Users Guide

376 | Control Plane Security Dell PowerConnect ArubaOS 5.0 | [User Guide
4. Click Apply to save your changes.
The master controller will generate its self-signed certificate and will begin distributing certificates to campus APs
and any local controllers on the network over a clear channel. After all APs have received a certificate and have
connected to the network using a secure channel, access the Control Plane Security window and turn off auto
certificate provisioning if that feature was enabled. This prevents the controller from issuing a certificate to any
rogue APs that may appear on your network at a later time.
Figure 66 Control Plane Security Settings
Configuring Settings via the CLI
Use the following commands to configure control plane security via the command line interface on a standalone
or master controller. Descriptions of the individual parameters are listed in Table 69, above.
control-plane-security
auto-cert-allowed-addrs <ipaddress-start> <ipaddress-end>
auto-cert-allow-all
auto-cert-prov
cpsec-enable
no ...
Example:
(host)(config) # control-plane-security
auto-cert-prov
no auto-cert-allow-all
auto-cert-allowed-addrs 10.21.18.10 10.21.10.90
cpsec-enable
View the current control plane security settings using the following command:
show control-plane-security
Managing the Campus AP Whitelist
Campus APs appear as valid APs in the campus AP whitelist when you manually enter their information into the
whitelist via the controller’s CLI or WebUI, or after the controller sends the AP a certificate via automatic
certificate provisioning and the AP connects to its controller via a secure tunnel. Any APs not approved or
certified on the network will also be included in the campus AP whitelist, but these APs will appear in an
unapproved state.
Use the campus AP whitelist to grant valid APs secure access to the network, or to revoke access from suspected
rogue APs. When you revoke or remove an AP from the campus AP whitelist on a controller that uses control
plane security, that AP will not be able to communicate with the controller again, except to obtain a new
certificate.
Note: If you manually add APs to the campus AP whitelist (rather than automatically adding the APs via the automatic certificate
provisioning feature), make sure that the whitelist has been synchronized to all other controllers on the network before enabling
control plane security.