The access point is where Wi-Fi actually happens, and on an Aruba network it is also the component that changes personality the most. The same AP model can be a Campus AP tunnelling to a controller, a Remote AP in an employee’s home, an Instant AP managing its own cluster, an Air Monitor hunting rogues, or an AOS 10 AP managed from the cloud. This post covers the hardware, then follows an AP from power-on to serving clients, and finishes with modes, security, Remote APs and troubleshooting.
Aruba Wireless series — seven posts from architecture to troubleshooting.
- Part 1: Architecture, Product Families and Operating Systems
- Part 2: Mobility Conductor, Mobility Controllers and the Configuration Hierarchy
- Part 3: Access Points — Boot, Discovery, Provisioning and Forwarding Modes (this post)
- Part 4: Building WLANs with Profiles — 802.1X, PSK, WPA3 and Guest SSIDs
- Part 5: User Roles, the Policy Enforcement Firewall, AAA and ClearPass
- Part 6: Controller Clustering, Redundancy, Roaming and Live Upgrade
- Part 7: RF Management (ARM, AirMatch, ClientMatch) and Troubleshooting
AP Hardware and Naming
Aruba model numbers encode a surprising amount of information:
- Series (first digit) — the Wi-Fi generation: 3xx = Wi-Fi 5 (802.11ac), 5xx = Wi-Fi 6 (802.11ax), 6xx = Wi-Fi 6E (adds 6 GHz), 7xx = Wi-Fi 7 (802.11be).
- Tier (second digit) — position in the range. In the 500 series, for example, the 50x models are entry level, 51x mainstream, 53x high performance and 55x the flagship with the most spatial streams.
- Antenna (last digit) — by convention, 4 means external antenna connectors and 5 means integrated antennas: AP-514 vs AP-515, AP-534 vs AP-535.
- Suffixes — H for hospitality wall-plate models with extra Ethernet ports (AP-503H, AP-505H), R for remote/teleworker models, -RW / -US / -JP / -IL / -EG regional variants that restrict the regulatory domain. Outdoor models have their own ranges (for example the 57x family) and IP66/67 enclosures.
| Generation | Example models | Bands | Notable features |
|---|---|---|---|
| Wi-Fi 5 (wave 2) | AP-303, AP-315, AP-325, AP-345 | 2.4 + 5 GHz | MU-MIMO downlink; many still in service |
| Wi-Fi 6 | AP-505, AP-515, AP-535, AP-555 | 2.4 + 5 GHz (AP-555 dual 5 GHz) | OFDMA, uplink MU-MIMO, BSS colouring, TWT, WPA3 |
| Wi-Fi 6E | AP-635, AP-655 | 2.4 + 5 + 6 GHz (tri-radio) | 6 GHz with 160 MHz channels; WPA3/OWE mandatory on 6 GHz |
| Wi-Fi 7 | 730-series and later | 2.4 + 5 + 6 GHz | 320 MHz channels, 4K-QAM, multi-link operation (MLO) |
Most current APs also include a BLE / Zigbee IoT radio for asset tags, location beacons and smart-building sensors, a USB port for IoT dongles, and a dedicated scanning radio on higher-end models so that RF monitoring does not steal airtime from client-serving radios.
Power
PoE budget determines what an AP can do. 802.3af (Class 3, ~13 W at the AP) is enough only for older or entry-level models. Most Wi-Fi 6 APs want 802.3at (PoE+, ~25.5 W), and tri-radio 6E and Wi-Fi 7 APs often need 802.3bt (Class 5 or above) for full functionality. Aruba’s Intelligent Power Monitoring (IPM) lets an under-powered AP keep running by selectively disabling features — the USB port first, then reducing spatial streams — rather than refusing to boot. An AP running in a reduced power state shows it in show ap debug system-status; this is a common hidden cause of “the new APs are slower than expected”. Dual-uplink models can also combine power from two switch ports.
