Aruba IAP-335 User Manual page 407

Table 86: IAP Configuration for Scenario 3—IPsec: Multiple Datacenter Deployment
Configuration Steps
5. Create authentication
servers for user
authentication. The
example in the next
column assumes 802.1X
SSID.
6. Configure wired port and
wireless SSIDs using the
authentication servers
and access rules; enable
authentication
survivability.
407 | IAP-VPN Deployment Scenarios
CLI Commands
(Instant AP)(DHCP profile "l3-dhcp")# domain-name
corpdomain.com
(Instant AP)(DHCP profile "l3-dhcp")# client-count
200
Local profile with VLAN 20
(Instant AP)(config)# ip dhcp local
(Instant AP)(DHCP profile "local")# server-type
Local
(Instant AP)(DHCP profile "local")# server-vlan 20
(Instant AP)(DHCP profile "local")# subnet
172.16.20.1
(Instant AP)(DHCP profile "local")# subnet-mask
255.255.255.0
(Instant AP)(DHCP profile "local")# lease-time 86400
(Instant AP)(DHCP profile "local")# dns-server
10.1.1.30,10.1.1.50
(Instant AP)(DHCP profile "local")# domain-name
arubanetworks.com
NOTE: The IP range configuration on each branch will be the
same. Each IAP will derive a smaller subnet based on the client
count scope using the Branch ID (BID) allocated by the controller.
(Instant AP)(config)# wlan auth-server server1
(Instant AP)(Auth Server "server1")# ip 10.2.2.1
(Instant AP)(Auth Server "server1")# port 1812
(Instant AP)(Auth Server "server1")# acctport 1813
(Instant AP)(Auth Server "server1")# key
"presharedkey"
(Instant AP)(Auth Server "server1")# exit
(Instant AP)(config)# wlan auth-server server2
(Instant AP)(Auth Server "server1")# ip 10.2.2.2
(Instant AP)(Auth Server "server1")# port 1812
(Instant AP)(Auth Server "server1")# acctport 1813
(Instant AP)(Auth Server "server1")# key
"presharedkey"
Configure wired ports to operate in NAT mode and associate
VLAN 20 to the wired port profile.
(Instant AP)(config) # wired-port-profile wired-port
(Instant AP)(wired-port-profile "wired-port")#
switchport-mode access
(Instant AP)(wired-port-profile "wired-port")#
allowed-vlan all
(Instant AP)(wired-port-profile "wired-port")#
native-vlan 20
(Instant AP)(wired-port-profile "wired-port")# no
shutdown
(Instant AP)(wired-port-profile "wired-port")#
access-rule-name wired-port
(Instant AP)(wired-port-profile "wired-port")# type
employee
(Instant AP)(wired-port-profile "wired-port")# auth-
server server1
UI Procedure
See
Configuring an
External Server
for
Authentication
See
Configuring a
Wired Profile
and
Network
Profiles
Aruba Instant 6.5.0.0-4.3.0.0 | User Guide
Wireless