Administrator Guide

1077 | Instant AP VPN Support Dell Networking W-Series ArubaOS 6.4.x| User Guide
V 54.44.44.16/28 [10/0] ipsec map
C 9.9.9.0/24 is directly connected, VLAN9
C 10.15.148.0/24 is directly connected, VLAN1
C 43.43.43.0/24 is directly connected, VLAN132
C 42.42.42.0/24 is directly connected, VLAN123
C 44.44.44.0/24 is directly connected, VLAN125
C 182.82.82.12/32 is an ipsec map 10.15.149.69-182.82.82.12
C 182.82.82.14/32 is an ipsec map 10.17.87.126-182.82.82.14
Branch-ID Allocation
For branches deployed in distributed L3 and distributed L2 mode, the master AP in the branch and the
controller should agree upon a subnet/IP addresses to be used for DHCP services in the branch. The process or
protocol used by the master AP and the controller to determine the subnet/IP addresses used in a branch is
called BID allocation. The BID allocation process is not essential for branches deployed in local or centralized L2
mode. The following are some of the key functions of the BID allocation process:
l Determines the IP addresses used in a branch for distributed L2 mode
l Determines the subnet used in a branch for distributed L3 mode
l Avoids IP address or subnet overlap (that is, avoids IP conflict)
l Ensures that a branch is allocated the same subnet or range of IP addresses irrespective of which AP in the
branch becomes the master in the IAP cluster
Centralized BID Allocation
In Master-Local controller set-up, the Master controller runs the BID allocation algorithm and allocates BID to
the branches terminating on it and to the Local controllers. The Master controller saves the BIDs in it’s memory
IAP database to avoid the collision of BID (per subnet) whereas the Local controller saves the BIDs only in it’s in
memory data structures. The IAP manager in Local controller forwards only the new register request (branch
coming for the first time with BIDs as -1) message to the Master controller. For existing branch’s register
request, the Local controller tries to honor the requested BIDs first. The master and local communication is
within the existing IPSec tunnel. The Master controller gets the register request and allocates BIDs using the
BID allocation algorithm. Finally, the Master controller sends back the allocated BIDs to the Local controller
and the Local controller updates its data structure and sends the response to the IAP.
General guidelines for upgrading from existing IAP-VPN release to ArubaOS 6.4:
1. Ensure that all the branches are upgraded to Instant 4.0.
2. Upgrade the data-center to ArubaOS 6.4.
If you have a Master-Local setup; upgrade the Master controller first and then the Local controller.
3. Ensure that always the IAP-VPN branches are configured using authorized tools like W-AirWave, else you
must trust all branches or the required branch using the following command,
iap trusted-branch-db allow-all
or
iap trusted-branch-db add mac-address<mac-address>
Instant version earlier than 4.0 also need the previous command to be executed for the controller to come up with
ArubaOS 6.4.