Users Guide

Dell PowerConnect ArubaOS 5.0 | User Guide Control Plane Security | 375
the controller has a valid certificate, the output of the command should appear similar to the output in the
example below.
If the controller displays the following output, it may have a corrupted or missing TPM and factory certificates.
Contact Dell technical support.
Configuring Settings via the WebUI
1. Access the WebUI of a standalone or master controller, and navigate to Configuration>Controller.
2. Select the Control Plane Security tab.
3. Configure the following control plane security parameters.
Table 69 Control Plane Security Parameters
Parameter Description
Control Plane Security Select Enable to enable the control plane security feature. This feature is disabled by default.
When control plane security is enabled, any APs on the network that do not have a valid
certificate will not be able to communicate with the controller on a clear channel, except to
obtain a certificate.
NOTE: If you plan on manually adding entries into the AP whitelist, do not enable control plane
security until after the completed whitelist has been synchronized to all controllers on the
network.
Auto Cert Provisioning When the control plane security feature is enabled, you can select this checkbox to turn on
automatic certificate provisioning. When this feature is enabled, the controller will attempt to
send certificates to all associated campus APs. Auto certificate provisioning is disabled by
default.
NOTE: If you do not want to enable automatic certificate provisioning the first time you enable
control plane security on the controller, you must identify the valid APs on your network by
adding those to the campus AP whitelist. For details, see “Viewing and Managing the Master
or Local controller Whitelists” on page382.
After you have enabled automatic certificate provisioning, you must select either Auto Cert
Allow all or Addresses Allowed for Auto Cert.
Auto Cert Allow All After you enable both control plane security and auto certificate provisioning, select Auto
Cert Allow All to allow all associated campus APs to receive automatic certificate
provisioning. This parameter is enabled by default.
Addresses Allowed for Auto
Cert
If your controller has a publicly accessible interface, you should identify the campus APs by
IP address range. This will prevent the controller from sending certificates to external or
rogue campus APs that may attempt to access your controller through that interface.
After you have enabled both control plane security and auto certificate provisioning, select
Addresses Allowed for Auto Cert to send certificates to a group of campus APs within a range
of IP addresses. In the two fields below, enter the start and end IP addresses, then click Add.
Repeat this procedure to add additional IP ranges to the list of allowed addresses. If both
control plane security and auto certificate provisioning is enabled, all campus APs in the
address list will receive automatic certificate provisioning.
Remove a range IP addresses from the list of allowed addresses by selecting the IP address
range from the list and clicking Delete.
(host) # show tpm cert-info
subject= /CN=AC1234567::00:0b:86:11:22:33
issuer= /DC=com/DC=arubanetworks/DC=ca3/CN=DEVICE-CA3
serial=5147D5BC00000000000C
notBefore=Aug 29 22:16:12 2009 GMT
notAfter=Aug 18 22:16:12 2029 GMT
(host) # show tpm cert-info
Cannot get TPM and Factory Certificate Info.
TPM and/or Factory Certificates might be missing.