ArubaOS 8 Fundamentals - Aruba Networks

1 ArubaOS8 FundamentalsGuideCopyrightInformation ,theGNUL esserGeneralPublicLicense, ,sendacheckormoneyorderintheamountofUS$ :HewlettPackardEnterpriseCompany6280 AmericaCenterDriveSanJose,CA95002 USAC ontentsContents3 RevisionHistory7 AboutthisGuide8 IntendedAudienceandAssumptions8 RelatedDocuments8 Scope8 InformationIcons9 TypographicalConventions9 GraphicalIcons10 AcronymList11 Architecture15 ProductPortfolio15 ArubaOS6 ControllerModes16 MasterMode16 LocalMode16 BranchMode17 Standalone18 ArubaOS6 Topology18 ArubaOS8 ControllerModes19 MobilityMaster19 MasterControllerMode20 MobilityController21 Stand-aloneController22 ArubaOS8 Topology22 ControllerModeComparison23 APModes24 CampusAPs24 TunnelMode24 Decrypt-TunnelMode25 ControlPlaneSecurity26 BootProcesswithControlPlaneSecurity27 LocalManagementSwitch2728 RemoteAPs28 TunnelMode29 SplitTunnelMode29 BridgeMode29 SecureJack30 RAPB ootstrapProcess30

2 HierarchicalConfiguration32 ArubaOS6 Configuration32 AOS8 ConfigurationEnhancements33 Contents|3 ContentsSystemNodes34 UserNodes34 ConfigurationInheritance35 NodeLevelAdministration37 LicensingPools38 ConfigurationBestPractices38 NodeHierarchyDesign38 ConfigurationOverrides39 DepthofHierarchy39 TheManagedNetworkNode39 ConfigurationNotes40 LoadableServiceModule42 UnifiedCommunicationandCollaboration42 ArchitectureComparison42 NewFeaturesofUCCinArubaOS843 UCCH euristics44 SkypeforBusiness45 ArubaOS6 SfBSDNAPI46 ArubaOS8 SfBSDNAPI47 AirMatch48 ARMinArubaOS648 AirMatchinArubaOS849 AirMatchWorkflow49 AirMatchandARMC omparison50 WebContentClassification51 WebCCinArubaOS651 WebCCinArubaOS852 AirGroup54 AirGroupinArubaOS654 AirGroupinArubaOS855 AirGroupFeatureEnhancements56 AppRF57 AppRFinArubaOS657 AppRFinArubaOS857 ApplicationProgrammingInterface58 ConfigurationAPIs58 ContextAPIs59 Multizone61 Architecture61 ZoneRoles62 PrimaryZone62 DataZone62 KeyConsiderations62 MobilityMasterRedundancy63 Layer2 Redundancy63 Topology65 Synchronization654|ContentsContentsMobil ityControllerFailover66 Layer3 Redundancy66 Topologies67 Synchronization68 Failover69 Clustering70 HighlightsandConsiderations71 ClusterFormation73 HandshakeProcess73 VLANP robing73 LeaderElection74 Heartbeats74 ConnectivityandVerification75 ClusterRoles75 APAnchorController75 UserAnchorController78 ClusterFeatures80 SeamlessRoaming80 StatefulFailover82 ClientLoadBalancing83

3 APLoadBalancing84 LoadBalancingMetrics87 LoadBalancingAlgorithm88 ClusterGrouping89 APNodeList91 ChangeofAuthorization91 ClusterCoASupport92 CoAwithMCFailure94 CoAwithLoadBalancing97 LiveUpgrade102 Prerequisites102 LiveUpgradeFlow104 InitialLabAPDistribution104 APPartition105 TargetAssignmentandFirmwareDownload106 ClusterMembersUpgrade107 ScheduledLiveUpgrades113 CentralizedLicensing115 LicensingConcepts115 LicenseTypes115 MobilityMasterLicensing116 LicenseModelExamples117 MCML icensing119 Stand-aloneLicensing119 LicenseActivationandMigration119 MyNetworkingPortal119 ArubaSupportPortal123 LicenseMigration124 Contents|5 ContentsLicenseInstallation125 LicenseComponents125 LicenseInstallationviaWebUI125 LicenseInstallationviaCLI126 MobilityMasterLicensePools127 ControllerReferenceArchitectures129 DesignPrinciples129 ModularDesigns130 LANA ggregationLayer131 WirelessModuleAggregationLayer132 WirelessModuleRedundancy134 ReferenceArchitectures138 SmallOffice138 ConsiderationsandBestPractices141 MediumOffice145 LargeOffice152 Campus158 MigrationtoArubaOS8173 MigrationStrategies173 ManualMigration173 MigrationBestPracticeRecommendations174 MigrationCaveats174 GeneralMigrationRequirements174 ArubaOS6 TopologyMigrations175 MasterandStandbyMaster176 MMTerminatingMCs177 Stand-aloneMCandStandbyStand-alone180 MasterandSingleLocal182 MMTerminatingMCs183 MasterandMultipleLocals(SingleCampus)

