ArubaOS FIPS. Release Notes

Transcription

1 ArubaOS FIPS Release Notes

2 Copyright 2014 Aruba Networks, Inc. Aruba Networks trademarks include, Aruba Networks, Aruba Wireless Networks, the registered Aruba the Mobile Edge Company logo, Aruba Mobility Management System, Mobile Edge Architecture, People Move. Networks Must Follow, RFProtect, Green Island. All rights reserved. All other trademarks are the property of their respective owners. Open Source Code Certain Aruba products include Open Source software code developed by third parties, including software code subject to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open Source Licenses. Includes software from Litech Systems Design. The IF-MAP client library copyright 2011 Infoblox, Inc. All rights reserved. This product includes software developed by Lars Fenneberg et al. The Open Source code used can be found at this site: Legal Notice The use of Aruba Networks, Inc. switching platforms and software, by all individuals or corporations, to terminate other vendors VPN client devices constitutes complete acceptance of liability by that individual or corporation for this action and indemnifies, in full, Aruba Networks, Inc. from any and all legal actions that might be taken against it with respect to infringement of copyright on behalf of those vendors. Warranty This hardware product is protected by an Aruba warranty. For details, see Aruba Networks standard warranty terms and conditions Crossman Avenue Sunnyvale, California Phone: Fax ArubaOS FIPS Release Notes March 2014

3 Contents Chapter 1 Release Overview... 5 Release Note Overview...5 Supported Browsers...5 Contacting Support...6 Chapter 2 What s New in this Release... 7 Features in this Release...7 Features in Previous Releases...7 Support for RADIUS Framed-IP-Address for VPN Clients...7 Advertisement of VPN Client Host Routes Through OSPF...7 4G Backhaul Support for 600 Series Controllers...7 Chapter 3 Fixed Issues... 9 Fixed Issues in this Release...9 Fixed Issues in Previous Releases...9 Chapter 4 Known Issues Known Issues in Previous Releases...11 Chapter 5 Upgrade Procedures Important Points to Remember...13 Technical Upgrading Best Practices...13 WIP Configuration Changes in ArubaOS FIPS...14 WIP Predefined Profiles...14 Wireless Containment Parameter...15 Signature Matching Profile Default Instance...15 WIP Logging Changes...15 Basic Upgrade Sequence...15 Managing Flash Memory...16 Before Upgrading...16 Backing up Critical Data...16 Backing up and Restoring Compact Flash in the WebUI...16 Backing Up and Restoring Compact Flash in the CLI...17 Licensing Change History and Mapping...17 ArubaOS FIPS...17 ACR Interaction...17 Upgrading from ArubaOS FIPS or later to ArubaOS FIPS Loading New Licenses...19 Saving your Configuration...19 Saving the Configuration in the WebUI...19 Saving the Configuration in the CLI...19 Installing ArubaOS FIPS...19 Installing ArubaOS FIPS in the WebUI...19 Installing ArubaOS FIPS in the CLI...20 Upgrading from pre-arubaos FIPS to ArubaOS FIPS...21 Loading New Licenses...21 ArubaOS FIPS Release Notes 3

4 Saving your Configuration...21 Saving the Configuration in the WebUI...21 Saving the Configuration in the CLI...22 Installing ArubaOS FIPS...22 Installing ArubaOS FIPSin the WebUI...22 Installing ArubaOS FIPSin the CLI...23 Upgrading in a Multi-Controller Network...24 Pre-shared Key for Inter-Controller Communication...25 Downgrading after an Upgrade...25 Downgrading to ArubaOS FIPS...25 Downgrading to Pre-ArubaOS FIPS...25 Downgrading from x FIPS to FIPS...26 Downgrading from x FIPS to pre FIPS...26 Controller Migration...26 Single-Controller Environment...27 Multiple-Master Controller Environment...27 Master/Local Controller Environment...27 Before Starting Migration...27 Basic Migration Steps...27 Before Calling Technical Support ArubaOS FIPS Release Notes

