ArubaOS Release Notes

Transcription

1 Release Notes

2 Copyright Information Copyright 2017 Hewlett Packard Enterprise Development LP. Open Source Code This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise Company. To obtain such source code, send a check or money order in the amount of US $10.00 to: Hewlett Packard Enterprise Company Attn: General Counsel 3000 Hanover Street Palo Alto, CA USA Revision 02 December 2017 Release Notes

3 Contents Contents 3 Revision History 5 Release Overview 6 Chapter Overview 6 Supported Browsers 6 Contacting Support 7 New Features 8 CLI 8 NTP 10 CLI 10 NTP 12 Regulatory Updates 13 Resolved Issues 14 Known Issues 35 Upgrade Procedure 38 Upgrade Caveats 38 GRE Tunnel-Type Requirements 39 Important Points to Remember and Best Practices 39 Memory Requirements 40 Backing up Critical Data 41 Release Notes Contents 3

4 Upgrading in a Multicontroller Network 42 Installing the FIPS Version of 42 Upgrading to 43 Downgrading 47 Before You Call Technical Support 49 Glossary of Terms 50 4 Contents Release Notes

5 Revision History The following table provides the revision history of this document. Table 1: Revision History Revision Change Description Revision 02 Added bug Revision 01 Initial release. Release Notes Contents 5

6 Chapter 1 Release Overview is a software release that includes new features and enhancements introduced in this release. See the Upgrade Procedure on page 38 for instructions on how to upgrade your controller to this release. Chapter Overview New Features provides a description of features and enhancements introduced in this release. Regulatory Updates describes the regulatory updates in this release. Resolved Issues describes the issues resolved in this release. Known Issues describes the known and outstanding issues identified in this release. Upgrade Procedure describes the procedures for upgrading a controller to this release. Glossary of Terms lists the acronyms and abbreviations used in the document. For information regarding prior releases, refer to the corresponding Release Notes on support.arubanetworks.com. Supported Browsers The following browsers are officially supported for use with WebUI: Microsoft Internet Explorer 10.x and 11 on Windows 7 and Windows 8 Mozilla Firefox 23 or later on Windows Vista, Windows 7, and Mac OS Apple Safari or later on Mac OS Chrome m (64-bit) Microsoft Edge and Microsoft Edge HTML Release Notes Release Overview 6

7 Contacting Support Table 2: Contact Information Main Site Support Site Airheads Social Forums and Knowledge Base North American Telephone International Telephone Software Licensing Site End-of-life Information Security Incident Response Team arubanetworks.com support.arubanetworks.com community.arubanetworks.com (Toll Free) arubanetworks.com/support-services/contact-support/ hpe.com/networking/support arubanetworks.com/support-services/end-of-life/ Site: arubanetworks.com/support-services/security-bulletins/ 7 Release Overview Release Notes

8 Chapter 2 New Features This chapter describes the new features, enhancements, and hardware introduced in. For more information about these features, refer to the x User Guide. CLI No Support for Image Preload The following commands are not supported in this release: ap image-preload activate all-aps ap image-preload activate specific-aps ap image-preload add ap-group ap image-preload add ap-name ap image-preload cancel ap image-preload clear-all ap image-preload delete ap-group ap image-preload delete ap-name OSPF Enhancements to show ip ospf neighbor Command Starting from, the output of the show ip ospf neighbor command is enhanced to display the total number of OSPF neighbors and router LSAs. The following output displays the total number of OSPF neighbors and router LSAs when the command is executed. Release Notes New Features 8

9 OSPF Neighbor Table Neighbor ID Pri State Address Interface WAY Vlan 10 (Aruba7220) (config-subif)#show ip ospf OSPF is currently running with Router ID Number of areas in this router is 1 Area Number of interfaces in this area is 2 Area is normal area SPF algorithm executed 2 times Number of neighbors in this router is 2 Number of Active LSAs in this router is 4 Number of Retransmit LSAs in this router is 1 Enhancements to show ip route command Starting from, the output of the show ip route command is modified to display the cost and administrative distance in [AD/Cost] format. In the previous releases, the information was in [Cost/AD] format. Following is the modified output of the show ip route command. The [1/0] field represents the [AD/Cost] respectively. Codes: C - connected, O - OSPF, R - RIP, S - static M - mgmt, U - route usable, * - candidate default, V - RAPNG VPN/Branch Gateway of last resort is Imported from DHCP to network at cost 10 Gateway of last resort is Imported from CELL to network at cost 10 Gateway of last resort is Imported from PPPOE to network at cost 10 Gateway of last resort is to network at cost 1 S* /0 [1/0] via * S /8 [1/0] via * Enhancements to show ip ospf interface command Starting from, the Tx Err and Rx Err parameters introduced in the show ip ospf interface vlan command, display information related to the Rx and the Tx errors. They also help in analyzing defects based on the tech-support logs. 9 New Features Release Notes

