Users Guide

450 | Control Plane Security Dell PowerConnect W-Series ArubaOS 6.1 | User Guide
Table 86 Control Plane Security Upgrade Strategies
Troubleshooting Control Plane Security
Certificate Problems
If an AP has a problem with its certificate, check the state of the AP in the campus AP whitelist. If the AP is in
either the certified-hold-factory-cert or certified-hold-switch-cert states, you may need to manually change the
status of that AP before it can be certified.
 certified-hold-factory-cert: An AP is put in this state when the controller thinks the AP has been certified with
a factory certificate yet the AP requests to be certified again. Since this is not a normal condition, the AP will
not be approved as a secure AP until a network administrator manually changes the status of the AP to verify
that it is not compromised. If an AP is in this state due to connectivity problems, then the AP will recover and
will be out of this hold state as soon as connectivity is restored.
 certified-hold-switch-cert: An AP is put in this state when the controller thinks the AP has been certified with
a controller certificate yet the AP requests to be certified again. Since this is not a normal condition, the AP
will not be approved as a secure AP until a network administrator manually changes the status of the AP to
verify that it is not compromised. If an AP is in this state due to connectivity problems, then the AP will
recover and will be out of this hold state as soon as connectivity is restored.
Verifying Certificates
If you are unable to configure the control plane security feature on W-6000M3, W-600 Series or W-3000 Series
controllers, verify that its Trusted Platform Module (TPM) and factory-installed certificates are present and valid
Automatically send Certificates to Campus APs Manually Certify Campus APs
1. Access the control plane security window and enable both
the control plane security feature and the auto certificate
provisioning option. Next, specify whether you want all
associated campus APs to automatically receive a
certificate, or if you want to certify only those APs within a
defined range of IP addresses.
1. Identify the campus APs that should receive certificates by
entering the campus APs’ MAC addresses in the campus AP
whitelist.
2. Once all APs have received their certificates, disable auto
certificate provisioning to prevent certificates from being
issued to any rogue APs that may appear on your network
at a later time.
2. If your network includes both master and local controllers, wait
a few minutes, then verify that the campus AP whitelist has
been propagated to all other controllers on the network.
Access the WebUI of the master controller, navigate to
Configuration>Controller>Control Plane Security, then verify
that the Current Sequence Number field has the same value as
the Sequence Number entry for each local controller in the
local switch whitelist. (For details, see “Verify Whitelist
Synchronization” on page 451.)
3. If a valid AP did not receive a certificate during the initial
certificate distribution, you can manually certify the AP by
adding that AP’s MAC address to the campus AP whitelist.
You can also use this whitelist to revoke certificates from
APs that should not be allowed access to the secure
network.
3. Enable the control plane security feature.
CAUTION: If you upgraded your controller from ArubaOS 5.0 or earlier and you want to use this feature for the first time, you
must either add all valid APs to the campus AP whitelist or enable automatic certificate provisioning before you enable the
feature. If you do not enable automatic certificate provisioning, only the APs currently approved in the campus AP whitelist will
be allowed to communicate with the controller over a secure channel. Any APs that do not receive a certificate will not be able
to communicate with the controller except to request a certificate.