Users Guide

446 | Control Plane Security Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
Access the command-line interface on the old local controller and issue the command whitelist-db cpsec
purge
-or-
Access the local controller WebUI, navigate to Configuration>AP Installation>Campus AP Whitelist and
click Purge.
3. Once the campus AP whitelist has been purged, you must inform the master controller that the local
controller will no longer be available. .
Access the command-line interface on the master controller, and issue the command whitelist-db cpsec-local-
switch-list del mac-address <local-controller-mac>
-or -
Access the maser controller WebUI, navigate to the Configuration>Controller>Control Plane Security
window, select the entry for the local controller you want to delete from the local switch whitelist, and click
Delete.
4. Install the new local controller, but do not connect it to the network yet. If the controller has been previously
installed on the network, you must ensure that the new local controller has a clean whitelist.
Access the command-line interface on the new local controller and issue the command whitelist-db cpsec
purge
-or-
Access the local controller WebUI, navigate to Configuration>AP Installation>Campus AP Whitelist and
click Purge.
5. Now, connect the new local controller to the network. It is very important that the local controller is able to
contact the master controller the first time it is connected to the network, because the local controller will try
to get its control plane security certificate certified by the master controller the first time the local controller
contacts its master.
6. Once the local controller has a valid control plane security certificate and configuration, the local controller
will receive the campus AP whitelist from the master controller and will start certifying approved APs.
7. APs associated with the new local controller will reboot and create new IPsec tunnels to their controller using
the new certificate keys
Replacing a Master Controller (With No Backup)
Use the following procedure to replace a master controller that does not have a backup controller.
1. Remove the old master controller from the network.
2. Install and configure the new master controller, then connect the new master to the network. The new master
controller will generate a new certificate when it first becomes active
3. If the new master controller has a different IP address than the old master controller, change the master IP
address on the local controllers to reflect the address of the new master.
4. Reboot each local controller to ensure that the local controllers get their certificate from the new master. Each
local controller will begin using a new certificate signed by the master controller.
5. APs will no longer be able to securely communicate with the controller using their current key, and must
receive a new certificate. Access the campus AP whitelist on any local controller and change all APs in a
“certified” state to an “approved” state. The new master controller will send the approved APs new
certificates. The APs will reboot and create new IPsec tunnels to their controller using the new certificate key.
If the master controller does not have any local controllers, you must recreate the campus AP whitelist by
turning on automatic certificate provisioning or manually reentering the campus AP whitelist entries.
NOTE: This step is very important; unused local controller entries in the local switch whitelist can significantly increase network
traffic and reduce controller memory resources.