4 187 MMTerminatingMCs188 MCMasterTerminatingMCs191 MasterandMultipleLocals(MultipleCampuses )195 MMTerminatingMCs196 MCMasterTerminatingMCs200 MultipleMaster-Locals205 MCMasterTerminatingMCs212 AllMasters216 MMTerminatingMCs218 MasterandBranchControllers222 MMTerminatingMCs2236| ,ChangeofAuthorization, :RevisionHistory7| ,recommendationsforproductselections,net workdesigndecisions,configurationprocedu res, , (WLANs). ,operation,andtroubleshootingdeployments nBaseDesignguidesdescribethemostcommonde ploymentmodels,recommendations, ,video, , |8 Figure1 ArubaReferenceArchitectureInformationIco nsThefollowinginformationaliconsareusedt hroughoutthisguide:Indicateshelpfulsugge stions,pertinentinformation, :Table2 (GUI). (CLI).9|AboutthisGuideAboutthisGuide|10 StyleTypeDescription<Arguments>Inthecommandexamples.

5 #send<textmessage>Inthisexample,youwouldtype send atthesystempromptexactlyasshown, [Optional] {ItemA|ItemB}Inthecommandexamples, ,Authorization,andAccountingAACAPA nchorControllerACLA ccessControlListACRA dvancedCryptographyAMAirMonitorAPAccessP ointAPIA pplicationProgrammingInterfaceARMA daptiveRadioManagementASPA rubaSupportPortalBLMSB ackupLocalManagementSwitchCoAChangeofAut horizationCLIC ommandLineInterfaceCPSecControlPlaceSecu rityCPUC entralProcessingUnitDCDataCenterDLNAD igitalLivingNetworkAllianceDNSD omainNameServiceDHCPD ynamicHostConfigurationProtocolDMZD emilitarizedZoneDPIDeepPacketInspectionF QDNF ully-qualifiedDomainName11|AboutthisGuid eAboutthisGuide|12 AcronymDefinitionGREG enericRoutingEncapsulationGUIG raphicalUserInterfaceHAHighAvailabilityH MMH ardwareMMHTTPH ypertextTransferProtocolHTTPSHTTPS ecureIAPI nstantAccessPointIDFI

6 NtermediateDistributionFrameIKEqInternet KeyExchangeIPInternetProtocolIPsecIntern etProtocolSecurityIPv4 InternetProtocolVersion4 IPv6 InternetProtocolVersion6 JSONJavaScriptObjectNotationLACPLinkAggr egationControlProtocolLANL ocalAreaNetworkLAGLinkAggregatedConnecti onLMSL ocalManagementSwitchLSML oadableServiceModuleMACM ediaAccessControlMCMobilityControllerMCM M asterControllerModemDNSmulticastDomainNa meServiceMDManagedDeviceAcronymDefinitio nMDMobilityDeviceMDFMainDistributionFram eMMMobilityMasterMM-HWMobilityMaster-Har dwareMM-VAMobilityMaster VirtualApplianceMNManagedNodeMNPMyNetwor kingPortalNASN etworkAccessServerNATN etworkAddressTranslationNBAPIN orthboundApplicationProgrammingInterface NVFN etworkVirtualizationFunctionalityPAPIP roprietaryAccessProtocolInterfacePATPort AddressTranslationPEFP olicyEnforcementFirewallPSKPre-sharedKey QoSQualityofServiceRADIUSR emoteAuthenticationDialInUserServiceRAMR andomAccessMemoryRAPR emoteAccessPointRFRadioFrequencyRFPRFP rotectS-AACS tandbyAPAnchorControllerS-UACS tandbyUserAnchorControllerSDNS oftwareDefinedNetwork13|AboutthisGuideAb outthisGuide|14 AcronymDefinitionSfBSkypeforBusinessSIPS essionInitiationProtocolSSIDS erviceSetIdentifierSVIS witchVirtualInterfaceUACUserAnchorContro llerUCCU nifiedCommunicationsandCollaborationUCMU nifiedCommunicationManagerUDLDU nidirectionalLinkDetectionURLU niformResourceLocatorVAPV irtualAccessPointVIAV irtualInternetAccessVIPV