10 The following example displays the output of the show ip ospf interface vlan 1 command: Vlan 1 is up, line protocol is up Internet Address , Mask , Area Router ID , Network Type BROADCAST, Cost: 1 Transmit Delay is 1 sec, State DROTHER, Priority 0 Designated Router id , Interface Address Backup designated Router id , Interface Address Timer intervals configured, Hello 10, Dead 40, Retransmit 5 Neighbor Count is 0 Tx Stat: Hellos 7 DbDescr 0 LsReq 0 LsUpdate 0 LsAck 0 Pkts 7 Tx Err: BufNull 0 BufCorrupt 0 NoMem 0 SendFail 0 Rx Stat: Hellos 0 DbDescr 0 LsReq 0 LsUpdate 0 LsAck 0 Pkts 0 LoopSend 0 RxVirtualLink 0 Rx Err: DisCd 0 BadVer 0 BadNet 0 BadArea 0 BadDstAdr 0 BadAuType 0 BadAuth 0 BadNeigh 0 BadPckType 0 BadVirtLink 0 IntfDown 0 MySource 0 Legal 0 NTP SHA1 Authentication Starting from, the controller allows you to enable SHA1 authentication on an NTP server. To enable SHA1 authentication on NTP, the sha1 parameter is introduced in the ntp authentication-key command. The following command enables SHA1 on NTP. The key identifier is and the shared secret is (host) (config) #ntp authentication-key sha The following command shows values for the NTP authentication keys, Key ID and SHA1 secret key. Key Id Key Type Secret sha This chapter describes the new features, enhancements, and hardware introduced in. For more information about these features, refer to the x User Guide. CLI No Support for Image Preload The following commands are not supported in this release: ap image-preload activate all-aps ap image-preload activate specific-aps ap image-preload add ap-group Release Notes New Features 10

11 ap image-preload add ap-name ap image-preload cancel ap image-preload clear-all ap image-preload delete ap-group ap image-preload delete ap-name OSPF Enhancements to show ip ospf neighbor Command Starting from, the output of the show ip ospf neighbor command is enhanced to display the total number of OSPF neighbors and router LSAs. The following output displays the total number of OSPF neighbors and router LSAs when the command is executed. OSPF Neighbor Table Neighbor ID Pri State Address Interface WAY Vlan 10 (Aruba7220) (config-subif)#show ip ospf OSPF is currently running with Router ID Number of areas in this router is 1 Area Number of interfaces in this area is 2 Area is normal area SPF algorithm executed 2 times Number of neighbors in this router is 2 Number of Active LSAs in this router is 4 Number of Retransmit LSAs in this router is 1 Enhancements to show ip route command Starting from, the output of the show ip route command is modified to display the cost and administrative distance in [AD/Cost] format. In the previous releases, the information was in [Cost/AD] format. Following is the modified output of the show ip route command. The [1/0] field represents the [AD/Cost] respectively. 11 New Features Release Notes

12 Codes: C - connected, O - OSPF, R - RIP, S - static M - mgmt, U - route usable, * - candidate default, V - RAPNG VPN/Branch Gateway of last resort is Imported from DHCP to network at cost 10 Gateway of last resort is Imported from CELL to network at cost 10 Gateway of last resort is Imported from PPPOE to network at cost 10 Gateway of last resort is to network at cost 1 S* /0 [1/0] via * S /8 [1/0] via * Enhancements to show ip ospf interface command Starting from, the Tx Err and Rx Err parameters introduced in the show ip ospf interface vlan command, display information related to the Rx and the Tx errors. They also help in analyzing defects based on the tech-support logs. The following example displays the output of the show ip ospf interface vlan 1 command: Vlan 1 is up, line protocol is up Internet Address , Mask , Area Router ID , Network Type BROADCAST, Cost: 1 Transmit Delay is 1 sec, State DROTHER, Priority 0 Designated Router id , Interface Address Backup designated Router id , Interface Address Timer intervals configured, Hello 10, Dead 40, Retransmit 5 Neighbor Count is 0 Tx Stat: Hellos 7 DbDescr 0 LsReq 0 LsUpdate 0 LsAck 0 Pkts 7 Tx Err: BufNull 0 BufCorrupt 0 NoMem 0 SendFail 0 Rx Stat: Hellos 0 DbDescr 0 LsReq 0 LsUpdate 0 LsAck 0 Pkts 0 LoopSend 0 RxVirtualLink 0 Rx Err: DisCd 0 BadVer 0 BadNet 0 BadArea 0 BadDstAdr 0 BadAuType 0 BadAuth 0 BadNeigh 0 BadPckType 0 BadVirtLink 0 IntfDown 0 MySource 0 Legal 0 NTP SHA1 Authentication Starting from, the controller allows you to enable SHA1 authentication on an NTP server. To enable SHA1 authentication on NTP, the sha1 parameter is introduced in the ntp authentication-key command. The following command enables SHA1 on NTP. The key identifier is and the shared secret is (host) (config) #ntp authentication-key sha The following command shows values for the NTP authentication keys, Key ID and SHA1 secret key. Key Id Key Type Secret sha Release Notes New Features 12