5 Chapter 1 Release Overview ArubaOS FIPS is a software release that introduces fixes to previously outstanding issues. For details on the features described in the following sections, see the ArubaOS 6.1 User Guide, ArubaOS 6.1 CLI Reference Guide, and ArubaOS 6.1 MIB Reference Guide. NOTE See the Upgrade Procedures on page 13 for instructions on how to upgrade your controller to this release. Release Note Overview Chapter 2, What s New in this Release on page 7 describes the new features introduced in this release and the features documented in the previous release. Chapter 3, Fixed Issues on page 9 provides a description of the issues resolved in the current and previous release. Chapter 4, Known Issues on page 11 describes the known issues introduced in the current and previous release. Chapter 5, Upgrade Procedures on page 13 details the procedures for upgrading your controller from ArubaOS FIPS to ArubaOS FIPS release. Supported Browsers The following browsers are supported with ArubaOS FIPS WebUI: Microsoft Internet Explorer 8.x on Windows XP, Windows Vista, Windows 7, and MacOS Mozilla Firefox 3.x on Windows XP, Windows Vista, Windows 7, and MacOS Apple Safari 5.x on MacOS ArubaOS FIPS Release Notes Release Overview 5

6 Contacting Support Main Site Support Site Airheads Social Forums and Knowledge Base North American Telephone International Telephones Software Licensing Site End of Support information Wireless Security Incident Response Team (WSIRT) arubanetworks.com support.arubanetworks.com community.arubanetworks.com (Toll Free) contact-support licensing.arubanetworks.com end-of-life-policy/ Support Addresses Americas and APAC EMEA WSIRT Please details of any security problem found in an Aruba product. 6 Release Overview ArubaOS FIPS Release Notes

7 Chapter 2 What s New in this Release This chapter provides a brief summary of new features added in ArubaOS FIPS. Features in this Release There are no new features in this release. Features in Previous Releases This section describes features added in ArubaOS FIPS. Support for RADIUS Framed-IP-Address for VPN Clients IP addresses are usually assigned to VPN clients from configured local address pools. This feature provides another way to do this by using the Framed-IP-Address attribute that is returned from a RADIUS server to assign the address. VPN clients use different mechanisms to establish VPN connections with the controller such as IKEv1, IKEv2, EAP or a user certificate. Regardless of how the RADIUS server is contacted for authentication the Framed-IP-Address attribute is assigned the IP address as long as the RADIUS server returns the attribute. The Framed-IP-Address value always has a higher priority than the local address pool. Advertisement of VPN Client Host Routes Through OSPF This feature allows VPN client addresses to be exported to Open Shortest Path First (OSPF) and be advertised as host routes (/32). Exporting applies to any VPN client address regardless of how it is assigned. In the CLI Use this command to export the VPN client s assigned address to OSPF using IPC. (host) (config) #aaa authentication vpn default (host) (VPN Authentication Profile "default") # (host) (VPN Authentication Profile "default") # export-route Use the show ip ospf database command to show LSA types that are generated. 4G Backhaul Support for 600 Series Controllers! CAUTION Route summarization is not performed for these types of routes. There is a different host route advertised for each client on a controller with a very large number of VPN clients. Ensure that upstream routers are sized appropriately. ArubaOS FIPS introduces support for wireless uplink using 4G networks on the 600 Series controller. This feature is only supported when used with a Pantech UML290 4G USB modem. No new commands have been added to support this feature; instead, the existing 600 Series wireless uplink configuration steps are used. To configure a wireless uplink on a 600 Series controller, see the ArubaOS 6.1 User Guide. ArubaOS FIPS Release Notes What s New in this Release 7

8 8 What s New in this Release ArubaOS FIPS Release Notes

9 Chapter 3 Fixed Issues Fixed Issues in this Release The following issues have been fixed in ArubaOS : Table 1 Fixed Issues in ArubaOS FIPS Bug ID Description Symptom: Configuration from the controller did not synchronize with an AP when MTU is less than This issue is fixed by supporting MTU configuration on controller vlan in the range of 1280 and 1500 bytes. Scenario: This issue is seen when the controller sent packets with size larger than the MTU. This issue is not limited to any specific controller model or release version. Symptom: Certain steps under the Configuration > WIZARDS page of the WebUI did not work in Mozilla Firefox The fix ensures that the controller supports Mozilla Firefox Scenario: This issue is seen when you access the Basic Info, License, and Role Assignment steps of the Configuration > WIZARDS page of the WebUI. This issue is not limited to any specific controller model or release version. Symptom: RADIUS authentication failed in networks that had different Maximum Transmission Values (MTUs). To fix this issue, the socket options are updated to allow the controller to send RADIUS requests to the RADIUS server when EAP termination is enabled. Scenario: The RADIUS authentication failed when the MTU value in the network between the controller and RADIUS server was different. This issue was observed in controllers running ArubaOS x Symptom: When the customer clicks on the Locate button in the Dashboard > Security tab, the loctaion information is not displayed. To reoslve this issue, the logicall implemention error in the code is addressed. Scenario: This issue is observed in ArubaOS FIPS and FIPS, but is not specific to any controller model. Fixed Issues in Previous Releases The following issues have been fixed in ArubaOS FIPS: Table 2 Fixed Issues in ArubaOS FIPS Bug ID Description Symptom: OUI 18:64:72 was not supported on Aruba devices. OUI is the first three octets in a MAC address that uniquely identifies the equipment manufacturer. Aruba devices now come with the new mac address pool. Scenario: This issue was not specific to any controller model or release version. ArubaOS FIPS Release Notes Fixed Issues 9

