Wireless Access

Hi,

We have this weird problem. When both AP with controller in same subnet, i can provision the AP without issue.
But when AP in different subnet, after provisioning the AP will stuck in "Generating CSR" status , flag is inactive and we are unable to proceed from there.

We assigned static ip to the AP, with master ip point to the controller using console cable. Both AP and controller can ping each other. We tried remove AP in the whitelist and reboot/reset the AP. Firewall allows all traffic. (any/any).

Called TAC support but so far no progress. We tried update AOS firmware too (8.10.0.4).

Any help is much appreciated.

Is there a firewall between the AP and the controller?  It could be an MTU issue
Did you try a different subnet?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------

Could you confirm that not have asymmetric routing between MC and the AP? you can test doing traceroute from MC point to the AP and viceversa.

Hi,

Sorry for late reply. Firewall team confirmed that all traffic between AP and controller is allowed. We tried placing AP at different subnet but same result. We managed to provision 3 units of AP but stuck from 4th unit and onwards. Is there anything we might have overlooked? Can you elaborate steps required to check MTU ?
Original Message:
Sent: Oct 20, 2022 12:38 PM
From: Fernando Carranza
Subject: Unable to provision AP located at different subnet

Could you confirm that not have asymmetric routing between MC and the AP? you can test doing traceroute from MC point to the AP and viceversa.

But there is a firewall?  You should try a VLAN that doesn't separate the AP from the firewall to see if it works (you already did, but try another that is not on the same subnet).  To find out the optimal MTU, use the ping method in the post here:  https://kb.netgear.com/19863/Ping-Test-to-determine-Optimal-MTU-Size-on-Router

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------

Original Message:
Sent: Oct 21, 2022 01:01 AM
From: Jason LL
Subject: Unable to provision AP located at different subnet

Hi,

Sorry for late reply. Firewall team confirmed that all traffic between AP and controller is allowed. We tried placing AP at different subnet but same result. We managed to provision 3 units of AP but stuck from 4th unit and onwards. Is there anything we might have overlooked? Can you elaborate steps required to check MTU ?

Original Message:
Sent: Oct 20, 2022 12:38 PM
From: Fernando Carranza
Subject: Unable to provision AP located at different subnet

Could you confirm that not have asymmetric routing between MC and the AP? you can test doing traceroute from MC point to the AP and viceversa.

Hi, do you have all the required licenses?  All licenses types you have must match in quantity

I hope this helps

Hi, 

Thank you for the suggestions.
Security team checked IPS & ATP records, and found ATP capture some entries. They will temporarily whitelist the AP IP range.
We will try again next week and update here.
Original Message:
Sent: Oct 21, 2022 10:16 AM
From: Ulises Cazares
Subject: Unable to provision AP located at different subnet

Hi, do you have all the required licenses?  All licenses types you have must match in quantity

I hope this helps

Hi,

The required licenses are installed. We reinstalled the controllers from scratch and the weird thing is, only the same AP that were successfully provisioned before reset are able to provision again. The rest of the AP still stuck on approved-ready-for-cert status.

Also we changed the MTU size in default AP system profile to 1300 but same result.

------------------------------
Jason_L
------------------------------

Original Message:
Sent: Oct 22, 2022 02:47 AM
From: Jason LL
Subject: Unable to provision AP located at different subnet

Hi,

Thank you for the suggestions.
Security team checked IPS & ATP records, and found ATP capture some entries. They will temporarily whitelist the AP IP range.
We will try again next week and update here.

Original Message:
Sent: Oct 21, 2022 10:16 AM
From: Ulises Cazares
Subject: Unable to provision AP located at different subnet

Hi, do you have all the required licenses?  All licenses types you have must match in quantity

I hope this helps

I would try provisioning APs in the same subnet as the controller and then moving them to the new subnet and see if it works.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------

Original Message:
Sent: Oct 26, 2022 10:23 PM
From: Lau TS
Subject: Unable to provision AP located at different subnet

Hi,

The required licenses are installed. We reinstalled the controllers from scratch and the weird thing is, only the same AP that were successfully provisioned before reset are able to provision again. The rest of the AP still stuck on approved-ready-for-cert status.

Also we changed the MTU size in default AP system profile to 1300 but same result.