13 Chapter 3 Regulatory Updates This chapter describes the regulatory updates in. Contact your local Aruba sales representative about device availability and support for your country. Periodic regulatory changes may require modifications to the list of channels supported by an AP. For a complete list of channels supported by an AP using a specific country domain, access the controller CLI and execute the show ap allowed-channels country-code <country-code> ap-type <ap-model> command. The following default DRT version is part of : DRT-1.0_62783 For a complete list of countries and the regulatory domains in which the APs are certified for operation, refer to the Downloadable Regulatory Table or the DRT Release Notes at support.arubanetworks.com. The FCC has changed the rules for operation in all of the 5 GHz bands. For more information, refer to the FCC DFS Regulatory Change Impact and Resolution Plan - Support Advisory available in Support Advisories. Release Notes Regulatory Updates 13

14 Chapter 4 Resolved Issues This chapter describes the issues resolved in. Release Notes Resolved Issues 14

15 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: The controller rebooted unexpectedly. The log file for the event listed the reason as Kernel Panic (Intent:cause:register 12:86:e0:2). The fix ensures that the controller works as expected. Scenario: This issue was observed in controllers running. Controller- Platform Symptom: An error in AP wireless containment was observed. The issue is fixed by simplifying the path of containment frames. Scenario: This issue was observed when the AP that was functional in the AM mode was unable to send containment related frames. This issue was observed in AP-205 access points running. Air Management - IDS AP-205 access points Symptom: SNMP enterprise specific traps did not contain the enterprise trap OID. The fix ensures that the traps contain the enterprise trap OID. Scenario: This issue was observed in controllers running. SNMP 15 Resolved Issues Release Notes

16 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom:An AP crashed unexpectedly. The log file listed the reason for the event as mac_to_str_r,remove_dos_sta,timer_ handler,timerexpiredontimer,dispprocessprio,main. The fix ensures that the AP works as expected. Scenario: This issue was observed in AP-135 access points running. Station Management AP-135 access points Symptom:SNMP traps did not contain the source IP address and the community string. The issue is resolved by adding the source IP address to the SNMP traps. Scenario: This issue was observed in controllers running. SNMP Symptom: APs crashed and rebooted due to kernel panic. The log file for the event lists the reason as Fatal exception at NIP d98945d4 LR d988a998 CTR: c000c724. The fix ensures that APs do not crash. Scenario: This issue was observed in AP-225 access points running. AP-Wireless AP-225 access points Symptom: A standby controller failed to synchronize with the WMS database. The fix ensures that the standby controller synchronizes with the database. Scenario: This issue occurred because of the large size of the WMS database. This issue was observed in controllers running. Database Symptom: An OFA module crashed on a controller although OpenFlow was not enabled. The fix ensures that the crash does not occur. Scenario: This issue was observed in controllers running. SDN Symptom: An SNMP module constantly crashed. The fix ensures that SNMP does not crash. Scenario: This issue occurred due to incorrect incoming SNMP queries. This issue was observed in AP-225 access points running SNMP Symptom: A controller crashed multiple times due to a ble-relay module. The fix ensures that the controller works as expected. Scenario: This issue was observed in controllers running. BLE Platforms Release Notes Resolved Issues 16

17 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: APs frequently changed channels due to a false Radar detection. Adding improvements to the wireless drivers resolved this issue. Scenario: This issue was observed in 200 Series, 210 Series, 220 Series, and 270 Series access points running. AP-Wireless 200 Series, 210 Series, 220 Series, 270 Series access points Symptom: An SNMP query on a controller fetched incorrect values for the associated users count on an AP. The fix ensures that the SNMP query fetches the correct value. Scenario: This issue was observed in access points running. AP-Platform Symptom: A controller crashed and rebooted due to a datapath timeout. The log file listed the reason for the event as Reboot Cause: Datapath timeout (Intent:cause:register 56:86:50:2). The fix ensures that the controller works as expected. Scenario: This issue occurred because an AP with two physical ports plugged into Juniper switches caused a continuous loop. The issue was observed in controllers running. Controller- Datapath Symptom: A controller rebooted due to a datapath crash. The issue is resolved by introducing required changes to the DTR stall count limit and the stall count maintenance in the DTR channel. Scenario: This issue occurred when there was DTR stall in one of the DTR channels. This issue was observed in 7240 controllers running Controller- Datapath 7240 controllers Symptom: An access point crashed unexpectedly due to a kernel panic. The fix ensures that the AP does not crash. Scenario: This issue was observed in AP-135 running. AP-Wireless AP-135 access points Symptom: The output of the show netdestination output command displayed only 6 netdestination entries although there were more than 100 netdestination entries configured on the master controller. The fix ensures that the CLI output displays the netdestination entries as expected. Scenario: This issue occurred when there were white spaces in the netdestination names configured. This issue was observed in controllers running Base OS Security Resolved Issues Release Notes

