Users Guide

374 | Control Plane Security Dell PowerConnect ArubaOS 5.0 | [User Guide
certificates to all APs on the network. This ensures that all valid APs will receive a certificate, but also increases
the chance that a rogue or unwanted AP will also be certified. If you configure the controller to send certificates
to only those APs within a range of IP addresses, there is a smaller chance that a rogue AP will get a certificate, but
any valid AP with an IP address outside the specified address range will not be given a certificate and will not be
able to communicate with the controller (except to obtain a certificate). Consider both options carefully before
you proceed. If your controller has a publicly accessible interface, you should identify the campus APs on the
network by IP address range. This will prevent the controller from sending certificates to external or rogue
campus APs that may attempt to access your controller through that publicly accessible interface.
The table below briefly describes the basic tasks to configure the control plane security feature via the campus AP
whitelist or automatic certificate provisioning. For complete details on performing each of these individual steps,
see “Configuring Control Plane Security” on page374 and “Whitelists on Master and Local Controllers” on
page380
Table 68 Control Plane Security Migration Strategies
Configuring Control Plane Security
Before you enable control plane security for the first time, you must either add all valid APs to the campus AP
whitelist or enable automatic certificate provisioning. If you do not enable automatic certificate provisioning,
only the APs currently approved in the campus AP whitelist will be allowed to communicate with the controller
over a secure channel. Any APs that do not receive a certificate will not be able to communicate with the
controller except to request a certificate.
Verifying Certificates
Before you begin configuring the control plane security feature on W-600 Series Controller or W-3000 Controller
Series controllers, verify that its Trusted Platform Module (TPM) and factory-installed certificates are present
and valid by accessing the controller’s command-line interface and issuing the command show tpm cert-info. If
Automatically send Certificates to Campus APs Manually Certify Campus APs
1. Access the control plane security window and enable both
the control plane security feature and the auto certificate
provisioning option. Next, specify whether you want all
associated campus APs to automatically receive a
certificate, or if you want to certify only those APs within a
defined range of IP addresses.
1. Identify the campus APs that should receive certificates by
entering the campus APs’ MAC addresses in the campus AP
whitelist.
2. Once all APs have received their certificates, disable auto
certificate provisioning to prevent certificates from being
issued to any rogue APs that may appear on your network
at a later time.
2. If your network includes both master and local controllers, wait
a few minutes, then verify that the campus AP whitelist has
been propagated to all other controllers on the network.
Access the WebUI of the master controller, navigate to
Configuration>Controller>Control Plane Security, then verify
that the Current Sequence Number field has the same value as
the Sequence Number entry for each local controller in the
local controller whitelist. (For details, see “Verify Whitelist
Synchronization” on page390.)
3. If a valid AP did not receive a certificate during the initial
certificate distribution, you can manually certify the AP by
adding that AP’s MAC address to the campus AP whitelist.
You can also use this whitelist to revoke certificates from
APs that should not be allowed access to the secure
network.
3. Enable the control plane security feature.