From Power-On to Serving Clients
1. APBoot
The AP’s bootloader, APBoot, checks the image in flash and loads it. With a console cable attached, pressing Enter during the countdown drops to the apboot> prompt, which is the AP’s equivalent of ROMMON — invaluable when an AP will not join:
apboot> printenv ! show stored provisioning variables
apboot> setenv master 10.1.10.21 ! statically point at a controller
apboot> setenv serverip 10.1.10.21 ! TFTP server for image download
apboot> saveenv
apboot> boot
apboot> factory_reset ! wipe provisioning, certificates and config
apboot> purgeenv ! clear stored environment variables only2. DHCP
The AP requests an address on its native (untagged) VLAN. Aruba APs identify themselves with DHCP vendor class identifier ArubaAP (Instant APs send ArubaInstantAP), which lets the DHCP server hand out an option 43 value only to them.
3. Controller Discovery
The AP needs one IP address: a controller that will accept it. It tries these methods in order and stops at the first that works:
- Static — a master/controller address stored in flash by provisioning or
setenv master. - DHCP option 43 — the controller IP (or cluster VIP) returned in vendor-specific option 43, matched on vendor class “ArubaAP”. Works across Layer 3.
- ADP (Aruba Discovery Protocol) — the AP sends a discovery request to multicast group 239.0.82.11 on UDP 8200, then broadcasts it. Controllers on the same Layer 2 segment (or reachable via multicast routing) answer. Handy in a lab, unsuitable for routed campuses.
- DNS — the AP resolves
aruba-masterusing the domain name from DHCP (for examplearuba-master.corp.example).
In AOS 8 the address discovered here must be a controller (or cluster VIP), not the Mobility Conductor: APs never terminate on the Conductor. A Windows DHCP server example:
REM Define a vendor class matching the string ArubaAP, then add option 43 for it
netsh dhcp server add class ArubaAP "Aruba AP" "ArubaAP" 1
netsh dhcp server add optiondef 43 "Aruba Controller" STRING 0 vendor=ArubaAP
netsh dhcp server scope 10.1.50.0 set optionvalue 43 STRING vendor=ArubaAP "10.1.10.20"And the ISC DHCP / Kea equivalent concept: match vendor-class-identifier "ArubaAP" and send option 43 as the text string of the controller IP. On a Cisco IOS DHCP server, option 43 ascii "10.1.10.20" inside the AP pool achieves the same.
4. Joining the Controller
The AP sends a PAPI (Aruba’s control protocol, UDP 8211) hello to the discovered address. The controller looks up which AP group the AP belongs to and returns the address of the controller that should actually terminate it — historically the LMS (Local Management Switch) and backup LMS from the AP system profile, and in a cluster the list of cluster nodes from which the AP’s anchor controller is chosen (Part 6).
5. Image Check
If the AP’s software version differs from the controller’s, the AP downloads the matching image from the controller (FTP or TFTP), reboots and repeats the process. The AP always runs the same AOS version as its controller; there is no separate AP firmware to manage. On a large network, a controller upgrade therefore means thousands of APs upgrading — Part 6 covers how AP image preloading and Live Upgrade avoid a mass outage.
6. Configuration and Tunnels
The AP receives the profiles of its AP group, brings up its radios on the channels and powers chosen by AirMatch, builds GRE tunnels for its tunnelled SSIDs, and starts beaconing. From this point onward the AP sends regular heartbeats; if it misses enough of them (governed by the heartbeat interval and bootstrap threshold in the AP system profile), it declares the controller lost and fails over.
When Nothing Answers: Universal APs
A factory-default universal AP that finds no controller does not simply give up. It asks Aruba Activate / Central whether a provisioning rule exists for its serial number — which might tell it to become a Campus AP for a particular controller, an Instant AP, or an AOS 10 AP managed by Central. If no rule exists either, it boots as an Instant AP and broadcasts a setup SSID (historically named SetMeUp-xx:xx:xx) for initial configuration. This is why a brand-new AP plugged into a network without option 43 often appears as an Instant AP instead of joining the controller.
