Wireless Access

Hi,

We installed FIPS mobility masters and it was/is my understanding that they should be able to manage non-FIPS controllers however since I switched the controller in our test setup from FIPS to non-FIPS it fails to communicate with the mobility master.

I've actually changed the IPsec secret on both to make sure it was not an issue there and am at a loss what else I can try.

The controller has ping to the real IPs of the mobility masters but not to the VRRP IP address that is supposed to manage it.

Technical:

- 2 virtual mobility masters (master/standby) - ArubaOS 8.7.0.0-FIPS

- 1 7030 controller in the test setup - ArubaOS 8.6.0.5

- 1 7030 production standalone - ArubaOS 8.6.0.5

Eventually once the mobility master managed system works 100% the standalone unit will be added to cluster with the other one in the mean time we switch between the two units managing the network.

The reason we're currently not switching the controllers to FIPS is that we have a Remote AP that loses connectivity upon update of the controller to FIPS, I suspect we can resolve this by preloading the FIPS image on it and rebooting it before we reboot the controller into the FIPS firmware however since this seems a risky procedure (the RAP is a ±3 hour drive from our location) we haven't attempted it yet.

/Edit - eventually I absolutely do want FIPS, I read about the differences and non-FIPS seem to have some unacceptably lax security settings/old libraries.

My guess is the non-FIPS and FIPS versions of OpenSSL are incapable of setting up an IPsec tunnel with each other.

Which leaves the question - how do I safely migrate production to FIPS without losing the Remote AP.

I don't think that is something we test or expect customers to do.

I guess it is a weird step...

I wanted to switch to FIPS but do it in steps, anyhow I managed to switch our production system to FIPS (though our RAP is now functioning as a campus AP over P2P, I'll have to fix that later).

Either way the instructional videos do seem to suggest this is possible since they state explicitly that the mobility master and mobility controller don't need the same version.

I wouldn't interpret it that way. 

If you want to migrate, you should have an entire FIPS system and then migrate APs to the new system, not manage a non-FIPS system with a FIPS MM or vice versa.