17
6. If the staging controller does not pr ovide PoE, either ensure the presence of a PoE injector for the
LAN connection bet ween the module and the controller, or ensure the presence of a DC power
supply appropriate to the particular model of the module.
7. Connect the module via an Ethernet cable to the staging controller; note that this should be a direct
connection, with no intervening network or devices; if PoE is being supplied by an inj ector, this
represents the only exception. That is, nothing other than a PoE injector should be present between
the module and the staging controller.
8. Once the module is connected to the controller by the Ethernet cable, navigate to the
Configuration > Wireless > AP Installation page, where you should see an entry for the AP. Select
that AP, click the “Provision” button, which will open the provisioning window. Now provision
the AP as Remote AP by filling in the form appropriately. Detailed steps are listed in Section
“Provisioning an Individual AP” of Chapter “The Basic User-Centric Networks” of the Aruba OS
User Guide. Click “Apply and Reboot” to complete the provisioning process.
a. During the p rovisioning process as Remote AP if Pre-shared key is selected to be the
Remote IP Authentication Method, the IKE pre-shared key (which is at least 8 characters
in length) is input to the module during provisioning. Generation of this key is outside the
scope of this policy. In the initial provisioning of an AP, this key will be entered in
plaintext; subsequently, during provisioning, it will be entered encr ypted over the secure
IPSec session. If certificate based authentication is chosen, AP’s RSA key pair is used to
authenticate AP to co ntroller during IPSec. AP’s RSA private ke y is contained in the
AP’s non volatile memory and is generated at manufacturing time in factory.
9. Via the logging fac ility of the sta ging controller, ensure t hat the module ( the AP) is succ essfully
provisioned with firmware and configuration
10. Terminate the administrative session
11. Disconnect the module from the staging controller, and install it on the deployment network; when
power is applied, the module will attempt to discover and connect to an Aruba Mob ility Controller
on the network.
1. Apply TELs according to the directions in section 3.2
2. Log into the administrative console of the staging controller
3. Deploying the AP in CPSec AP mode, configure the staging controller with CPSec under
Configuration > Controller > Control Plane Security tab. AP will authenticate to the co ntroller
using certificate based authentication to establish IPSec. AP is configured with RSA key pair at
manufacturing. AP’s certificate is signed by Aruba Certification Authority (trusted by all Aruba
controllers) and the AP’s RSA private key is stored in non-volatile memory. Refer to “Configuring
Control Plane Security” Section in ArubaOS User Manual for details on the steps.
4. Enable FIPS mode on the controller. This is accomplished by going to the Configuration > Network
> Controller > System Settings page (this is the default page when you click the Configuration tab), and
clicking the FIPS Mode for Mobility Controller Enable checkbox.
5. Enable FIPS mode on the AP. This accomplished by going to the
Configuration > Wireless > AP Configuration > AP Group page. There, you click the Edit button for the
appropriate AP group, and then select AP > AP System Profile. Then, check the “Fips Enable” box, check
“Apply”, and save the configuration.
6. If the staging controller does not pr ovide PoE, either ensure the presence of a PoE injector for th e
LAN connection bet ween the module and the controller, or ensure the presence of a DC power
supply appropriate to the particular model of the module