Blog

Parts 2 and 3 built the platform: a Mobility Conductor configuring controllers, and APs joined to those controllers in AP groups. Nothing is broadcasting yet. This post creates real WLANs — an 802.1X employee network, a PSK network for IoT devices, and a captive-portal guest network — and in doing so explains the profile model that every Aruba configuration is built from.

The Profile Model

Aruba configuration is a graph of named profiles. Each profile configures one aspect of behaviour and refers to other profiles by name. A WLAN is not a single object; it is a virtual AP profile that ties together an SSID profile, an AAA profile, a VLAN and a forwarding mode, and it only goes on the air when an AP group references it.

Two habits make this model manageable:

• Never edit the default profiles. Every AP group, VAP and AAA profile has a default instance. Changing it silently affects everything that still references it, including APs that happen to land in the default AP group. Create named profiles instead.
• Use a naming convention that makes the graph readable: CORP-SSID, CORP-AAA, CORP-VAP, CORP-dot1x. When debugging, show wlan virtual-ap CORP-VAP then leads naturally to every profile it references.

On a Mobility Conductor, all of the following is entered at the node where the WLAN should exist — typically /md for a corporate WLAN used everywhere, or a site node for something local (Part 2). The examples use /md/USA/HQ.

Build 1: An 802.1X Enterprise WLAN

Goal: SSID Corp, WPA3-Enterprise (with WPA2 fallback discussed below), authenticated against two ClearPass (or any RADIUS) servers, users tunnelled to VLAN 20 and placed in the employee role unless RADIUS says otherwise.

Step 1 — RADIUS Servers and Server Group

(MCR-1) [mynode] #cd /md/USA/HQ
(MCR-1) [HQ] #configure terminal

aaa authentication-server radius CPPM1
    host 10.1.1.51
    key Radius-Secret-2026
    nas-identifier HQ-Aruba
!
aaa authentication-server radius CPPM2
    host 10.1.1.52
    key Radius-Secret-2026
    nas-identifier HQ-Aruba
!
aaa server-group CORP-SG
    auth-server CPPM1
    auth-server CPPM2
!
! Source RADIUS from the controller's management VLAN so the server sees a predictable NAS-IP
ip radius source-interface vlan 10

Servers in a group are tried in order; the second is used only when the first does not respond (fail-through to the next server on rejection is a separate, optional behaviour). Each managed device is its own RADIUS client, so every controller’s IP must be configured as a network device on the RADIUS server — a common gotcha when a second controller or a new cluster member is added.

Test the server before building anything on top of it:

(HQ-MC1) #aaa test-server mschapv2 CPPM1 alice Passw0rd!
Authentication Successful

Step 2 — Roles

Roles are covered properly in Part 5; for now create a simple employee role that permits everything, and use the built-in logon role as the initial (pre-authentication) role.

user-role employee
    access-list session allowall

Step 3 — 802.1X Profile and AAA Profile

aaa authentication dot1x CORP-dot1x
    ! defaults are sensible; termination stays disabled so EAP runs end-to-end to RADIUS
!
aaa profile CORP-AAA
    initial-role logon
    authentication-dot1x CORP-dot1x
    dot1x-default-role employee
    dot1x-server-group CORP-SG
    radius-accounting CORP-SG
    radius-interim-accounting

• initial-role applies from association until authentication completes. logon allows only what is needed to authenticate.
• dot1x-default-role applies after a successful 802.1X authentication unless the RADIUS server returns a role (Part 5).
• Accounting gives ClearPass session visibility and is required for many ClearPass features (session tracking, CoA, device insight).
• 802.1X termination (termination in the dot1x profile) lets the controller itself terminate the outer EAP tunnel. It exists for special cases such as LDAP back ends; with a proper RADIUS server leave it off.

Step 4 — SSID Profile

wlan ssid-profile CORP-SSID
    essid "Corp"
    opmode wpa3-aes-ccm-128
    a-basic-rates 12 24
    a-tx-rates 12 18 24 36 48 54
    g-basic-rates 12 24
    g-tx-rates 12 18 24 36 48 54
    dtim-period 1

The rate settings disable the slow legacy rates (1, 2, 5.5, 6, 9, 11 Mbps). Beacons and management frames are sent at the lowest basic rate, so raising it to 12 Mbps shrinks each cell’s effective size, cuts airtime wasted on overhead, and nudges clients to roam sooner. The trade-off is that very old 802.11b-only devices can no longer connect — almost always acceptable today. HT/VHT/HE rates (802.11n/ac/ax) are negotiated separately and are not limited by these legacy rate lists.

