Administrator Guide

Dell Networking W-Series ArubaOS 6.4.x| User Guide Tunneled Nodes | 246
Chapter 8
Tunneled Nodes
This chapter describes how to configure a Dell tunneled node, also known as a wired tunneled node. Dell
tunneled nodes provide access and security using an overlay architecture.
This chapter describes the following topics:
l Understanding Tunneled Node Configuration on page 246
l Configuring a Wired Tunneled Node Client on page 247
Understanding Tunneled Node Configuration
The Dell tunneled node connects to one or more client devices at the edge of the network and then establishes
a secure GRE tunnel to the controlling concentrator server. This approach allows the controller to support all
the centralized security features, such as 802.1x authentication, captive-portal authentication, and stateful
firewall. The Dell tunneled node is required to handle only the physical connection to clients and support for its
end of the GRE tunnel.
To support the wired concentrator, the controller must have a license to terminate access points (APs). No
other configuration is required. To configure the Dell tunneled node, you must specify the IP address of the
controller and identify the ports that are to be used as active tunneled node ports. Tunnels are established
between the controller and each active tunneled node port on the tunneled node. All tunneled node units
must be running the same version of software. The tunneled node port can also be configured as a trunk port.
This allows customers to have multiple clients on different VLANs that come through the trunk port instead of
having clients on a single vlan.
Figure 40 shows how the tunneled node fits into network operations. Traffic moves through GRE tunnels
between the active tunneled node ports and the controller or controllers. Policies are configured on a master
server and enforced on the local controllers. The master and the local controller can run on the same or
different systems. The tunneled node can connect to the master, but it is not required.
On the controlling controller, you can assign the same policy to tunneled node user traffic as you would to any
untrusted wired traffic. The profile specified by the aaa authentication wired command determines the
initial role, which contains the policy. The VLAN setting on the concentrator port must match the VLAN that will
be used for users at the local controller.