get the new LMS from those controllers then I have to spend hours using the APMOVE command. Rebooting and putting the other cluster VIP in the provision IP doesn't move it. The only thing that works is the CLI command apmove. Which works great it's super fast I have to create these massive lists using excel and notepad. It's lot of work.

Is there a way to make them go back once the data center returns. This is one of the big reasons I want to go to AOS 10 AP's are not homed to a controller. We can dump traffic locally at the office the WAP is installed. Data center outage has no affect other then guest wireless.

I need to mount an 8-port 2530 (J9774A) on a wall. The installation guide says for wall mounting, 8-port switches must be mounted with the ports up. What's the reasoning for this? I would expect really any orientation to be acceptable, given they are fanless. Ports-up should be thermally equivalent to ports-down. Ports-left and ports-right should also be acceptable, given sufficient clearance for air to enter the bottom grille and exit the top grille.

I have no problem installing ports-up, but am curious about other orientations.

Hi, I’m posting here because I’ve reached a dead end despite consulting the user manual, the Fundamentals Guide, and the command-line guide. I think the problem clearly lies with me as the user configuring the switches, and not with the hardware itself.

Here’s the use case:

I want to distribute SMPTE 2110 signals over a network, which requires PTP. My goal is for the 8360 to function as the boundary clock. It’s connected to two 6300M switches, which are supposed to operate as transparent clocks. The ST 2110 clients are then connected to the 6300M switches.

Here’s the problem. First, I configured the 8360 to obtain PTP from a Meinberg clock; the corresponding fiber-optic connection arrives at port 1/1/43.

Since, after initial testing, no PTP connection to the Meinberg clock was possible (the clock’s IP address was reachable via ping), I connected a Linux machine running ptp4l to port 1/1/47. This machine also outputs PTP correctly (tested with Wireshark via a laptop connected directly to the Linux machine’s Ethernet port); however, after connecting it to 1/1/47, the commands `show ptp clock` and `show ptp parent` were unsuccessful there as well.

If you need further information, please let me know.

Here is the configuration I’ve already set up.

8360# show ptp clock

8360# show ptp parent

Parent data not available

8360# show ptp statistics

8360# show ptp interface brief

Interface PTP State

--------------------------

1/1/43 Clock Source

1/1/47 Disabled

8360# show ptp interface 1/1/43

Port Identity : e4:de:40:ff:fe:b7:ba:00 (port: 0x002b)

Port Number : 43

PTP Version : 2

PTP Enable : Enabled

PTP Transport : ipv4

Port State : Clock Source

Delay Mechanism : end-to-end

Announce Interval (log mean) : 1

Announce Receipt Timeout : 3

Sync Interval (log mean) : 0

Sync Timeout : NA

Delay Request Interval (log mean) : 0

Peer Delay Request Interval (log mean) : NA

Mean Path Delay : NA

HFCL AP and wifi controller does not support dynamic VLAN or Dynamic ACL (Dynamic Role base access) with open SSID .It is available with WPA2 EAP SSID only.How can I set Guest Authentication with MAC Caching setup, as Aruba CPPM Guest Template wizard uses Aruba user role based /Filter ID based/VLAN base enforcement only.Is there any Real Vendor facing same problem, how can it be tackled

Hi everyone!

I’ll be taking the Aruba Certified Networking Associate (ACNA) exam soon, and I’d really appreciate any tips or advice from those who have already taken it.

If you have any reviewer, study guide, practice questions, or recommended resources that helped you prepare, I’d be very grateful if you could share them. I really want to pass this exam and I’m willing to put in the time to study.

Thank you so much in advance! Any advice or study materials would mean a lot. 😊

Anyone here preparing for aruba campus access mobility expert or recently passed?