Step 5 — Virtual AP and AP Group

wlan virtual-ap CORP-VAP
    ssid-profile CORP-SSID
    aaa-profile CORP-AAA
    vlan 20
    forward-mode tunnel
    broadcast-filter arp
    dynamic-mcast-optimization
!
ap-group HQ-Building1
    virtual-ap CORP-VAP
!
write memory

Within a few seconds of write memory, every AP in HQ-Building1 begins beaconing Corp.

The Same Thing in the WebUI

The WLAN wizard (Configuration › WLANs › +) builds exactly the same profiles behind the scenes and names them after the WLAN:

1. General — name, primary usage (Employee/Guest), AP groups to broadcast on, forwarding mode.
2. VLANs — VLAN ID, name or pool.
3. Security — a slider from Enterprise to Personal to Open, then the key management (WPA3-Enterprise, WPA2-Enterprise, WPA3-Personal…) and the authentication servers.
4. Access — default role, and whether access is role-based or network-based.

The wizard is fast, but its auto-generated names (Corp_ssid_prof, Corp_aaa_prof) and its tendency to create one of everything mean that large networks are usually managed in the CLI or through templates, with the wizard used for learning and quick labs.

Encryption Choices: WPA2, WPA3 and Enhanced Open

Practical rules:

• Protected Management Frames (PMF/802.11w) are mandatory for WPA3 and optional for WPA2. Some old clients fail to connect with PMF required.
• Transition modes — WPA2/WPA3 mixed on one SSID, or open + OWE transition — exist so that old and new clients can share an SSID during migration. The exact keywords differ between releases; opmode ? in the SSID profile lists what the running release supports.
• 6 GHz is WPA3-only. A WLAN broadcast on 6 GHz must use WPA3-Personal (SAE), WPA3-Enterprise or Enhanced Open. A WPA2 SSID simply will not appear on the 6 GHz radio of a Wi-Fi 6E/7 AP. The common design is one WPA3 SSID broadcast on all three bands.
• Fast roaming (802.11r, OKC) is configured on the 802.1X and SSID/VAP side and is covered with roaming in Part 6.

Build 2: A PSK WLAN for IoT Devices

Scanners, sensors, printers and building systems often support nothing better than WPA2-Personal and only the 2.4 GHz band. They deserve their own SSID, VLAN and role so that a compromised device cannot reach anything beyond what it needs.

user-role iot
    access-list session iot-acl          ! defined in Part 5 — e.g. only the IoT servers
!
aaa profile IOT-AAA
    initial-role iot                     ! PSK has no per-user authentication step
!
wlan ssid-profile IOT-SSID
    essid "Corp-IoT"
    opmode wpa2-psk-aes
    wpa-passphrase V3ry-L0ng-IoT-Passphrase-2026
    g-basic-rates 6 12 24
    g-tx-rates 6 9 12 18 24 36 48 54
!
wlan virtual-ap IOT-VAP
    ssid-profile IOT-SSID
    aaa-profile IOT-AAA
    vlan 40
    allowed-band g
    forward-mode tunnel
    deny-inter-user-traffic
!
ap-group HQ-Building1
    virtual-ap IOT-VAP
!
write memory

Points to note:

• With PSK there is no authentication server to return a role, so the role comes from initial-role. MAC authentication can be layered on top (authentication-mac in the AAA profile) so that ClearPass identifies each device by MAC and returns a device-specific role.
• allowed-band g keeps the SSID off 5 GHz, so it does not consume 5 GHz beacon airtime.
• Multi-PSK (MPSK) — recent AOS 8 releases support a different passphrase per device or device group on one SSID, either from ClearPass (which returns the passphrase in a RADIUS attribute after MAC authentication) or from a local list. MPSK removes the classic PSK problem that one leaked passphrase compromises every device.
• Keep the number of SSIDs small. Every SSID beacons on every radio, about ten times per second. Five or more SSIDs on 2.4 GHz can consume a large share of airtime before any data is sent. Roles, not SSIDs, should separate most user populations.

Build 3: A Captive-Portal Guest WLAN

A captive portal on Aruba is simply a role change. The guest associates and is placed in a pre-authentication role that allows DHCP and DNS and redirects web traffic to a login page. After a successful login, the controller moves the client into a post-authentication role. Nothing else changes: same SSID, same VLAN, same IP address.