18 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: A controller unexpectedly rebooted. The log file listed the reason for the event as Nanny rebooted machine - low on free memory (Intent:cause:register 34:86:0. The fix ensures that the controller works as expected. Scenario: This issue was observed in controllers running Controller- Platform Symptom: A client could not pass traffic after a VRRP failover occurred. The fix ensures that clients can pass traffic. Scenario: This issue occurred when the LACP striping IP was configured as the VRRP IP. This issue was observed in 220 Series, 270 Series, and 320 Series access points running versions or later in a master-redundancy topology. AP-Datapath Symptom: An Alcatel 8128 phone with an Ascom chipset failed to pass traffic intermittently. Improvements to the wireless driver resolved the issue. Scenario: This issue was observed in controllers running. AP-Wireless Symptom: OSPF neighbor devices received Type-4 LSAs with bad checksum from the controller. This issue is resolved by making changes to the sequence number and other fields and updating the LSA checksum to the link state database. Scenario: This issue was observed when there was an autonomous system boundary router in the OSPF network. This issue occurred when OSPF Type-4 LSAs were generated by an area border router in an OSPF topology with autonomous system boundary router. OSPF Symptom: The tx-power resolution values were inconsistent in the RADIO_ STATS AMON message. The fix ensures that the tx-power resolution values are consistent. Scenario: This issue was observed in controllers running ARM Symptom: An AP became unresponsive and rebooted with the reason SAPD: Unable to contact switch: HELLO-TIMEOUT. The fix ensures that the AP works as expected. Scenario: This issue occurred because the Rx traffic was halted due to an error condition. This issue was observed in access points running AP-Wireless Release Notes Resolved Issues 18

19 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: A remote AP did not work with 4G-LTE USB MODEM. This issue is resolved by supporting the configuration of a second APN during USB initialization. Scenario: This issue occurred when a second APN was configured but not used in a remote AP. This issue was observed in remote APs running or later versions. Remote AP Symptom: The Tx data transmitted retries were not up to date in the radio debug statistics. The fix ensures that the information is up to date. Scenario: This issue was observed in 200 Series access points running. AP-Platform 200 Series access points Symptom: VLAN interface was displayed as DOWN even although the interface operstate is UP. The fix ensures that the VLAN interface is displayed as UP. Scenario: This issue was observed in controllers running or later versions. Mesh Symptom: Clients were facing throughput issues when connecting to a radio profile Improvements to the wireless driver resolves this issue. Scenario: This was observed in controllers running AP-Wireless Symptom: The output of the show ap debug system-status command displayed incorrect speed and duplex information. However, the show ap debug port status command displayed the correct configuration. Scenario: This issue was observed in controllers running or later versions. AP-Platform Symptom: An AP failed to work with any RTLS server. The fix ensures that the AP works with the RTLS server. Scenario: This issue was observed in AP-207 access points running. AP-Wireless AP-207 access points 19 Resolved Issues Release Notes

20 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: A wireless client appeared to be active on to two different APs at the same time because one of the APs fails to age out the client entry from its user table. The fix ensures that the client appears active on the correct AP. Scenario: This issue occurred when the wireless client roamed from one AP to another AP that terminates on a different controller. This issue was observed in 200 Series access points running. AP-Wireless 200 Series access points Symptom: An Instant AP wired connection with a 4G uplink was not stable. The fix ensures that the wired Instant AP connection is stable. Scenario: The issue occurred because of a packet corruption as the switch chip drivers did not handle cloned SKBs efficiently. This issue was observed in AP- 203R, AP-203RP, and AP-205 access points running. AP-Platform AP-203R, AP-203RP, and AP- 205 access points Symptom: Database synchronization failed to work when TLS 1.2 was enabled. The fix ensures that database synchronization works when TLS 1.2 is enabled. Scenario: This issue occurred because the periodic synchronization did not include the customized captive portal data. This issue was observed in controller running. Database Symptom: Multiple clients were not authenticated. The log file listed the reason for the event as RADIUS-VSA: Error while parsing Vendor-Specific attribute with multiple sub-attributes in Access-Accept packet. The fix ensures that the clients are authenticated. Scenario: This issue occurred in the authentication process during client authentication. This issue was observed in controllers running RADIUS Symptom: A controller showed the ASAP_FIREWALL_ADD_MCAST " " kernel system logs. The fix ensures that the controller does not show the debug logs. Scenario: This issue was observed in controllers running AP-Datapath Symptom: The console logs of an AP displayed an unnecessary warning message, nul_get_max_amsdu_size(2126): WARN: AMSDU size is not explicitly configured. The fix ensures that the warning message is not displayed. Scenario: This issue was observed in access points running. AP-Wireless Release Notes Resolved Issues 20

