Dell 6.2 Chapte r 5

DellPowerConnect W- Series ArubaOS 6.2 | User Guide ControlPlane Security | 79
Chapte r 5
Control Plan e Security
ArubaOSsupports secure IPsec communications between a controller and campus or remote APs using public-key
self-signedcertificates created by each master controller.The controller certifies its APs by issuing them certificates.
If the master controller has any associated local Dell controllers,t he master controllersends a certificat e to each local
controller,which in turn sends certificates t o their own associated APs. I f a local controlleris unable to co ntact the
master controllerto obtain it s own certificate, it is not be ablet o certify its APs, and those APs can not
communicate with their local controller until master-localcommunicatio n has been reestablished.You create an
initial control plane security configuration when you first configure the controller using the initial setup wizard. The
ArubaOSiniti al setup wizard enables control planesecurity by default, so it is very important that the local controller
is able to communicate with its master controllerwhen it is first provisio ned.
Some AP modeltypes have factory-installed digital certificates. TheseA P modelsuse their factory-installed
certificates for IPsec, and do not need a certificate from the controller. Oncea campus or remote AP is certified,
either througha factory-installed certificate or a certificate from the controller, the AP can failover between local
Dell controllersand still stay connected to the secure network, because each AP has the same master controlleras a
common trust anchor.
Starting with ArubaOS6.2, the controller maintains two separate AP whit elists; onefor campus APs and one for
Remote APs. These whitelists contain records of allcampus APs o rremote APs co nnectedto t henetwork. You can
use a campus or AP whitelist at any time to add anew valid campus or remote AP to the secure network, or revoke
network access to any suspected rogue or unauthorized AP.
NOTE:The control pl ane securityfeature supports IPv4 campus and remote APsonl yDo not enable control plane security on a
controller thattermi natesIPv6 APs.
Whenthe co ntrollersends an AP a certificate, that AP must reboot before it can connect to it s controllerover a
securechannel. If you are enabling control plane security for the first time on a large network, you may experience
severalminutes of interrupted connectivity while each AP receives its certificate and establishes its secure
connection.
Topics in this chapter include:
l"ControlP laneSecurity Overview" on page 80
l"ConfiguringControl Plane Security" on page 80
l"ManagingWhitelists on Master and Local Controllers" on page 87
l"Workingin Environments wi th MultipleMaster Controllers" on page 90
l"Replacinga Controlleron a Multi-ControllerNetwork" on page 93
l"ConfiguringControl Plane Security after Upgrading" on page 97
l"TroubleshootingControl Plane Security" on page 97