Step 1 — Guest Access Policy

netdestination RFC1918
    network 10.0.0.0 255.0.0.0
    network 172.16.0.0 255.240.0.0
    network 192.168.0.0 255.255.0.0
!
ip access-list session GUEST-INTERNET
    user any svc-dhcp permit
    user any svc-dns permit
    user alias RFC1918 any deny
    user any svc-http permit
    user any svc-https permit
    user any any deny
!
aaa bandwidth-contract GUEST-10M mbits 10
!
user-role GUEST
    access-list session GUEST-INTERNET
    bw-contract GUEST-10M per-user downstream
    bw-contract GUEST-10M per-user upstream

The ACL reads top-down, first match wins: allow DHCP and DNS, block everything internal, allow web, deny the rest. If the guests’ DNS server is internal, permit it explicitly before the RFC1918 deny line.

Step 2 — Captive Portal Profile and Pre-Authentication Role

aaa authentication captive-portal GUEST-CP
    default-role GUEST
    server-group internal                ! the controller's local user database
    redirect-pause 3
!
user-role GUEST-LOGON
    captive-portal GUEST-CP
    access-list session logon-control
    access-list session captiveportal

logon-control and captiveportal are predefined ACLs: the first permits DHCP, DNS and the basics needed before login; the second redirects HTTP/HTTPS to the portal. With an external portal such as ClearPass Guest, the captive portal profile points login-page at the external URL and the server group at ClearPass, and the portal server’s address is added to a white-list ACL in the pre-authentication role (Part 5).

Step 3 — Guest Accounts

(HQ-MC1) #local-userdb add username visitor01 password Welcome-2026 role GUEST
(HQ-MC1) #show local-userdb

The local database is fine for labs and small sites. Real guest programmes use ClearPass Guest (or another portal) for self-registration, sponsor approval, SMS/e-mail credentials and terms-of-use logging.

Step 4 — SSID, AAA Profile and VAP

aaa profile GUEST-AAA
    initial-role GUEST-LOGON
!
wlan ssid-profile GUEST-SSID
    essid "Corp-Guest"
    opmode enhanced-open
!
wlan virtual-ap GUEST-VAP
    ssid-profile GUEST-SSID
    aaa-profile GUEST-AAA
    vlan 900
    forward-mode tunnel
    deny-inter-user-traffic
    broadcast-filter arp
!
ap-group HQ-Building1
    virtual-ap GUEST-VAP
!
write memory

enhanced-open (OWE) gives guests per-client encryption without a password. Clients too old for OWE will not see the SSID unless a transition mode is used — a decision to make consciously for each venue. deny-inter-user-traffic stops guests from reaching each other’s devices.

Captive Portal Pitfalls

• Certificate warnings. The portal is served by the controller using its certificate; the default self-signed certificate triggers browser warnings. Install a publicly trusted certificate and use a matching portal hostname.
• HTTPS redirection. Browsers cannot be cleanly redirected from an HTTPS site, so the portal relies on operating systems’ captive-portal detection (which uses plain HTTP probes). Blocking those probes breaks the pop-up.
• DNS must work before login, or the client never sends the HTTP request that triggers redirection.
• MAC randomization means a returning guest’s phone may look like a new device. Portal-based “remember me” features that key on MAC addresses become unreliable.

Useful VAP Options

VLAN Pools

A single large WLAN can outgrow one subnet. Instead of a /16 broadcast domain, a VAP can reference several VLANs — directly as a list, or through a named VLAN that maps to several IDs:

vlan-name EMPLOYEE
vlan EMPLOYEE 20-23
!
wlan virtual-ap CORP-VAP
    vlan EMPLOYEE

By default the controller hashes the client’s MAC address to choose a VLAN, so a client returns to the same VLAN (and usually the same IP address) when it reconnects. Even distribution is an alternative assignment method. Named VLANs also make RADIUS-returned VLANs portable: ClearPass can return the name EMPLOYEE, and each site maps the name to its own local VLAN IDs.