10 The following issues have been fixed in ArubaOS FIPS: Table 3 Fixed Issues in ArubaOS FIPS Bug ID Description Symptom: An OpenSSH LoginGraceTime Denial of Service (DoS) vulnerability was observed when a Qualys scan was run against an Aruba 650 controller. This issue is fixed by reducing the possibilities of a successful DoS attack by implementing a random early drop method. Scenario: This issue was not specific to any controller model or release version Symptom: The default SSL server certificate was set to expire on November 21, This certificate is now replaced with one that is valid until August Scenario: This issue was identified on ArubaOS 6.1.x.x-FIPS and was not limited to any specific controller model. The following issues have been fixed in ArubaOS FIPS: Table 4 Fixed Issues in ArubaOS FIPS Bug ID Description Symptom: When packet capture for IKE using the command crypto isakmp packet-dump was enabled the packet capture did not happen. Scenario: This issue was identified on ArubaOS 6.1.x.x-FIPS and was not limited to any specific controller model Symptom: Previously, the PEF-NG license was required in order to modify roles and firewall policies for VIA users. This has been corrected so that the PEF-V license now enables you to modify roles and policies for VIA users. Scenario: This issue was identified on ArubaOS 6.1.x.x-FIPS and was not limited to any specific controller model Symptom: OpenSSL vulnerability CVS allowed a remote attacker to perform DoS attacks and caused the Certificate Manager to crash by through an invalid key. Scenario: Systems were affected with this vulnerability, if OCSP was enabled for certificate revocation check and the signature verification of OCSP response was not performed properly. This issue was identified on ArubaOS 6.1.x.x-FIPS and was not limited to any specific controller model Symptom: Although the Aruba-Factory-CA is not configured in the IKE ca-certificate list, logs showed that during IKE authentication, the client certificate was being checked against the factory CA. The crypto isakmp block-aruba-ca command now applies to all IPsec connections regardless of the connection type. Previously the command applied only to RAP connections. Note that when using this command, features such as CPsec that depend on factory-installed device certificates no longer function. To use master/local communication when this command is enabled, you must use custom certificates. Scenario: This occurred on ArubaOS6.1.x and did not affect a specific controller model Symptom: Reloading the master controller with a master redundancy setup occasionally caused the global configuration to disappear during startup and when running the configuration. Scenario: This occurred on ArubaOS FIPS and not limited to a specific controller model. When the master controller was reloaded, it briefly came up as standby and prematurely sent a heartbeat message to the new master controller (old standby). This caused the new master controller to send global configuration data to the old master controller. 10 Fixed Issues ArubaOS FIPS Release Notes

11 Chapter 4 Known Issues Known Issues in Previous Releases The following issue was identified in a previous release. Table 1 Known Issues and Limitations in ArubaOS FIPS Bug ID Description Symptom: The user cannot send or receive data traffic over the IPsec channel using the Aruba VIA client when the connection is established using IKEv1 with a pre-shared key. Scenario: This occurs on the Aruba VIA client and all Aruba controllers running ArubaOS 6.1.X.X- FIPS release. Workaround: Use IKEv2 or certificate-based authentication. ArubaOS FIPS Release Notes Known Issues 11

