Cloud Managed Networks

This looks like a feature I'd love to implement on our network.  Reading your tutorial, though, it creates the MPSK SSID in bridge mode.  Our MPSK SSID is in tunnel mode and I don't see the Personal Wireless Network option when I look at our MPSK SSID.  I assume that means bridge mode is currently a requirement.  Will support be added for tunnel mode MPSK SSIDs in the future?

Works perfectly, thank you for the great tutorial!

How did you get the 'Password Portal' links under MPSK Management?

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------


Original Message:
Sent: Dec 02, 2024 09:18 AM
From: Ulrich Saur
Subject: [TUTORIAL] Personal Wireless Network with Aruba Central and AOS10

Works perfectly, thank you for the great tutorial!

How did you get the 'Password Portal' links under MPSK Management?

------------------------------
Greez,
Uli

Hi Herman,

this screenshot also was included in @AP-e172d8`s document and is the reason for my question.

In my case it looks like that:

No 'Open' nor 'Copy URL' visible ...

------------------------------
Greez,
Uli
------------------------------


Original Message:
Sent: Dec 02, 2024 02:00 PM
From: Herman Robers
Subject: [TUTORIAL] Personal Wireless Network with Aruba Central and AOS10

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.


Original Message:
Sent: Dec 02, 2024 09:18 AM
From: Ulrich Saur
Subject: [TUTORIAL] Personal Wireless Network with Aruba Central and AOS10

Works perfectly, thank you for the great tutorial!

How did you get the 'Password Portal' links under MPSK Management?

------------------------------
Greez,
Uli

Did you connect your Identity Provider? I tested and if there is no Identity Provider configured (Entra ID, Google Workspace, Okta), the URL is not shown (because the users can't login); once I added the provider, the URL link shows up.

Hi Herman,

this screenshot also was included in @AP-e172d8`s document and is the reason for my question.

In my case it looks like that:

No 'Open' nor 'Copy URL' visible ...

------------------------------
Greez,
Uli


Original Message:
Sent: Dec 02, 2024 02:00 PM
From: Herman Robers
Subject: [TUTORIAL] Personal Wireless Network with Aruba Central and AOS10

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.


Original Message:
Sent: Dec 02, 2024 09:18 AM
From: Ulrich Saur
Subject: [TUTORIAL] Personal Wireless Network with Aruba Central and AOS10

Works perfectly, thank you for the great tutorial!

How did you get the 'Password Portal' links under MPSK Management?

------------------------------
Greez,
Uli

Hi, last week I experimented a bit with Central MPSK-based Personal Wireless Network, which was exceptionally easy and worked well. At the time I was only using admin-managed named MPSKs. 
Yesterday evening I also set up Entra ID as an IDP. This morning, MPSKs created via the Entra ID-authenticated portal also worked. At some point, however, I noticed that the test clients were going in and out of the SSID every second, regardless of whether they were admin-managed or via the portal.
 I see the following message in the events on Central:
"Onboarding failed for client 3e:9c:29:xx:xx:xx in Deauthentication/Disassociation phase to BSSID 94:64:24:yy:yy:yy on channel 100+ of AP hostname AP-635. Reason: Previous authentication is not valid"
Unfortunately, deleting the Entra ID connection (the only change to the overall construct) did not fix it! All other SSIDs (1x, PSK and Cloudguest) work without drama.
Do you have any idea what is going wrong here? 

Could it be that your AP clock is not syncronized? Otherwise, I would open a TAC case to let them find out what is going on here. Looks like the AP invalidates the authentication, which is not expeced.

Hi, last week I experimented a bit with Central MPSK-based Personal Wireless Network, which was exceptionally easy and worked well. At the time I was only using admin-managed named MPSKs. 
Yesterday evening I also set up Entra ID as an IDP. This morning, MPSKs created via the Entra ID-authenticated portal also worked. At some point, however, I noticed that the test clients were going in and out of the SSID every second, regardless of whether they were admin-managed or via the portal.
 I see the following message in the events on Central:
"Onboarding failed for client 3e:9c:29:xx:xx:xx in Deauthentication/Disassociation phase to BSSID 94:64:24:yy:yy:yy on channel 100+ of AP hostname AP-635. Reason: Previous authentication is not valid"
Unfortunately, deleting the Entra ID connection (the only change to the overall construct) did not fix it! All other SSIDs (1x, PSK and Cloudguest) work without drama.
Do you have any idea what is going wrong here? 

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk

Assuming you are an HPE Technology Partner, this is something your would reach out for with your Partner Alliance Manager or partner contact in HPE.

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk

Hi @US-86ba77

You can return PAN ID via Aruba-PAN-Id TLV radius attribute. It's 32 bit integer value with specific structure.  Look for Personal Wireless Networks presentations from Bob Filer, Kevin Marshal, Diego Fontes for HPE Tech Jam 2024 for more details on the structure of attribute.

 Best, Gorazd

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk

Thanks @Gorazd Kikelj this is very helpful and it should be enough.

I cannot find anywhere the presentation you mentioned form Bob Filer, Kevin Marshal, Diego Fontes. Any chance you can point me to the right direction?

Hi @US-86ba77

You can return PAN ID via Aruba-PAN-Id TLV radius attribute. It's 32 bit integer value with specific structure.  Look for Personal Wireless Networks presentations from Bob Filer, Kevin Marshal, Diego Fontes for HPE Tech Jam 2024 for more details on the structure of attribute.

 Best, Gorazd

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk

Hi @IvanMuccini.

You can find presentation on HPE Tech Pro  under Events / Tech Jam Vienna ARU177BRO_V or Tech Jam Atlanta ARU177BRO_A

Best, Gorazd

Thanks @Gorazd Kikelj this is very helpful and it should be enough.

I cannot find anywhere the presentation you mentioned form Bob Filer, Kevin Marshal, Diego Fontes. Any chance you can point me to the right direction?

Hi @US-86ba77

You can return PAN ID via Aruba-PAN-Id TLV radius attribute. It's 32 bit integer value with specific structure.  Look for Personal Wireless Networks presentations from Bob Filer, Kevin Marshal, Diego Fontes for HPE Tech Jam 2024 for more details on the structure of attribute.

 Best, Gorazd

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk

Please note that this is not public information. Access requires a partner agreement to be in place, and it may even be only for attendees of the Tech Jam event (not sure, not checked). If you are part of the Technology Partner ecosystem, you should be able to get access to such information.

Hi @IvanMuccini.

You can find presentation on HPE Tech Pro  under Events / Tech Jam Vienna ARU177BRO_V or Tech Jam Atlanta ARU177BRO_A

Best, Gorazd

Thanks @Gorazd Kikelj this is very helpful and it should be enough.

I cannot find anywhere the presentation you mentioned form Bob Filer, Kevin Marshal, Diego Fontes. Any chance you can point me to the right direction?

Hi @US-86ba77

You can return PAN ID via Aruba-PAN-Id TLV radius attribute. It's 32 bit integer value with specific structure.  Look for Personal Wireless Networks presentations from Bob Filer, Kevin Marshal, Diego Fontes for HPE Tech Jam 2024 for more details on the structure of attribute.

 Best, Gorazd

@AP-e172d8 is there any way we could enforce PAN IDs via our own external RADIUS sever with some custom RADIUS VSAs?

Our solution is integrated with the Aruba Unbound MPSK technology, so we perform key matching on scale on our system, and the ability to enforce PAN without VLANs would be a killer application for our hospitality offering.

Here the docs for reference:
https://docs.cusna.io/wifi-integration/summary-of-supported-wifi-vendors/aruba-unbound-mpsk