an indication to the managed device that it has to enforce additional policies to the user traffic based on policy
configuration associated with the secondary role and then from the tunnel.
Tunneling to a Controller Cluster
To ensure high availability, customers can tunnel traffic to a Controller Cluster instead of just to a standalone
controller. If users are tunneled to a controller cluster, the bucket map containing the mapping between a bucket
of clients to the active UAC and s-UAC is populated in the controller. A value based on the client MAC address is
assigned when a user is redirected to a controller. This value is then used to look up the bucket map and the
client device is then anchored to that particular controller node. This secondary role information is an indication to
the controller that it has to enforce additional policies to user traffic based on policy configuration associated with
the secondary role. After this process, the per user tunneled node module creates a tunnel to this UAC, if not
already created, and forward user traffic to that UAC. If a user role does not contain an attribute to redirect traffic
to a controller, then the switch will forward the traffic locally.
Once user tunnels are established to the user anchor controllers, a PAPI (Process Application Programming
Interface)-based keepalive packet is exchanged with the controllers that have users anchored to them.
NOTE:
Upgrading from earlier images to 16.08 or greater with the same user role configuration is
seamless and is supported. After upgrading to 16.08 or later, if Reserved VLAN mode is configured,
the VLAN IDs already configured in user roles will not be used for tunneling traffic to the controller.
Downgrading is not allowed when User-Based Tunneling is operating in Reserved VLAN mode. The
user cannot downgrade to pre-16.08 image if the user role lacks a VLAN configuration.
Licensing Requirements
A license is required to activate Dynamic Segmentation and if the license is not installed, controllers will not be
allowed to form tunnels to Aruba switches and the feature will not be functional. The AP/switch consumes the
following license types:
AP
PEFNG
RFP
WebCC
MC-VA (for VMC-MD)
The
show license-usage ap
command displays license usage for User-Based Tunnels. Licenses are
consumed per switch and User-Based Tunnels will show up alongside APs for license consumption.
switch# show ap license-usage
AP Licenses
-----------
Type Number
---- ------
AP Licenses 2048
RF Protect Licenses 2048
PEF Licenses 2048
MM Licenses 2048
Controller License True
Overall AP License Limit 2048
AP Usage
--------
Type Count
---- -----
Active CAPs 0
Active RAPs 0
622
Aruba 2930F / 2930M Management and Configuration Guide
for ArubaOS-Switch 16.08