21 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: False Radar events were detected on APs. Adding improvements to the wireless drivers resolved this issue. Scenario: This issue was observed in AP-225 access points running. AP-Wireless AP-225 access points Symptom: An inconsistency was observed in assigning the correct role to a wired user after 802.1X authentication. Scenario: This issue occurred because ACLs for L2 authenticated wired users was not getting updated. This issue was observed in controllers running Base OS Security Symptom: When the IPM was enabled, the system LED displayed an amber light although no power restrictions were applied. Improvements to the wireless driver resolved the issue. Scenario: This issue occurred because the IPM disabled kernel polling thread that periodically checks the system power supply status. This issue was observed in access points running. AP-Platform Symptom: The CLI output of the show ap debug dot11r efficiency command displayed 0% as the value in the Hit (%) and Miss (%) columns an output. The fix ensures that the CLI output displays the correct values. Scenario: This issue was observed in controllers running. Station Management Symptom: An AP rebooted unexpectedly. The log file for the event listed the reason as Reboot caused by kernel panic: L2 single-bit error detected. The fix ensures that the AP works as expected. Scenario: This issue occurred due to a corruption in the memory of the AP. This issue was observed in 310 Series and 320 Series access points running. AP-Wireless 310 Series and 320 Series access points Symptom: The IAP-VPN branch status was displayed as DOWN on the controller although the VPN status was UP on an access point. The fix ensures that the accurate IAP-VPN status is displayed. Scenario: This issue was observed in access points running Remote AP Resolved Issues Release Notes

22 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: Clients were unable to connect to APs. The issue is resolved using the cached MAC address instead of using the striping-ip address. AP-Datapath Scenario: This issue was observed under the following conditions: Observed in hardware offload APs. HA active and standby were in the same subnet. The striping-ip address configured was the same between controllers. The AP was in the same subnet of controllers. This issue was observed in controllers running Symptom: The following errors were observed in the controller logs. Unexpected stm (Station management) runtime error at wifi_refresh_ assoc_drv. An internal system error has occurred at file messenger.c function msgr_vap_stats_v2 line 5267 error msgr_vap_stats_v2. The fix ensures that these incorrect error messages are not displayed in the logs. Scenario: This issue occurred when a backup Virtual AP was configured for the AP. This issue was observed in APs running. AP-Wireless AP Symptom: For wired users, an ARP entry was not displayed on a controller. The fix ensures that the ARP entry is displayed. Scenario: This issue occurred because the inter-tunnel flooding parameter was disabled on the controller. This issue was observed in controllers running. Controller- Datapath Symptom: APs took a longer time to process the configurations after a failover. This delayed the reconnection of the client to the AP. The fix ensures that the APs process the configurations faster after a failover. Scenario: This issue was observed in AP-305 access points running AP-Platform AP-305 access points Symptom: APs were not coming up after a controller was upgraded. The fix ensures that APs are connected after a controller upgrade. Scenario: This issue was observed in controllers running. AP-Platform Release Notes Resolved Issues 22

23 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: Users were unable to connect to a Wi-Fi network because a controller became unresponsive. The fix ensures that users are able to connect to the Wi-Fi network. Scenario: This issue occurred when the MDNS CPU load was full. This issue was seen when a specific type of google cast query was sent to the controller. This issue was observed in 7240XMcontrollers running or later versions. AirGroup 7240XM controllers Symptom: A controller failed to establish SSL connection with PAN integration. The log file listed the reason for the event as SSL Alert (Level: Fatal, Description: Bad Record MAC). The fix ensures that controller establishes an SSL connection with PAN integration. Scenario: This issue occurred when the controllers was running in FIPS mode. This issue was observed in controllers running Base OS Security Symptom: Clients failed to obtain an IP address and pass traffic in a 2.4 GHz radio profile. The fix ensures that the clients obtain IP address appropriately. Scenario: This issue occurred when the high-throughput parameter in the rf dot11g-radio-profile command was disabled for the 2.4 GHz radio. This issue was observed in controllers running. AP-Wireless Platforms Symptom: Clients were constantly disconnected from a dual radio AP. The fix ensures that the clients remain connected to the dual radio AP. Scenario: The issue occurred because a flag was set to recreate a virtual access when a radio AP changed from AP-mode to spectrum-mode. The flag was erased when the same radio changed back to AP-mode. This issue was observed in controllers running. Station Management Platforms Symptom: The radio debug statistics displayed an incorrect value for Tx and Rx data bytes. The issue is resolved by validating the frame type before incrementing the data bytes. Scenario: This issue was observed in AP-305 access points running. AP-Wireless AP-305 access points 23 Resolved Issues Release Notes