12 12 Known Issues ArubaOS FIPS Release Notes

13 Chapter 5 Upgrade Procedures This chapter details software and hardware upgrade procedures. It is recommend that you schedule a maintenance window when you upgrade the controllers. Topics in this chapter include: Important Points to Remember on page 13 Technical Upgrading Best Practices on page 13 WIP Configuration Changes in ArubaOS FIPS on page 14 The new WIP logging subcategories - ids and ids-ap are enabled at the Warning level when you upgrade. By default, AP logging of WIP events is disabled and correlation of WIP logs is enabled. on page 15 Managing Flash Memory on page 16 Before Upgrading on page 16 Licensing Change History and Mapping on page 17 Upgrading from ArubaOS FIPS or later to ArubaOS FIPS on page 18 Upgrading from pre-arubaos FIPS to ArubaOS FIPS on page 21 Upgrading in a Multi-Controller Network on page 24 Downgrading after an Upgrade on page 25 Before Calling Technical Support on page 27 Important Points to Remember Listed below are the actions to optimize your upgrade procedure: Upgrading during a maintenance window limits the troubleshooting variables. Verify your current ArubaOS version (execute the show version, show image version, or the show switches command). Verify the services used for each controller (for example, Employee Wireless, Guest Access, Remote AP, Wireless Voice). Verify the exact number of access points (APs) assigned to each controller. List the method used by the AP to discover the controller (DNS, DHCP Option, broadcast), and verify that those methods are operating as expected. Resolve any existing issues (consistent or intermittent) before you upgrade. List devices such as Core switches, radius servers, DHCP servers, and firewall, in the infrastructure, to provide wireless users with connectivity. Technical Upgrading Best Practices Connectivity issues will interfere with a successful upgrade. To ensure that the traffic path is functioning, test and make connectivity changes (routing, switching, DHCP, authentication), if required. Do not combine a software upgrade with other upgrades; this limits the troubleshooting variables. Do not make configuration changes during your upgrade. ArubaOS FIPS Release Notes Upgrade Procedures 13

14 Verify that all the controllers are running the same software version in a master-local relationship. The same software version assures consistent behavior in a multi-controller environment. Use FTP to upload software images to the controller. FTP is much faster than TFTP and also offers more resilience over slower links. NOTE If you must use TFTP, ensure that your TFTP servers can send more than 30 MB data. Always upgrade the non-boot partition first. If there is an issue while upgrade, you can restore the flash, and switch back to the boot partition. Upgrading the non-boot partition gives you a smoother downgrade path, if required. WIP Configuration Changes in ArubaOS FIPS New configuration parameters were added in ArubaOS FIPS. When you upgrade from an ArubaOS prior to ArubaOS FIPS, new parameters are automatically added to their respective profiles and given their default value. If the default value of an existing parameter changed in versions prior to ArubaOS FIPS, profiles using the default value will automatically be changed to use the new default value. If your configuration uses a non-default value prior to upgrade, the value will not be modified during the upgrade process. The following default values were changed: Detect AP Impersonation - changed from True to False Detect Adhoc Network - changed from True to False Detect Wireless Bridge - changed from True to False Detect 40MHz Intel - changed from True to False Detect Active Greenfield mode - changed from True to False WIP Predefined Profiles Except for predefined profiles IDS Rate Thresholds and IDS Signature, all IDS predefined profiles were deprecated in ArubaOS FIPS. The deprecated profiles are handled as follows: If a predefined profile is referenced by default from another profile, the reference will point to the new default instance of the profile. If a predefined profile is referenced explicitly (that is, you changed from the default value so that it points to a predefined profile), after the upgrade the reference will point to a profile that is an editable clone of the predefined profile. The profile is named similarly to the predefined profile, except the word transitional is inserted after ids. 14 Upgrade Procedures ArubaOS FIPS Release Notes