Protocols Between AP and Controller
| Protocol | Transport | Purpose |
|---|---|---|
| ADP | UDP 8200, multicast 239.0.82.11 / broadcast | Controller discovery on the local segment |
| PAPI | UDP 8211 | Control channel: provisioning, config, keepalives, statistics |
| GRE | IP protocol 47 | User data tunnels (tunnel and decrypt-tunnel modes); heartbeats |
| IPsec / IKE | UDP 500, UDP 4500 (NAT-T) | Protects PAPI when CPsec is on; carries everything for Remote APs |
| FTP / TFTP | TCP 21 / UDP 69 | AP image download |
| RADIUS | UDP 1812/1813 | Not from Campus APs in AOS 8 — the controller is the RADIUS client even for bridged SSIDs. Instant and AOS 10 APs send RADIUS themselves. |
Each AP builds a GRE tunnel per BSSID (per SSID per radio) to its controller, and multiple user VLANs share those tunnels — the VLAN is a property of the user session on the controller, not of the tunnel. The GRE tunnel itself is not encrypted; in tunnel mode it does not need to be, because the payload is still 802.11-encrypted (Part 1, Figure 4).
AP Groups, AP Names and Provisioning
Aruba does not configure APs individually. Every AP belongs to exactly one AP group, and the AP group is a container that references all the profiles that matter: which virtual APs (WLANs) to broadcast, which radio profiles, regulatory domain, AP system profile, wired port profiles, IDS profile and so on. Part 4 builds an AP group from scratch.
Where a single AP needs to differ — a specific channel, an extra SSID in one conference room — an AP name profile overrides the group for that AP. AP-name overrides should be the exception; dozens of them make a network hard to reason about.
A new AP lands in the default AP group. Moving it to the right group and giving it a meaningful name is provisioning. Both values are stored in the AP’s own flash, so the AP keeps them across reboots and controller failovers:
! Rename and regroup — the AP reboots to apply the new group
(HQ-MC1) #ap-rename ap-name 20:4c:03:12:34:56 HQ-B1-F2-AP07
(HQ-MC1) #ap-regroup ap-name HQ-B1-F2-AP07 HQ-Building1
! Full provisioning workflow (static IP, master, group, etc.)
(HQ-MC1) (config) #provision-ap
(HQ-MC1) (AP provisioning) #read-bootinfo ap-name HQ-B1-F2-AP07
(HQ-MC1) (AP provisioning) #copy-provisioning-params ap-name HQ-B1-F2-AP07
(HQ-MC1) (AP provisioning) #ap-group HQ-Building1
(HQ-MC1) (AP provisioning) #master 10.1.10.20
(HQ-MC1) (AP provisioning) #reprovision ap-name HQ-B1-F2-AP07In the WebUI the same is done under Configuration › Access Points › Campus APs: select one or many APs, then Provision. Naming conventions are worth deciding on day one; a name like HQ-B1-F2-AP07 (site, building, floor, number) turns every log line and client complaint into a location.
The AP System Profile
The AP system profile, referenced by the AP group, holds AP-to-controller behaviour:
ap system-profile HQ-sys
lms-ip 10.1.10.20 ! controller or cluster VIP the AP should terminate on
bkup-lms-ip 10.2.10.20 ! fallback (non-cluster designs)
lms-preemption ! return to primary LMS when it recovers
lms-hold-down-period 600
session-acl ap-uplink-acl ! ACL applied on the AP's wired uplink
dns-domain corp.example
!
ap-group HQ-Building1
ap-system-profile HQ-sysAP Modes
| Mode | What the AP does | How it is set |
|---|---|---|
| Campus AP (CAP) | Serves clients; tunnels to a controller across the LAN | Default when a controller is discovered |
| Remote AP (RAP) | Serves clients over an IPsec tunnel across the internet | Provisioned as remote; RAP whitelist |
| Instant AP (IAP) | Controllerless; one AP is the virtual controller | Default with no controller and no Activate rule |
| Air Monitor (AM) | Dedicated to scanning: rogue detection, containment, WIDS, RF data for AirMatch | Radio profile mode am-mode |
| Spectrum Monitor (SM) | Layer 1 spectrum analysis — microwaves, Bluetooth, video bridges, jammers | Radio profile mode spectrum-mode |
| Hybrid AP | Serves clients while also performing spectrum analysis on the same radio | spectrum-monitoring on the serving radio profile |
| Mesh Portal / Mesh Point | Portal has a wired uplink; Points backhaul over the air through it | Provisioned mesh role + mesh cluster profile |
Mode is set per radio in many cases, so a dual-radio AP can serve clients on 5 GHz while its 2.4 GHz radio acts as an air monitor. Modern APs with a dedicated scanning radio make most of this unnecessary for day-to-day WIDS and AirMatch data.