Radio and Regulatory Profiles in Brief

Radio settings are mostly automated by AirMatch (Part 7), but three profiles are worth setting deliberately for each AP group:

ap regulatory-domain-profile HQ-regdom
    country-code US
    valid-11a-channel 36 40 44 48 149 153 157 161 165    ! drop DFS channels if radar is a problem
    valid-11g-channel 1 6 11
!
rf dot11a-radio-profile HQ-5GHz
    eirp-min 12
    eirp-max 18
!
rf dot11g-radio-profile HQ-2GHz
    eirp-min 6
    eirp-max 12
!
ap-group HQ-Building1
    regulatory-domain-profile HQ-regdom
    dot11a-radio-profile HQ-5GHz
    dot11g-radio-profile HQ-2GHz

Keeping 2.4 GHz power several dB below 5 GHz balances cell sizes between bands, which is the foundation for good band steering and roaming.

Verification

(HQ-MC1) #show ap essid                                ! every ESSID, how many APs and clients
(HQ-MC1) #show ap bss-table                            ! BSSID, SSID, AP, band, channel, EIRP
(HQ-MC1) #show wlan virtual-ap CORP-VAP                ! the VAP and every profile it references
(HQ-MC1) #show wlan ssid-profile CORP-SSID
(HQ-MC1) #show aaa profile CORP-AAA
(HQ-MC1) #show user-table                              ! clients: IP, MAC, name, role, auth type, AP, ESSID
(HQ-MC1) #show user-table verbose
(HQ-MC1) #show aaa authentication-server radius statistics
(HQ-MC1) #show auth-tracebuf mac 3c:22:fb:11:22:33     ! step-by-step EAP/RADIUS trace for one client

show auth-tracebuf is the single most useful command for authentication problems: it shows each EAP and RADIUS message for a client with timestamps, so it is immediately clear whether the client stopped responding, the RADIUS server rejected, or the server never answered.

(HQ-MC1) #show user-table

Users
-----
IP            MAC                Name   Role      Age(d:h:m)  Auth    VPN link  AP name        Roaming  Essid       Bssid              Phy        Profile
----------    ------------       ----   ----      ----------  ----    --------  -------        -------  -----       -----              ---        -------
10.20.4.17    3c:22:fb:11:22:33  alice  employee  00:00:12    802.1x            HQ-B1-F2-AP07  Wireless Corp        20:4c:03:12:34:50  5GHz-HE    CORP-AAA
10.90.0.33    a4:83:e7:44:55:66         GUEST     00:00:03    Web               HQ-B1-F2-AP07  Wireless Corp-Guest  20:4c:03:12:34:51  5GHz-HE    GUEST-AAA

Exercises

1. List, in the order they should be created, every profile needed for an 802.1X SSID on a new AP group. Why does order matter in the CLI?

2. A new Corp SSID works on HQ-MC1 but every user on HQ-MC2 fails authentication. show auth-tracebuf on HQ-MC2 shows Access-Requests sent but no response. What is wrong?

3. A Wi-Fi 6E AP broadcasts Corp on 2.4 and 5 GHz, but never on 6 GHz, even though the 6 GHz radio is up. The SSID profile uses opmode wpa2-aes. Why?

4. Guests associate to Corp-Guest but never see the login page. Browsing to an IP address directly does show the portal. What is the most likely cause?

5. Rewrite the GUEST-INTERNET ACL so guests can use an internal DNS server at 10.1.1.53 while still blocking all other RFC1918 destinations.

ip access-list session GUEST-INTERNET
    user any svc-dhcp permit
    user host 10.1.1.53 svc-dns permit
    user alias RFC1918 any deny
    user any svc-http permit
    user any svc-https permit
    user any any deny

6. An administrator changes essid in the default SSID profile “just to test”, and minutes later the help desk receives calls from a building whose APs were never meant to be touched. Explain.

Summary

An Aruba WLAN is a virtual AP profile that combines an SSID profile (name, encryption, rates), an AAA profile (authentication methods, server groups, roles), a VLAN and a forwarding mode, and it goes on the air when an AP group references it. Building bottom-up — servers, roles, AAA, SSID, VAP, AP group — keeps the configuration coherent. WPA3-Enterprise is the modern default for corporate WLANs, 6 GHz demands WPA3 or OWE, PSK SSIDs suit IoT when paired with tight roles or MPSK, and a captive portal is nothing more than a pre-authentication role that redirects web traffic until the user logs in and is moved to a guest role. show user-table and show auth-tracebuf are the essential verification tools.

Next: Part 5 goes deep on the heart of the platform: user roles, session ACLs and the Policy Enforcement Firewall, role derivation, RADIUS-assigned roles and VLANs, Change of Authorization, and ClearPass integration.