15 Wireless Containment Parameter The status of the wireless-containment parameter in the ids-general-profile changes from an enabled/ disabled knob, to an enumeration (none, deauth-only, tarpit-non-valid-sta, tartip-all-sta) only if: the parameter was set to enabled (its default value), the upgrade will render the value as deauth-only (the new default value). the parameter was set to disabled, the upgrade will render the value as none. Signature Matching Profile Default Instance The default instance of the signature matching profile in ArubaOS contains references to two predefined signatures: Deauth-Broadcast and Disassoc-Broadcast (a new signature in ArubaOS 6.14-FIPS). The default instance of this profile was empty prior to ArubaOS 6.14-FIPS. If the profile is empty, the upgrade will render the profile with both the predefined signatures. If the profile is not empty, the upgrade will add references to the two predefined signatures, if they are not already there. WIP Logging Changes In ArubaOS FIPS, all WIP logs related to intrusion detection and protection are in the security logging category. Earlier most WIP logs were generated under the Wireless Logging category. Many of the logs that were previously generated at the Error level have been moved to the Warning level. In the security logging category, two new subcategories are added: The ids subcategory contains correlated WIP logs. The ids-ap subcategory contains WIP logs generated by the APs (uncorrelated). The new WIP logging subcategories - ids and ids-ap are enabled at the Warning level when you upgrade. By default, AP logging of WIP events is disabled and correlation of WIP logs is enabled. Basic Upgrade Sequence It is recommended that you list the users in different locations to assist with the validation before you begin the upgrade. Listed below are the validation procedures. NOTE If you manage your controllers via AirWave Wireless Management Suite, the AirWave upgrade process automates most of these steps. 1. Upload the same version of the new software image onto all controllers. 2. Reboot all controllers simultaneously. 3. Execute the ping -t command to verify all your controllers are up after the reboot. 4. Open a Secure Shell session (SSH) on your Master Controller. 5. Execute the show ap database command to determine if your APs are actively working and are ready to accept clients. 6. Execute the show ap active to view the APs that are actively working. 7. Repeat step 5 and step 6 until a sufficient amount of APs are actively working. The show ap database command displays both active and inactive APs. If some APs are down, execute the show datapath session table <access point ip address> command and verify the traffic flows through the controller. If there is no traffic flow, ping the APs. If they still do not respond, execute the show ap database long command to view the wired mac address of the AP. 8. Verify the number of access points and clients. ArubaOS FIPS Release Notes Upgrade Procedures 15

16 9. Test a different client for each access method (802.1X, VPN, Remote AP, Captive Portal, Voice) and in different locations.! CAUTION Managing Flash Memory All Aruba controllers store critical configuration data on an onboard compact flash memory module. To maintain the reliability of your WLAN network, Aruba recommends the following compact flash memory best practices: Do not exceed the size of the flash file system. For example, loading multiple large building JPEGs for RF Plan or VisualRF Plan can consume flash space quickly. Warning messages are alerts that notify you when the file system is running out of space or if there is a write attempt to flash and only 5 Mbps or less space is remaining. Other tasks that are impacted when there is insufficient flash file system space include: DHCP lease and renew information is stored in the flash. If the file system is full, DHCP addresses cannot be distributed or renewed. If a controller encounters a problem and it needs to write a log file, it will not be able to do so if the file system is full. As a result critical troubleshooting information will be lost In certain situations, a reboot or a shutdown could cause the controller to lose the information stored in its compact flash card. To avoid such issues, it is recommended that you issue the halt command before rebooting. Before Upgrading Ensure the following before installing a new image on the controller: Make sure you have at least 10 Mb ree compact flash space, using the show storage command. Execute the tar crash command to ensure that there are no process died files clogging the memory. In case there are files, FTP/TFTP the files to another storage device. Remove the saved files that are not required from the flash, using the delete filename command. Backing up Critical Data Frequently backup all critical configuration data and files on the compact flash file system to an external server or mass storage facility. It is recommended that you include the following files in these frequent backups: Configuration data WMS database Local user database Licensing database Floor plan JPEGs Customer captive portal pages Customer x.509 certificates Backing up and Restoring Compact Flash in the WebUI The following steps describe how to back up and restore the compact flash file system using the WebUI on the controller: 1. Navigate to the Maintenance > File > Backup Flash page. 16 Upgrade Procedures ArubaOS FIPS Release Notes

17 2. Click Create Backup to back up the contents of the compact flash file system to the file flashbackup.tar.gz. 3. Click Copy Backup to copy the file to an external server. You can later copy the backup file from the external server to the compact flash file system by navigating to the Maintenance > File > Copy Files page. 4. To restore the backup file to the compact flash file system, navigate to the Maintenance > File > Restore Flash page and click Restore. Backing Up and Restoring Compact Flash in the CLI The following steps describe the back up and restore procedure for the entire compact flash file system using the controller s command line: 1. Enter enable mode in the CLI on the controller. 2. Use the backup command to back up the contents of the compact flash file system to the file flashbackup.tar.gz: (host) # backup flash Please wait while we tar relevant files from flash... Please wait while we compress the tar file... Checking for free space on flash... Copying file to flash... File flashbackup.tar.gz created successfully on flash. 3. Use the copy command to transfer the backup flash file to an external server: (host) copy flash: flashbackup.tar.gz ftp: <ftphost> <ftpusername> <ftpuserpassword> <remote directory> You can later transfer the backup flash file from the external server to the compact flash file system with the copy command: (host) # copy tftp: <tftphost> <filename> flash: flashbackup.tar.gz 4. Use the restore command to untar and extract the flashbackup.tar.gz file to the compact flash file system: (host) # restore flash Licensing Change History and Mapping License consolidation and even renaming of licenses occur over time. The following changes and/or consolidations were made to the ArubaOS licensing. ArubaOS FIPS software licenses have been consolidated and in some instances licensing names and modules were renamed to more accurately represent the modules supported by the licenses. For a detailed description of these new license modules, refer to the Software Licenses chapter in the User Guide. ArubaOS FIPS The VIA feature now requires a PEFV license (Policy Enforcement Firewall Virtual Private Network). The Walled Garden feature requires the PEFNG or PEFV license. The Advanced Cryptography License (ACR) is required for the Suite B Cryptography in IPsec and modes. License enforcement behavior controls the total number of concurrent connections (IPsec or ) using Suite B Cryptography. ACR Interaction On a platform that supports 2048 IPsec tunnels, the maximum number of Suite B IPsec tunnels supported is 2048, even if a larger capacity license is installed. ArubaOS FIPS Release Notes Upgrade Procedures 17

