Wireless Access

Hello ! 

I have configured a cluster with two HW-MM-5K and four controllers (7220 and 7240).
Yesterday, I decided to switch VRRP master on Mobility Conductors and since then I can't join them with SSH/HTTPS from remote network.
Second member was reachable but I rebooted it thinking it could be a VRRP issue. Now, it is unreachable too.

ICMP is still OK and SSHd service is still up because I can reach them from other controllers on the same network.

Do you have ever seen same issue with remote access ?

We have verified the whole architecture, routing protocols are OK and there are not any firewall equipements between PC with SSH client and Mobility-conductor : SSH access is possible only on the same network.

Can be that there is a problem with a change done before the reboot but I don't remember of anything new big.
I read issues with "trusted" state on interfaces so I verified it. I verified firewall-cp state too. Nothing to report !

Do you know some verifications to do ?

Thanks for your help.

------------------------------
Jules Bvt
------------------------------

Can you check with the 'show users' command on the controller if you see your client there, possibly in a logon role?

That may happen if the interface is trusted, but the VLAN is not. Then still the client IP may end up in untrusted role, where logon is the default and does not allow access to the controller, but does allow icmp.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Thanks you Herman,

I will verify this possibility but in my memories, I verified uplinks interfaces and are "trusted" like the "VLANs".
I will look at "show users" in few days.

As husnu said, I can connect to these HW-MM-5K from other controllers on the same subnet. This situation is very strange...

------------------------------
Jules Bvt
------------------------------

Original Message:
Sent: Jan 06, 2022 10:06 AM
From: Herman Robers
Subject: WebGUI/SSH issue with Mobility Conductors

Can you check with the 'show users' command on the controller if you see your client there, possibly in a logon role?

That may happen if the interface is trusted, but the VLAN is not. Then still the client IP may end up in untrusted role, where logon is the default and does not allow access to the controller, but does allow icmp.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Dear Herman, 

I tried your workaround, added « trusted vlan » on port-channel 0 interface and now I can reach the two Mobility Conductors.
Even I don't understand why this issue appeared suddenly, I thanks you for this idea !

------------------------------
Jules Bvt
------------------------------

Original Message:
Sent: Jan 06, 2022 10:06 AM
From: Herman Robers
Subject: WebGUI/SSH issue with Mobility Conductors

Can you check with the 'show users' command on the controller if you see your client there, possibly in a logon role?

That may happen if the interface is trusted, but the VLAN is not. Then still the client IP may end up in untrusted role, where logon is the default and does not allow access to the controller, but does allow icmp.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Hi,

If you can connect from local network with MDs, it could be network problem. Be sure about topology. Did you enter the correct default route?

check with;

show ip route and show ip interface brief

check with client ip reachibility with traceroute;

By the way aruba did not recommend L3 config. If possibel use L2 cluster connectivity between switches (I mean aruba MDs). 

You may want to check your topology, design with a aruba eng.

------------------------------
husnu demir
------------------------------

Thanks you too Husnu,

I'm agree with you but there was not any changes on network and we verified it two times with my network team.
The default route is the only L3 route on the Mobility-Controller.

interface vlan 500
ip address 172.31.0.5 255.255.255.128
ip default-gateway 172.31.0.1

Each 7220/7240 controller has an IP on the same subnet : This is a L2-Connectivity, not ?

------------------------------
Jules Bvt
------------------------------

Original Message:
Sent: Jan 07, 2022 04:06 AM
From: husnu demir
Subject: WebGUI/SSH issue with Mobility Conductors

Hi,

If you can connect from local network with MDs, it could be network problem. Be sure about topology. Did you enter the correct default route?

check with;

show ip route and show ip interface brief

check with client ip reachibility with traceroute;

By the way aruba did not recommend L3 config. If possibel use L2 cluster connectivity between switches (I mean aruba MDs). 

You may want to check your topology, design with a aruba eng.

------------------------------
husnu demir
------------------------------

Hi,

If there is a reachability problem,

1. Check firewalls and ACLs.
There can be an ACL in the configs. Especially, on the uplink. If there is no ACL, write one to log the packets and see if your packets coming to your controller.

2. Check routing problem.

If ping packets are coming and going to the interface, then most probably no routing problem. Also you may check with "telnet <IP ADDRE> 4343" command and see the result.





------------------------------
husnu demir
------------------------------

Original Message:
Sent: Jan 07, 2022 08:42 AM
From: Jules Bvt
Subject: WebGUI/SSH issue with Mobility Conductors

Thanks you too Husnu,

I'm agree with you but there was not any changes on network and we verified it two times with my network team.
The default route is the only L3 route on the Mobility-Controller.

interface vlan 500
ip address 172.31.0.5 255.255.255.128
ip default-gateway 172.31.0.1

Each 7220/7240 controller has an IP on the same subnet : This is a L2-Connectivity, not ?