Control Plane Security (CPsec)
PAPI was designed for a trusted LAN. Control Plane Security wraps the AP-to-controller control channel in IPsec and, just as importantly, controls which APs may join at all. With CPsec enabled (the default in modern releases):
- Each AP authenticates using a certificate — Aruba APs carry a factory certificate in a TPM chip; the controller can issue a certificate to APs without one.
- The controller maintains a CPsec whitelist of AP MAC addresses and their state. Unknown APs can be auto-approved (convenient during rollout) or held for manual approval (secure in steady state).
- Control traffic between AP and controller is encrypted, so PAPI cannot be spoofed or sniffed on the wire.
(HQ-MC1) #show control-plane-security
(HQ-MC1) #show whitelist-db cpsec
MAC-Address Enable State Cert-Type Description
----------- ------ ----- --------- -----------
20:4c:03:12:34:56 Enabled certified-factory-cert factory HQ-B1-F2-AP07
20:4c:03:12:34:9a Enabled unapproved-factory-cert factory
(HQ-MC1) #whitelist-db cpsec modify mac-address 20:4c:03:12:34:9a state approved-ready-for-certA typical rollout enables automatic approval while APs are being installed, then switches it off so that only whitelisted APs can join afterwards. Forgetting to switch it off leaves an open door: any Aruba AP plugged into a port that can reach the controller would join and be handed the corporate SSID configuration.
Wired-Side Security for APs
AP switchports are a physical security weak point — an attacker can unplug an AP and plug in a laptop. Two mitigations are common: 802.1X on the AP port, with the AP acting as a supplicant (Aruba APs can authenticate with their factory certificate via EAP-TLS, or with PEAP credentials configured in the AP’s provisioning), and an uplink ACL or port profile on the switch limiting the port to the AP management VLAN and to the protocols in the table above.
Forwarding Modes Revisited
Part 1 introduced forwarding modes. With the AP-controller protocols in view, the differences become concrete:
- Tunnel — the AP forwards the still-encrypted 802.11 frame in GRE; the controller decrypts, authenticates, applies the role, and switches the user onto a VLAN. Default and recommended for campus.
- Decrypt-tunnel — the AP decrypts and sends 802.3 frames in GRE. Offloads cryptography from the controller (useful with very high-throughput Wi-Fi 6/6E APs) and enables features that need the AP to see clear traffic. The AP-controller path should be trusted or otherwise protected.
- Bridge — the AP decrypts and bridges onto its own switchport. The user VLAN must be trunked to the AP. Role-based firewall policy is enforced on the AP itself, with a reduced feature set compared to the controller. Roaming between APs on different switches requires the VLAN to span them.
- Split-tunnel — used mostly on Remote APs: traffic to corporate destinations (defined by the role’s ACL using the
routeorsrc-natactions) goes through the tunnel, everything else is NATed out locally at the AP.
Remote APs
A Remote AP (RAP) brings the corporate WLAN to a home office, hotel or small branch with nothing more than an internet connection. The RAP builds an IPsec tunnel to a controller — typically a VPN concentrator behind the corporate firewall with UDP 4500 forwarded to it — and then behaves exactly like a Campus AP. The employee sees the same SSID, authenticates the same way and lands in the same role as in the office.
RAP specifics:
- Authentication — modern RAPs use their factory certificate (certificate-based RAP) and must be listed in the RAP whitelist with the AP group they belong to. Older deployments used a PSK plus a username/password.
- Provisioning — a RAP can be zero-touch provisioned through Activate/Central, or pre-staged in the office and then shipped. The controller address is the public IP or FQDN of the concentrator.
- Wired ports — RAP Ethernet ports can be tunnelled, bridged or split, so the desk phone and a printer at home can join the corporate network too.