18 An evaluation ACR license is available (EVL-ACR-8192). You can install the ACR evaluation license with a higher capacity than the platform maximum. On a platform that supports 2048 IPsec tunnels, with a LIC-ACR-512 installed, only 512 IPsec tunnels can be terminated using Suite B encryption. An additional 1536 IPsec tunnels, using non-suite B modes (e.g. AES-CBC), can still be supported. On a platform with LIC-ACR-512 installed, a mixture of IPsec and i Suite B connections can be supported. The combined number of these sessions may not exceed 512. A single client using both i Suite B and IPsec Suite B simultaneously will consume two ACR licenses. WIP license is changed to RFprotect and includes the WIP and Spectrum Analysis features. Figure 1 is an up-to-date illustration of the consolidated licenses effective with this release. MAP was merged into base ArubaOS VPN was merged into base ArubaOS RAP was merged into AP license PEF (user basis) was converted to PEFNG (AP basis) with ArubaOS FIPS VOC was merged into PEF. IMP was merged into base ArubaOS ESI was merged into PEF Figure 1 Licensing Consolidation ArubaOS 5.0 Upgrading from ArubaOS FIPS or later to ArubaOS FIPS If you are running ArubaOS FIPS or later, you can directly upgrade to ArubaOS FIPS. Refer to ArubaOS FIPS Release Note for upgrade information to this release. Should you need to downgrade from ArubaOS FIPS, you need to downgrade to version ArubaOS FIPS first. 18 Upgrade Procedures ArubaOS FIPS Release Notes

19 Read all the following information before you upgrade to ArubaOS FIPS. Loading New Licenses on page 21 Saving your Configuration on page 21 Installing ArubaOS FIPS on page 22 Loading New Licenses Before you upgrade to ArubaOS FIPS, assess your software license requirements and load any new or expanded licenses you require prior to upgrading to ArubaOS FIPS. Software licenses in ArubaOS FIPS are consolidated and in some instances license names and modules are renamed to more accurately represent the modules supported by the licenses (see Figure 1). For a detailed description of these new license modules, refer to the Software Licenses chapter in the User Guide. Saving your Configuration Before upgrading, save your configuration and corresponding SHA-1 files, and take a backup of the controller s data files (see Managing Flash Memory on page 16). Saving the configuration saves the admin and enable passwords in the proper format. Saving the Configuration in the WebUI 1. Click on the Configuration tab. 2. Click the Save Configuration button at the top of the screen. Saving the Configuration in the CLI Enter the following command in enable or config mode: (host) #write memory Installing ArubaOS FIPS Download the latest software image from the Aruba Customer Support website.! CAUTION When upgrading the software in a multi-controller network (one that uses two or more Aruba controllers), special care must be taken to upgrade all the controllers in the network and to upgrade them in the proper sequence. (See Upgrading in a Multi-Controller Network on page 24.) NOTE When upgrading the controller, note the following: - Confirm (show memory) that there is at least 40 MB of free memory available. - Confirm (show storage) that there is at least 85 MB of /flash available. - If less flash space is available find and delete all crash files, logs.tar file or a previous failed download image. At times there are crash files on the platform which may not be removed automatically. If the crash files directory is not already archived as crash.tar, run the tar crash command to collate the crash file. Run the dir command to list the files. Installing ArubaOS FIPS in the WebUI The following steps describe how to install the ArubaOS software image from a PC or workstation using the WebUI on the controller. You can also install the software image from a TFTP or FTP server using the same WebUI page. 1. Upload the new software image to a PC or workstation on your network. ArubaOS FIPS Release Notes Upgrade Procedures 19