24 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: The output of the show ap debug radio-stats command displayed incorrect values for Tx and Rx data bytes. The fix ensures that the correct value is displayed in the command output. Scenario: This issue occurred when an ac or n client was connected to an AP-207 access point running. AP-Wireless AP-207 access points Symptom: The Remote Intf column In the CLI output of the show ap lldp neighbors and show AP lldp neighbor commands displayed the port description TLV. The issue is resolved at both AP side and controller side in the following ways: AP fix: Provide both port ID and port descriptions in separate columns. Controller fix: Display only port number even when the port description is configured. Scenario: This issue was observed in controllers running LLDP Symptom: An AP crashed unexpectedly. The log file listed the reason for the event as Kernel panic - at aruba_mesh_am_hook_entrance(). The fix ensures that the AP works as expected. Scenario: This issue was observed in access points running AP-Wireless Symptom: A controller crashed and rebooted unexpectedly. The log file listed the reason for the event as Datapath timeout (SOS Assert) (Intent:cause:register 54:86:0:2c). The fix ensures that the controller works as expected. Scenario: This issue was observed in 7205 controllers running. Controller- Datapath 7205 controllers Symptom: Clients were unable to pass traffic although they received the IP address from the correct VLAN. The fix ensures that the client are able to pass traffic. Scenario: This issue occurred due to an ACL/ACE mismatch. This issue was observed in controllers running. Base OS Security Release Notes Resolved Issues 24

25 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: A master controller rebooted after DPI was disabled. The log file listed the reason for the event as Reboot Cause: Datapath timeout (SOS Assert) (Intent:cause:register 54:86:50:2). The fix ensures that the controller works as expected. Scenario: This issue was observed in controllers running Controller- Datapath Symptom: Controllers rebooted due to a datapath timeout, without creating a core file. The fix ensures that the controllers work as expected. Scenario: This issue was observed in controllers running Controller- Platform 25 Resolved Issues Release Notes

26 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: APs rebooted unexpectedly at various locations due to a random memory corruption. The fix ensures that the APs do not crash. Scenario: This issue was observed in controllers running AP-Wireless Symptom: An AP crashed and rebooted unexpectedly due to a firmware assert. The log file listed the reason for the event as Unable to handle kernel NULL pointer dereference at virtual address. The fix ensures that the AP works as expected. Scenario: This issue occurred as the debug logging and the core dump generation were halted. This issue was observed in AP-325 access points running. AP-Wireless AP Symptom: Users were unable to view Chromecast or Apple TV on their devices when the shared attributes were of the same case. The issue is resolved by removing the case sensitivity from the AirGroup shared user-list. Scenario: This issue was observed in controllers running AirGroup Release Notes Resolved Issues 26

27 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: A controller crashed and rebooted due to a datapath timeout. The fix ensures that the controller works as expected. Scenario: This issue occurred because the ESP packets consumed excess memory space. The issue was observed in 7205 controllers running Controller- Datapath 7205 controllers Symptom: A scanner declined the action frames sent by APs. This resulted in poor wireless performance. Improvements to the wireless driver resolved the issue. Scenario: This issue was observed in AP-228 access points running AP-Wireless AP-228 access points Symptom: Users were unable to connect to VIA. The fix ensures that clients connect to VIA. Scenario: This issue occurred because the controller set an incorrect NAS port type for VIA clients. This issue was observed in controllers running. RADIUS Symptom: SSH connection to a controller failed when the length of the username and password combination exceeded 28 characters. The issue is resolved by increasing the buffer size of the SSH command. Scenario: This issue occurred because the buffer allocated for the SSH command could not hold longer username and passwords. This issue was observed in controllers running Authentication Symptom: Multiple APs crashed and rebooted in a cluster setup. The log file for the event listed the reason as kernel panic: Fatal exception in interrupt. The fix ensures that the APs work as expected. Scenario: This issue was observed in AP-335 running. AP-Wireless AP-335 access points Symptom: The AeroScout Location Engine was unable to receive Wi-Fi tags from the server. The fix ensures that the AeroScout Location Engine is able to receive Wi-Fi tags from the server. Scenario: This issue occurred because the UDP port 1144 was blocked by the AP firewall. This issue was observed in controllers running or later versions. AP-Platform 27 Resolved Issues Release Notes

28 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: The ARM feature did not work after the AP was upgraded. The fix ensures that the ARM feature works as expected. Scenario: This issue occurred due to a difference between the operating bandwidth and the configured bandwidth when the AP was scanning a 40 MHz radio channel. This issue was observed in APs running ARM Symptom: Clients were unable to connect to an SSID. The fix ensures that the clients get authenticated appropriately. Scenario: This issue occurred when the APs failed to respond to authentication requests. This issue was observed in AP-303H, 300 Series, 310 Series, 320 Series,330 Series and 360 Series access points running or later versions. AP-Wireless AP- 303H,300 Series, 310 Series, 320 Series, 330 Series, and 360 Series access points Symptom: A web-cc URL cloud search was unsuccessful on a controller. The log file listed the reason for the event as <ERRS> web_cc web_cc_callback: URL lookup failed. The fix ensures that cloud response is received. Scenario: This issue was observed in APs running. WebCC Symptom: The noise floor value in a DFS channel was higher than usual. The issue is resolved by controlling the DFS channel utilization. Scenario: This issue occurred because a high channel utilization was observed in DFS. This issue was observed in controllers running. AP-Wireless Symptom: An AP failed to respond and unexpectedly rebooted. The log file for the event listed the reason as kernel panic: Fatal exception in interrupt. Improvements to the wireless driver of the AP resolved the issue. Scenario: This issue occurred due to a corruption in the memory of the AP. This issue was observed in AP-303H, 300 Series, 310 Series, 320 Series, 330 Series, and 360 Series access points running. Mesh AP-303H, 300 Series, 310 Series, 320 Series,330 Series, and 360 Series access points Release Notes Resolved Issues 28