- Survivability — the
rap-operationsetting on a virtual AP controls what happens when the tunnel is down:standard(SSID only up while connected),persistent(stays up once the tunnel has been established),always(always broadcast, typically a bridged PSK SSID) andbackup(only broadcast when the controller is unreachable).
(HQ-VPNC) #whitelist-db rap add mac-address 20:4c:03:aa:bb:cc ap-group Home-RAPs full-name "J. Smith" description "Home office"
(HQ-VPNC) #show whitelist-db rap
(HQ-VPNC) #show ap database long | include RInstant APs in Brief
An Instant cluster elects a conductor (virtual controller) among APs in the same VLAN. The VC owns a virtual controller IP — the address administrators browse to — and if the VC fails, another AP takes over the role and the IP. Instant configuration is flat (no node tree), and every Instant AP enforces roles and firewall rules itself. Instant clusters can be managed from Aruba Central or AirWave, and an Instant AP can be converted to a Campus AP from its web UI (Maintenance › Convert) by pointing it at a controller — the standard way to absorb Instant sites into a controller-based network.
Troubleshooting APs
Reading show ap database
(HQ-MC1) #show ap database long
AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP Wired MAC Address Serial #
---- ----- ------- ---------- ------ ----- --------- ---------- ----------------- --------
HQ-B1-F2-AP07 HQ-Building1 515 10.1.50.23 Up 3d:4h:12m 10.1.10.21 10.1.10.22 20:4c:03:12:34:56 CNxxxxxxx
HQ-B1-F2-AP08 HQ-Building1 515 10.1.50.24 Up 3d:4h:10m L 10.1.10.21 10.1.10.22 20:4c:03:12:34:78 CNxxxxxxx
20:4c:03:12:34:9a default 635 10.1.50.31 Down U 10.1.10.21 0.0.0.0 20:4c:03:12:34:9a CNxxxxxxxThe Flags column is the fastest diagnostic on the platform. The most useful ones:
| Flag | Meaning | Usual fix |
|---|---|---|
| U | Unprovisioned | Provision the AP (or approve it in the CPsec whitelist) |
| L | Unlicensed | Check licence pools on the Conductor |
| G | No such AP group | AP is provisioned into a group that does not exist on this node |
| D | Dirty or no configuration | Config push incomplete; check controller logs |
| N | Duplicate AP name | Rename one of the APs |
| R | Remote AP | Informational |
| S | Standby connection | Informational (AP has a standby tunnel) |
| I | Inactive | AP is up but radios not serving — often regulatory or power issues |
| F / 1 | Failed / succeeded 802.1X on the AP uplink | Check the wired authentication of the AP itself |
The command prints the full legend at the bottom of its output; the exact set grows with each release.
A Diagnostic Ladder for “The AP Will Not Come Up”
- Power and link — LEDs, switch PoE status, negotiated PoE class. An AP that keeps rebooting is often power-starved.
- IP — does the switch’s MAC table and the DHCP server show a lease for the AP?
show ap databasemay list it with its IP even if it is down. - Discovery — with a console:
printenvin APBoot and the boot messages show which discovery method was tried and what address was found. Verify option 43 or DNS. - Reachability — PAPI (UDP 8211), GRE (protocol 47) and IPsec (UDP 500/4500) must pass every firewall between AP and controller.
- Authorization — CPsec whitelist state, RAP whitelist, licence (
L), AP group existence (G). - Image — an AP stuck in a reboot loop after an upgrade is often failing the image download; check the controller log for transfer errors.
- Radios — the AP is up but no SSID: check
show ap bss-table, the virtual AP’s band settings, the regulatory domain, and whether the VAP is enabled.
(HQ-MC1) #show ap active ! APs up and serving, with channel/power per radio
(HQ-MC1) #show ap details ap-name HQ-B1-F2-AP07 ! everything about one AP
(HQ-MC1) #show ap debug system-status ap-name HQ-B1-F2-AP07 ! uptime, reboot reason, power state
(HQ-MC1) #show ap bss-table ap-name HQ-B1-F2-AP07 ! BSSIDs, SSIDs, channels
(HQ-MC1) #show ap radio-summary
(HQ-MC1) #show log system 50 | include AP
(HQ-MC1) #show ap tech-support ap-name HQ-B1-F2-AP07 ! bundle for TACExercises
1. Twenty new APs on a routed AP subnet all boot as Instant APs and broadcast a SetMeUp SSID instead of joining the controller. The controller is reachable. What is the most likely cause, and what are two ways to fix it?