20 2. Log in to the WebUI from the PC or workstation. 3. Navigate to the Maintenance > Controller > Image Management page. Select the Upload Local File option, and click the Browse button to navigate to the image file on your PC or workstation. 4. To see the current boot partition, navigate to the Maintenance > Controller> Boot Parameters page. 5. Select No for Reboot Controller After Upgrade. Reboot manually after the upgrade. 6. Click Upgrade. Ignore the following error message when the upgrade is complete: write Device: No such file or directory 7. Navigate to Controller > Boot Parameters. Make sure that the partition you upgraded to is the boot partition. 8. Navigate to Controller > Reboot Controller. Select Yes next to Save Current Configuration Before Reboot? 9. When the boot process is complete, log in to the WebUI and navigate to the Monitoring > Controller > Controller Summary page to verify the upgrade, including country code. The Country field displays the country code configured on the controller. Installing ArubaOS FIPS in the CLI Follow these steps to upgrade a controller to ArubaOS version FIPS using the CLI. 1. Upload the new software image to your FTP/TFTP server on your network. 2. Execute the ping command to verify the network connection from the target controller to the FTP/TFTP server: (host) # ping <ftphost> or (host) # ping <tftphost> NOTE A valid IP route must exist between the FTP/TFTP server and the controller. A placeholder file with the destination filename and proper write permissions must exist on the FTP/TFTP server prior to executing the copy command. 3. Determine which partition to load the new software image. Use the following command to check the partitions: #show image version Partition : 0:0 (/dev/hda1) **Default boot** Software Version : ArubaOS (Digitally Signed - Production Build) Build number : Label : Built on : :02:33 PST Partition : 0:1 (/dev/hda2) Software Version : ArubaOS (Digitally Signed - Production Build) Build number : Label : Built on : :53:22 PST The best practice is to load the new image onto the backup partition (the non-boot partition). In the above example, partition 0 is the boot partition. Partition 1 is empty (image not present) and can be used to load the new software. 4. Use the copy command to load the new image onto the controller. This example uses partition 1. (host) # copy ftp: <ftphost> <ftpusername> <image filename> system: partition 1 or (host) # copy tftp: <tftphost> <image filename> system: partition 1 20 Upgrade Procedures ArubaOS FIPS Release Notes

21 The first time upgrade generates the following signature error. Ignore this error for the first time you upgrade to ArubaOS FIPS. Saving file to flash: Manually choose the system partition that contains the version 6.1 software image. In this example, partition 1 is selected. (host) (config) #boot system partition 1 6. Reload the system. (host) (config) #reload Upgrading from pre-arubaos FIPS to ArubaOS FIPS You can upgrade directly from ArubaOS x-FIPS to ArubaOS FIPS directly. If you are running a pre-arubaos FIPS version then you must first upgrade to ArubaOS FIPS build before upgrading to ArubaOS FIPS. Refer to ArubaOS FIPS Release Note for upgrade information to this release. Should you need to downgrade from ArubaOS FIPS, you need to downgrade to version ArubaOS FIPS first. Read all the following information before you upgrade to ArubaOS FIPS. Loading New Licenses on page 21 Saving your Configuration on page 21 Installing ArubaOS FIPS on page 22 Loading New Licenses Before you upgrade to ArubaOS FIPS, assess your software license requirements and load any new or expanded licenses you require prior to upgrading to ArubaOS FIPS. Software licenses in ArubaOS FIPS are consolidated and in some instances license names and modules are renamed to more accurately represent the modules supported by the licenses (see Figure 1). For a detailed description of these new license modules, refer to the Software Licenses chapter in the user guide. Saving your Configuration Before upgrading, save your configuration and corresponding SHA-1 files, and back up your controllers data files (see Managing Flash Memory on page 16). Saving your configuration saves the admin and enable passwords in the proper format. Saving the Configuration in the WebUI 1. Click on the Configuration tab. 2. Click the Save Configuration button at the top of the screen. ArubaOS FIPS Release Notes Upgrade Procedures 21