29 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: An AP failed to respond and unexpectedly rebooted. The log file listed the reason for the event as Unhandled fault: external abort on non-linefetch (0x1008) at 0xe The fix ensures that the AP runs as expected. Scenario: This issue was observed in 300 Series access points running. AP-Platform 300 Series access points Symptom: An AP crashed unexpectedly. The log file listed the reason for the event as panic-dump.apkys-invrec-pnt _ The fix ensures that the AP works as expected. Scenario: This issue was observed in AP-275 access points running Mesh AP-275 access points Symptom: The AppRF feature stopped working after a controller was upgraded. The fix ensures that AppRF works. Scenario: This issue occurred as the DPI classification did not take effect after the controller was upgraded. This issue was observed in 7240 controllers running Controller- Datapath 7240 controllers Symptom: An error, An internal system error has occurred at file aeroscout.c function rtls_send_message line 190 error sendto failed - e-101 l-74 ip port-27425, was displayed in the log files although the RTLS server was reachable from the APs. The fix ensures that the error is not displayed. Scenario: This issue was observed in APs running Air Management - IDS Symptom: iphones were unable to obtain the IP address after roaming to a new AP The fix ensures that the iphones are able to obtain the IP addresses. Scenario: This issue was observed in controllers running. Base OS Security Symptom: Clients were unable to connect to the access points. The log files for the event listed the reason as AP is resource constrained The fix ensures that the APs send an ageout interval to the STM when the authentication is unsuccessful. Scenario: This issue occurred as the STM was not notified after an unsuccessful authentication, which resulted in stale STA entries. This issue was observed in controllers running. AP-Wireless 29 Resolved Issues Release Notes

30 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: An AP failed to supply power through the PSE port because the port got disabled after a reboot. This fix ensures that a reboot on the AP does not disable the PSE port. Scenario: This issue occurred under one of the following conditions: When the access point was rebooted using the apboot command on the controller. When the AP rebooted on its own. This issue was observed in AP-303H access points running. AP-Platform AP-303H access points Symptom: APs connected to Android devices failed to send Group Temporal Key frames on time. The fix ensures that Tx frame encryption is removed after the Group Temporal Key frames are processed. Scenario: The issue occurred because Android devices ignored the Group Temporal Key frames that were processed without an encryption. This issue was observed in controllers running AP-Wireless Symptom: Clients were unable to view the custom Captive Portal page in the standby master controller. The fix ensures that the clients can view the Captive Portal page. Scenario: This issue was observed in controllers running or later versions in a master standby topology. Database Symptom: The STM module crashed multiple times on a controller. The fix ensures that the number of virtual APs are set after validating if the AP is in mesh recovery mode. Scenario: This issue occurred when a Mesh AP went into mesh recovery mode and the number of Virtual APs were incorrectly set to max SSIDs. This issue was observed in controllers running. Controller- Platform Symptom: The radius accounting interim update contained the Filter-Id attribute for a IPv6 client resulting in loss of packets. The fix ensures that the radius account interim update does not contain the Filter-ID attribute. Scenario:This issue was observed in controllers running. RADIUS Release Notes Resolved Issues 30

31 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: The Cellular Handoff Assist feature was disabled in a WLAN virtual AP profile after a controller was reloaded. The fix ensures that the feature is not disabled. Scenario: This issue occurred because the configuration upgrade script erroneously removed the instances of the cellular-handoff-assist parameter from the configuration after a controller reload. This issue was observed in controllers running. Configuration Symptom: Some Instant AP clients incorrectly derived the logon role on the controller and failed to pass traffic. The fix ensures that the IAP users derive the correct role. Scenario: This issue occurred when a heavy load was encountered in an Instant AP tunnel. This issue was observed in controllers running. Controller- Datapath Symptom: An AP crashed and rebooted unexpectedly. The fix ensures that the AP works as expected. Scenario: This issue occurred due to a race condition in the WLAN firmware. This issue was observed in AP-324 access points running AP-Wireless AP-324 access points Symptom: A Tx power setting was lost when the controller was reloaded. The fix ensures that the Tx power setting is not lost. Scenario: This issue occurred when the Tx power setting was rejected and the default Tx power value took effect. This issue was observed in controllers running. AP-Platform Symptom: The STM module stopped responding on the controller after executing the clear gap-db stale command. The fix ensures that the STM module works as expected upon executing the command. Scenario: This issue occurred in a cluster topology with load balancing was enabled. This issue was observed in controllers running. AP-Platform Symptom: Clients were unable to connect to an SSID when r was enabled on the controller. The fix ensures that the clients successfully connect to the SSID without service interruption. Scenario: This issue occurred when the clients attempted a full 802.1x authentication after an r roam. This issue was observed in controllers running Base OS Security Resolved Issues Release Notes

