Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide] Control Plane Security | 373
Chapter 17
Control Plane Security
ArubaOS supports secure IPsec communications between a controller and campus APs using public-key self-
signed certificates created by each master controller. The controller certifies its APs by issuing them certificates.
If the master controller has any associated local controllers, the master controller sends a certificate to each local
controller, which in turn sends certificates to their own associated campus APs. If a local controller is unable to
contact the master AP to validate its own certificate, it will not be able to certify its APs, and those APs will not be
able to communicate with their local controller until master-local communication has been reestablished.
Therefore, it is very important that all local controllers are able to communicate with their master controller when
you first enable the control plane security feature.
Some AP model types, such as the W-AP120 Series, have factory-installed digital certificates from Dell
PowerConnect These AP models will use their factory-installed certificates for IPsec, and do not need a self-
signed certificate from the controller. Once a campus AP is certified, either through a factory-installed certificate
or a certificate from the controller, the AP can failover between local controllers and still stay connected to the
secure network, because each campus AP will have the same master controller as a common trust anchor. The
campus AP whitelist contains a list of all APs connected to the network. You can use this whitelist at any time to
add new valid APs to the secure network, or revoke network access to any suspected rogue or unauthorized AP.
When the controller sends an AP a certificate, that AP must reboot before it can connect to its controller over a
secure channel. If you are enabling control plane security for the first time on a large network, you may experience
several minutes of interrupted connectivity while each AP receives its certificate and establishes its secure
connection.
This chapter describes the following topics:
z “Control Plane Security Overview” on page373
z “Configuring Control Plane Security” on page374
z “Whitelists on Master and Local Controllers” on page380
z “Environments with Multiple Master Controllers” on page383
z “Replacing a Controller on a Multi-Controller Network” on page386
z “Troubleshooting Control Plane Security” on page390
Control Plane Security Overview
Controllers enabled with control plane security will only send certificates to APs that you have identified as valid
APs on the network. If you are confident that all campus APs currently on your network are valid APs, you can
configure automatic certificate provisioning to send certificates from the controller to each campus AP, or to all
campus APs within a specific range of IP addresses. If you want closer control over each AP that gets certified, you
can manually add individual campus APs to the secure network by adding each AP's information to the campus
AP whitelist.
The default automatic certificate provisioning requires that you manually enter each AP’s information into the
campus AP whitelist. If you change the automatic certificate provisioning setting to let the controller send
Note: The control plane security feature supports campus APs only and is not intended for use with Remote APs.