------------------------------
Jason_L
------------------------------


Original Message:
Sent: Oct 22, 2022 02:47 AM
From: Jason LL
Subject: Unable to provision AP located at different subnet

Hi,

Thank you for the suggestions.
Security team checked IPS & ATP records, and found ATP capture some entries. They will temporarily whitelist the AP IP range.
We will try again next week and update here.

Original Message:
Sent: Oct 21, 2022 10:16 AM
From: Ulises Cazares
Subject: Unable to provision AP located at different subnet

Hi, do you have all the required licenses?  All licenses types you have must match in quantity

I hope this helps

So we found out that the issue may be related to FireEye & IPS. There is no record of FireEye blocking ip address of AP, however we only able to provision the AP after whitelisting it's ip address in FireEye.

We suspect the packet is altered causing authentication failure between AP and controller.

------------------------------
Jason_L
------------------------------

Original Message:
Sent: Oct 26, 2022 10:53 PM
From: Colin Joseph
Subject: Unable to provision AP located at different subnet

I would try provisioning APs in the same subnet as the controller and then moving them to the new subnet and see if it works.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------


Original Message:
Sent: Oct 26, 2022 10:23 PM
From: Lau TS
Subject: Unable to provision AP located at different subnet

Hi,

The required licenses are installed. We reinstalled the controllers from scratch and the weird thing is, only the same AP that were successfully provisioned before reset are able to provision again. The rest of the AP still stuck on approved-ready-for-cert status.

Also we changed the MTU size in default AP system profile to 1300 but same result.

------------------------------
Jason_L


Original Message:
Sent: Oct 22, 2022 02:47 AM
From: Jason LL
Subject: Unable to provision AP located at different subnet

Hi,

Thank you for the suggestions.
Security team checked IPS & ATP records, and found ATP capture some entries. They will temporarily whitelist the AP IP range.
We will try again next week and update here.

Original Message:
Sent: Oct 21, 2022 10:16 AM
From: Ulises Cazares
Subject: Unable to provision AP located at different subnet

Hi, do you have all the required licenses?  All licenses types you have must match in quantity

I hope this helps

Historically IDS/IPS attempts to inspect the GRE and it seems to break connectivity.  I am glad you figured it out.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card
------------------------------

Original Message:
Sent: Nov 01, 2022 11:32 PM
From: Lau TS
Subject: Unable to provision AP located at different subnet

So we found out that the issue may be related to FireEye & IPS. There is no record of FireEye blocking ip address of AP, however we only able to provision the AP after whitelisting it's ip address in FireEye.

We suspect the packet is altered causing authentication failure between AP and controller.

------------------------------
Jason_L
------------------------------


Original Message:
Sent: Oct 26, 2022 10:53 PM
From: Colin Joseph
Subject: Unable to provision AP located at different subnet

I would try provisioning APs in the same subnet as the controller and then moving them to the new subnet and see if it works.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

HPE Design and Deploy Guides: https://community.arubanetworks.com/support/migrated-knowledge-base?attachments=&communitykey=dcc83c62-1a3a-4dd8-94dc-92968ea6fff1&pageindex=0&pagesize=12&search=&sort=most_recent&viewtype=card


Original Message:
Sent: Oct 26, 2022 10:23 PM
From: Lau TS
Subject: Unable to provision AP located at different subnet

Hi,

The required licenses are installed. We reinstalled the controllers from scratch and the weird thing is, only the same AP that were successfully provisioned before reset are able to provision again. The rest of the AP still stuck on approved-ready-for-cert status.

Also we changed the MTU size in default AP system profile to 1300 but same result.

------------------------------
Jason_L


Original Message:
Sent: Oct 22, 2022 02:47 AM
From: Jason LL
Subject: Unable to provision AP located at different subnet

Hi,

Thank you for the suggestions.
Security team checked IPS & ATP records, and found ATP capture some entries. They will temporarily whitelist the AP IP range.
We will try again next week and update here.

Original Message:
Sent: Oct 21, 2022 10:16 AM
From: Ulises Cazares
Subject: Unable to provision AP located at different subnet

Hi, do you have all the required licenses?  All licenses types you have must match in quantity

I hope this helps