Users Guide

Dell PowerConnect W-Series ArubaOS 6.1 | User Guide Tunneled Nodes | 811
Appendix F
Tunneled Nodes
This appendix describes how to configure a Dell tunneled node, also known as a wired tunneled node. A Dell
tunneled node provides access and security using an overlay architecture.
This chapter describes the following topics:
 “Configuration Overview” on page811
 “Configuring a Wired Tunneled Node Client” on page812
 “Example Output” on page814
Configuration Overview
The Dell tunneled node connects to one or more client devices at the edge of the network and then establishes a
secure GRE tunnel to the controlling concentrator server. This approach allows the controller to support all the
centralized security features, such as 802.1x authentication, captive-portal authentication, and stateful firewall.
The Dell tunneled node is required to handle only the physical connection to clients and support for its end of
the GRE tunnel.
To support the wired concentrator, the controller must have a license to terminate access points (APs). No other
configuration is required. To configure the Dell tunneled node, you must specify the IP address of the controller
and identify the ports that are to be used as active tunneled node ports. Tunnels are established between the
controller and each active tunneled node port on the tunneled node. All tunneled node units must be running the
same version of software. The tunneled node port can also be configured as a trunk port. This allows customers to
have multiple clients on different VLANs that come through the trunk port instead of having clients on a single
vlan.
Figure 214 shows how the tunneled node fits into network operations. Traffic moves through GRE tunnels
between the active tunneled node ports and the controller or controllers. Policies are configured on a master
server and enforced on the local controllers. The master and the controller can run on the same or different
systems. The tunneled node can connect to the master, but it is not required.
On the controlling controller, you can assign the same policy to tunneled node user traffic as you would to any
untrusted wired traffic. The profile specified by the aaa authentication wired command determines the initial