Tunneled Node profile on a Mobility Controller and Cluster
Use the following commands to configure a secondary user role on the Mobility Controller:
switch(config)# user-role authenticated
access-list session global-sacl
access-list session apprf-authenticated-sacl
access-list session ra-guard
access-list session allowall
access-list session v6-allowall
If the managed device is in a cluster, deploy the following configuration on the Mobility Master:
lc-cluster group-profile "hp2node"
controller 10.0.102.6
controller 10.0.102.218
(ArubaMM) [mm] (config) #cd /md/00:1a:1e:02:a4:c0
(ArubaMM) [00:1a:1e:02:a4:c0] (config) #lc-cluster group-membership hp2node
(ArubaMM) [mm] (config) #cd /md/00:1a:1e:02:a6:40
(ArubaMM) [00:1a:1e:02:a6:40] (config) #lc-cluster group-membership hp2node
(ArubaMM) (config) #show configuration node-hierarchy
Default-node is not configured. Autopark is disabled.
Configuration node hierarchy
----------------------------
Config Node Type
----------- ----
/ System
/md System
/md/00:1a:1e:02:a4:c0 Device
/md/00:1a:1e:02:a6:40 Device
/mm System
/mm/mynode System
NOTE:
Configure a cluster profile, specify the managed device IP addresses, and map the managed
devices to the cluster profile.
(ArubaMM) [mynode](config) #show switches
All Switches
------------
IP Address IPv6 Address Name Location Type Model Version Status Configuration State Config
Sync Time (sec) Config ID
---------- ------------ ---- -------- ---- ----- ------- ------ ------------------- ----------
------------ ---------
15.212.178.108 None ArubaMM Building1.floor1 master ArubaMM 8.0.0.0_55647 up UPDATE SUCCESSFUL
0 0
10.0.102.218 None C2 Building1.floor1 MD Aruba7210 8.0.0.0-hp-interop_0000 up UNK
(00:1a:1e:02:a6:40) N/A N/A
10.0.102.6 None C1 Building1.floor1 MD Aruba7210 8.0.0.0-hp-interop_0000 up UNK
(00:1a:1e:02:a4:c0) N/A N/A
Verify that all managed devices are added and the status is
Update Successful
.
Using User Roles with User-Based Tunneling
User-Based Tunnels can also be used with Local User Roles and any third-party RADIUS server. This requires
that the user roles be preconfigured on the switch. For truly colorless and dynamic policy management, Aruba
recommends the use of ClearPass to dynamically send policies to both the switch and controller using
Downloadable User Roles along with User-Based Tunneling.
• There are two roles required when using Downloadable User Roles with User-Based Tunneling:
636
Aruba 2930F / 2930M Management and Configuration Guide
for ArubaOS-Switch 16.08