Show answer
No discovery method succeeded: the AP subnet is routed (ADP fails), and there is no DHCP option 43 and no aruba-master DNS record. Universal APs then fall back to Instant mode. Fix by adding option 43 (vendor class ArubaAP) with the controller/cluster VIP to the AP scope, or by creating an aruba-master DNS A record in the domain the APs receive from DHCP. (An Activate/Central provisioning rule is a third option.)
2. After a new firewall is inserted between the AP floors and the data centre, APs appear in show ap database for a minute or two, then drop and rejoin over and over. Clients cannot connect to tunnelled SSIDs. PAPI and IPsec are permitted. What was blocked?
Show answer
GRE (IP protocol 47). PAPI over IPsec is enough for the AP to discover and join the controller, but the GRE tunnels never come up. AP heartbeats travel in GRE, so the AP misses its bootstrap threshold, declares the controller lost and starts again; and all client 802.11 traffic in tunnel mode rides in GRE too. Many firewalls only permit TCP/UDP/ICMP by default, so GRE must be allowed explicitly.
3. A Wi-Fi 6E AP-655 is installed on an 802.3at switch port. It works, but throughput is lower than expected and the USB port does not power a BLE dongle. Explain.
Show answer
The AP is running under Intelligent Power Monitoring in a reduced power state because it needs more than PoE+ supplies for full functionality. IPM has disabled the USB port and reduced radio capability (for example spatial streams). show ap debug system-status shows the power state; an 802.3bt port (or dual uplinks, if supported) restores full operation.
4. During a rollout, CPsec auto-approval was enabled. Six months later a contractor plugs a second-hand Aruba AP into a conference-room port and it starts broadcasting the corporate SSIDs. What should have been done?
Show answer
Automatic approval should have been disabled once installation finished, so new APs stay unapproved in the CPsec whitelist until an administrator approves them. Wired-side 802.1X on AP ports would add a second layer.
5. Choose a forwarding mode for each: (a) a 2,000-seat campus where all users should share a single /20 employee VLAN and roam seamlessly; (b) a home worker who needs corporate apps and a desk phone but should stream video directly to the internet; (c) a small warehouse with no controller nearby and a local printer VLAN.
Show answer
(a) Tunnel (or decrypt-tunnel) to a controller cluster — the VLAN lives on the controllers and roaming is seamless. (b) Split-tunnel on a Remote AP, with the phone’s wired port tunnelled. (c) Bridge mode, with the printer VLAN trunked to the APs (or Instant APs in the warehouse).
6. In show ap database an AP shows status Up with the G flag. What happened and what does the AP do?
Show answer
The AP is provisioned into an AP group name that does not exist in the effective configuration of the controller it joined — typically a typo, or the group was created on a different node of the Conductor hierarchy. The AP cannot get its profiles and does not serve the intended SSIDs. Create the group at the correct node or regroup the AP.
Summary
Aruba APs are universal: what they become depends on what they discover at boot. A Campus AP gets an address via DHCP, finds a controller through a static entry, DHCP option 43, ADP or DNS, sends a PAPI hello, matches its software version to the controller, downloads its AP group’s profiles and builds GRE tunnels. AP groups hold all configuration, AP names override it per AP, and provisioning (name, group, controller address) is stored in AP flash. Control plane security protects PAPI with IPsec and gates which APs may join through a whitelist. Remote APs extend the same model over the internet through IPsec, and forwarding mode decides where traffic is decrypted and where it exits. show ap database flags and a structured ladder — power, IP, discovery, reachability, authorization, image, radios — solve most AP problems.
Next: Part 4 puts the profiles to work, building complete 802.1X, PSK, WPA3 and guest WLANs from SSID profile to AP group.