32 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: Clients randomly aged out of the controller. The log file listed the reason for the event as Error: error_no_free_slots. The issue is resolved by updating AMON with the correct IP address Scenario: This issue was observed in controllers running. Base OS Security Symptom: Certificate based Remote APs failed to come up due to an authentication failure. The fix ensures that the server list is accessed from the beginning once all the servers have been tried without a successful authentication. Scenario: This issue occurred because the Remote AP stored the name of the previous server that was accessed. As a result, it used the same server although it was not authenticated successfully. This issue was observed in controllers running. Certificate Manager Symptom: An AP rebooted unexpectedly. The log file listed the reason for the event as Fatal exception in ol_rx_flush_handler+0x40/0x118 [umac] / ol_rx_indication_handler. The fix ensures that the AP works as expected. Scenario: This issue was observed in AP-305 access points running. AP-Wireless AP-305 access points Symptom: A controller running MDNS crashed. The fix ensures that the controller does not crash. Scenario:.This issue occurred because SSDP packets were being sent from different IP addresses. The issue was observed in controllers running. AirGroup Symptom: The WebUI page went blank when the show reference option mapped to the server group was selected under Security > Authentication > Servers > RADIUS Server > CPPM. The fix ensures that the WebUI page does not go blank. The WebUI displayed a blank page when the Show Reference button was clicked from the Security > Authentication Servers > RADIUS Server > cppm server group page. The fix ensures that the WebUI displays the correct page. Scenario: This issue was observed in controllers running WebUI Release Notes Resolved Issues 32

33 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: An AP constantly crashed and rebooted on a controller network. The log file listed the reason for the event as Critical process /aruba/bin/sapd [pid 30240] DIED. The fix ensures that the AP works as expected. Scenario: This issue occurred when an adhoc network advertising a valid SSID was detected by the AP under the following configuration conditions: The WMS on master was disabled. The detect-valid-ssid-misuse and protect-ssid parameters were enabled in the ids unauthorized-device-profile. This issue was observed in AP-325 access points running. Air Management - IDS AP-325 access points Symptom: A site-to-site VPN failed to come up after a controller was upgraded. The issue is resolved by deleting the datapath route-cache entry for a 32 bit destination network on tunnel mode. Scenario: This issue occurred when the route-cache remained on a datapath. As a result, the subsequent IKE/IPSec SA was not triggered by the datapath entry. This issue was observed in controllers running IPsec Symptom: APs crashed unexpectedly. The log file listed the reason for the event as ofald invoked oom-killer: gfp_mask=0x200d2, order=0, oom_adj=0. The fix ensures that the APs work as expected. Scenario: This issue was observed in controllers running SDN Symptom: Users were unable to to load the Configuration > Authentication > Advanced page completely in the WebUI. This issue is resolved by removing the Survivability feature from the FIPS build. Scenario: This issue occurred because the Survivability feature was not supported on FIPS builds. This issue was observed in controllers running WebUI Symptom: An AP crashed unexpectedly. The fix ensures that the AP works as expected. Scenario: This issue occurred because the AP was treated as an IKE/IPSec responder. This issue was observed in AP-335 access points running. AP-Platform AP-335 access points 33 Resolved Issues Release Notes

34 Table 3: Resolved Issues in Bug ID Description Component Platform Reported Version Resolved in Version Symptom: Clients were unable to connect to the second ethernet port which was on bridge mode. The fix ensures that clients are able to connect to the second ethernet port. Scenario: The issue occurred because both wired and wireless clients had the same VLAN. This issue was observed in controllers running. AP-Datapath Symptom: The output of the show ap debug radio-stats command failed to display the accurate counter value. The fix ensures that the command displays the accurate value. Scenario: This issue was observed when ac and n clients were connected to APs. This issue was observed in AP-207 devices running AP-Wireless AP-207 access points Symptom: The crash directory was missing from controllers.this issue is resolved by ensuring that all the crashes are moved to a fixed location so that no crash is missed. Scenario: This issue is observed in controllers running. Controller- Platform Symptom: An STM module crashed on a controller. The fix ensures that the STM does not crash. Scenario: The issue occurred when the controller returned a snooped DNS response. Also, the server IP address was obtained based on the DNS pattern configured and the DNS pattern present in the response. UCC Symptom: Clients mapped to a particular AC were unable to connect to an access point. The fix ensures that clients are able to pass the authentication. Scenario: The issue occurred as the RADIUS server was unable to receive authentication requests any further because it was flooded. This issue was observed in controllers running RADIUS Symptom: A controller rebooted unexpectedly due to a datapath timeout. The fix ensures that the controller works as expected. Scenario: The issue was observed in controllers running Controller- Datapath Release Notes Resolved Issues 34