7 IrtualInternetProtocoladdressVLANV irtualLocalAreaNetworkVMVirtualMachineVM CV irtualMCVMMV irtualMMVPNV irtualPrivateNetworkVPNCV irtualPrivateNetworkConcentratorVRRPV irtualRouterRedundancyProtocolVSFV irtualSwitchingFrameworkWLANW irelessLocalAreaNetworkXMLE xtensibleMarkupLanguageZTPZero-touchProv isioningChapter2 ArchitectureArchitectureMostoftheenduser devicesinmodernproductionnetworksarewire lessdevices, (SfB)andthesetrendsforceenterprisestobei ncreasinglyreliantonwirelessLocalAreaNet works(LANs) ,networkadministratorsarerequiredtodesig ncomplexnetworkstosupportvarioustypesofa pplications,users, (MCs)andcontroller-managedwirelessaccess points(APs).Withanextensivesetofintegrat edtechnologiesandcapabilities,ArubaOS8de liversunifiedwiredandwirelessaccess,seam lessroaming,enterprisegradesecurity,anda highlyavailablenetworkwiththerequiredper formance,userexperience, :Table3:ControllerPortfolioControllerSer iesControllerModelNumberofAPsNumberofUse rsFirewall(Gbps)70xx7005161,02427008161, 02427010322,04847024322,04847030644,0968 72xx72052568000127210512160002072201,024 240004072402,048320004072802,04832000100 architecture |.

8 MasterModeIfacontrollerisdeployedinmaste rmode,theadministratorisresponsibleforal lconfigurationincludingIPaddresses,licen ses,WLANs,APgroups,userroles, (CLI) , ,localcontrollersshouldalsobeinitiallyco nfiguredbyanadministratorusingtheserialc onsoletoassignIPaddresses,toconfigureVir tualLocalAreanetworks(VLANs), (WLANs) (WebUI). |ArchitectureArchitecture|17 Figure4 LocalModeBranchModeBranchModeisrelativel yanewcontrolleroperatingmodewhichwasintr oducedintheArubaOS , ,70xxseriescontrollersareshippedwithDyna micHostConfigurationProtocol(DHCP) ,abranchcontrollercanuseZeroTouchProvisi oning(ZTP) , ' |ArchitectureArchitecture|19 Figure7 ArubaOS (MM) (VMM)andHardwareMobilityMaster(HMM).TheM obilityMasterisdesignedtorunonanx86-base dplatformandthefeaturesintroducedinAruba OS8requirerandomaccessmemory(RAM),centra lprocessingunit(CPU), , ,theMobilityMastercanbeconfiguredusingaN orthboundApplicationProgrammableInterfac e(NBAPI).

9 AVirtualMobilityMastercanbeinstalledonVM Ware,KVM, , (MCM)toenableaseamlesstransitionfromArub aOS6withoutrequiringanx86-basedappliance (HMM) (MC), :20|ArchitectureArchitecture|21 Table4:MasterControllerModeFeatureMatrix SupportedFeaturesUnsupportedFeaturesNewW ebUI,Workflows,andHierarchicalConfigurat ionClusteringMultizoneAirMatchMulti-thre adedCLIwithauto-completionCentralizedApp Support(UCC,AppRF)WANLinkBondingandLoadB alancingLiveUpgradeDistributedUCC,AppRF, (MN),ManagedDevices(MD),orMobilityDevice s(MD) , , (VMC).AVirtualMobilityControllercanbedep loyedeitheronVMWare,KVM, (VPNCs). (VM). ,AppRF,UCC,AirGroup,NorthboundAPI,UCM, |ArchitectureArchitecture|23 ArubaOS8topologyhasthefollowingkeypoints ofdifferentiationwhencomparedtoanArubaOS 6 :Table5.

10 ControllerModeSummaryArubaOS 6 ArubaOS 8 MasterControllerMobilityMaster(VMorhardw are)orMasterControllerMode( only72xxand7030controllers)LocalControll erMobilityControllersBranchControllerMob ilityControllersStand-aloneControllerSta nd-aloneControllerThefollowingkeypointss houldbenotedabouttheArubaOS 8 , , , ,actionframes, , , , (CPSec) ,thenetworkshouldsupportMaximumTransmiss ionUnit(MTU) , , |24 Figure13 TunnelForwardingModeDecrypt-TunnelModeDe crypt-tunnelmodeallowsanAP-clientpairtot akefulladvantageofAggregated-MediaAccess Control(MAC)ServiceDataUnits(A-MSDUs)and Aggregated-MACP acketDataUnits(A-MPDUs) (CPSec) , , |APModesAPModes|26 Figure14 Decrypt- :nThecontroltraffictransportedusingPropr ietaryAccessProtocolInterface(PAPI)issec uredusingacertificate-basedInternetProto colSecurity(IPsec) , , ,theywillinitiateasecurePAPI(UDP8209insi deIPsec)communicationwiththecontroller,s ynchronizetheirfirmware, :Figure15 (UDP8209) , (GRE) ,eachcontrolleractsasaLocalManagementSwi tch(LMS)byterminatingusertrafficfromtheA Ps, (BLMS) ,VirtualRouterRedundancyProtocol(VRRP).