------------------------------
Jules Bvt
------------------------------


Original Message:
Sent: Jan 07, 2022 04:06 AM
From: husnu demir
Subject: WebGUI/SSH issue with Mobility Conductors

Hi,

If you can connect from local network with MDs, it could be network problem. Be sure about topology. Did you enter the correct default route?

check with;

show ip route and show ip interface brief

check with client ip reachibility with traceroute;

By the way aruba did not recommend L3 config. If possibel use L2 cluster connectivity between switches (I mean aruba MDs). 

You may want to check your topology, design with a aruba eng.

------------------------------
husnu demir

Is the problem associated with just ssh/webui access to the MCR's VRRP VIP, or does it also prevent access to the MCR's unique management IP?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Unfortunately, the issue is the same with VIP and equipment unique IP. Even the MGMT interface IP is affected !

------------------------------
Jules Bvt
------------------------------

Original Message:
Sent: Jan 07, 2022 11:32 AM
From: Charlie Clemmer
Subject: WebGUI/SSH issue with Mobility Conductors

Is the problem associated with just ssh/webui access to the MCR's VRRP VIP, or does it also prevent access to the MCR's unique management IP?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

At least the behavior is consistent. 

Is there any error message presented when trying to ssh into the MCR, or does it simply timeout?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Original Message:
Sent: Jan 07, 2022 11:40 AM
From: Jules Bvt
Subject: WebGUI/SSH issue with Mobility Conductors

Unfortunately, the issue is the same with VIP and equipment unique IP. Even the MGMT interface IP is affected !

------------------------------
Jules Bvt
------------------------------


Original Message:
Sent: Jan 07, 2022 11:32 AM
From: Charlie Clemmer
Subject: WebGUI/SSH issue with Mobility Conductors

Is the problem associated with just ssh/webui access to the MCR's VRRP VIP, or does it also prevent access to the MCR's unique management IP?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

Yes, there is only a timeout with HTTPS or SSH.

------------------------------
Jules Bvt
------------------------------

Original Message:
Sent: Jan 07, 2022 11:52 AM
From: Charlie Clemmer
Subject: WebGUI/SSH issue with Mobility Conductors

At least the behavior is consistent. 

Is there any error message presented when trying to ssh into the MCR, or does it simply timeout?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------


Original Message:
Sent: Jan 07, 2022 11:40 AM
From: Jules Bvt
Subject: WebGUI/SSH issue with Mobility Conductors

Unfortunately, the issue is the same with VIP and equipment unique IP. Even the MGMT interface IP is affected !

------------------------------
Jules Bvt


Original Message:
Sent: Jan 07, 2022 11:32 AM
From: Charlie Clemmer
Subject: WebGUI/SSH issue with Mobility Conductors

Is the problem associated with just ssh/webui access to the MCR's VRRP VIP, or does it also prevent access to the MCR's unique management IP?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

I would start from both the remote client as well as the MCR directly to start isolating where the issue occurs.

Do a traceroute/tracert from the remote client to the MCR. Where does it stop?
From the MCR, traceroute back to the remote client. Is it reachable or does it stop?

Remember, communications between controllers and the conductor is carried inside IPSec, so that would potentially present itself differently if there's been a firewall rule added/changed somewhere. If ping works between the MCR and remote device, then routing should be correct.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Original Message:
Sent: Jan 07, 2022 11:57 AM
From: Jules Bvt
Subject: WebGUI/SSH issue with Mobility Conductors

Yes, there is only a timeout with HTTPS or SSH.

------------------------------
Jules Bvt
------------------------------


Original Message:
Sent: Jan 07, 2022 11:52 AM
From: Charlie Clemmer
Subject: WebGUI/SSH issue with Mobility Conductors

At least the behavior is consistent. 

Is there any error message presented when trying to ssh into the MCR, or does it simply timeout?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.


Original Message:
Sent: Jan 07, 2022 11:40 AM
From: Jules Bvt
Subject: WebGUI/SSH issue with Mobility Conductors

Unfortunately, the issue is the same with VIP and equipment unique IP. Even the MGMT interface IP is affected !

------------------------------
Jules Bvt


Original Message:
Sent: Jan 07, 2022 11:32 AM
From: Charlie Clemmer
Subject: WebGUI/SSH issue with Mobility Conductors

Is the problem associated with just ssh/webui access to the MCR's VRRP VIP, or does it also prevent access to the MCR's unique management IP?

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.