22 Saving the Configuration in the CLI Enter the following command in enable or config mode: (host) #write memory Installing ArubaOS FIPS Download the latest software image from the Aruba Customer Support website.! CAUTION When upgrading the software in a multi-controller network (one that uses two or more Aruba controllers), special care must be taken to upgrade all the controllers in the network and to upgrade them in the proper sequence. (See Upgrading in a Multi-Controller Network on page 24.) NOTE When upgrading the controller, note the following: - Confirm (show memory) that there is at least 40 MB of free memory available. - Confirm (show storage) that there is at least 85 MB of /flash available. - If less flash space is available find and delete all crash files, logs.tar file or a previous failed download image. At times there are crash files on the platform which may not be removed automatically. If the crash files directory is not already archived as crash.tar, run the tar crash command to collate the crash file. Run the dir command to list the files. Installing ArubaOS FIPSin the WebUI The following steps describe how to install the ArubaOS software image from a PC or workstation using the WebUI on the controller. You can also install the software image from a TFTP or FTP server using the same WebUI page. 1. Upload the new software image to a PC or workstation on your network. 2. Log in to the WebUI from the PC or workstation. 3. Navigate to the Maintenance > Controller > Image Management page. Select the Upload Local File option, then click the Browse button to navigate to the image file on your PC or workstation. 4. Determine which memory partition will be used to hold the new software image. Best practices is to load the new image onto the backup partition. To see the current boot partition, navigate to the Maintenance > Controller> Boot Parameters page. 5. Select No for Reboot Controller After Upgrade. Reboot manually after the upgrade. 6. Click Upgrade. Ignore the following error message when the upgrade is complete: write Device: No such file or directory 7. Navigate to Controller > Boot Parameters. Make sure that the partition you upgraded to is the boot partition. 8. Navigate to Controller > Reboot Controller. Select Yes next to Save Current Configuration Before Reboot? field. 9. Click Continue. 10. When the boot process is complete, login to the controller. The following message is displayed: 22 Upgrade Procedures ArubaOS FIPS Release Notes

23 Figure 2 Additional Upgrade Warning 11. Click Upgrade Now to continue the upgrade. (You can click Upgrade Later if you want to upgrade at another time.) 12. Upload the same image again to the same partition and click Upgrade. The write Device error message does not appear this time. When the upgrade is complete, the message image Upgraded Successfully displays. 13. Navigate to Controller > Reboot Controller and reboot the controller. 14. When the boot process is complete, log in to the WebUI and navigate to the Monitoring > Controller > Controller Summary page to verify the upgrade, including country code. The Country field displays the country code configured on the controller. Installing ArubaOS FIPSin the CLI Follow these steps to upgrade a controller to ArubaOS version FIPS using the CLI. 1. Upload the new software image to your FTP/TFTP server on your network. 2. Execute the ping command to verify the network connection from the target controller to the FTP/TFTP server: (host) # ping <ftphost> or (host) # ping <tftphost> NOTE A valid IP route must exist between the FTP/TFTP server and the controller. A placeholder file with the destination filename and proper write permissions must exist on the FTP/TFTP server prior to executing the copy command. 3. Determine which partition to load the new software image. Use the following command to check the partitions: #show image version Partition : 0:0 (/dev/hda1) Software Version : ArubaOS (Digitally Signed - Production Build) Build number : Label : Built on : :02:33 PST Partition : 0:1 (/dev/hda2)**default boot** Software Version : ArubaOS (Digitally Signed - Production Build) Build number : Label : Built on : :53:22 PST ArubaOS FIPS Release Notes Upgrade Procedures 23

24 Best practices is to load the new image onto the backup partition (the non-boot partition). In the above example, partition 0 is the boot partition. Partition 1 is empty (image not present) and can be used to load the new software. 4. Use the copy command to load the new image onto the controller. This example uses partition 1. (host) # copy ftp: <ftphost> <ftpusername> <image filename> system: partition 1 or (host) # copy tftp: <tftphost> <image filename> system: partition 1 The first time upgrade generates the following signature error. Ignore this error for the first time you upgrade to ArubaOS FIPS Saving file to flash: Error upgrading image:image Signature Verified Successfully 5. Manually choose the system partition that contains the version 6.1 software image. In this example, partition 1 is selected. (host) (config) #boot system partition 1 6. Reload the system. (host) (config) #reload When the controller comes back up the following banner displays: ********************************************************************* * WARNING: An additional image upgrade is required to complete the * * installation of the AP and WebUI files. Please upgrade the boot * * partition again and reload the controller. * ********************************************************************* 7. Download the same image again to the same partition and repeat Step. 4. The signature error message does not appear this time. 8. Reload the controller. NOTE This double upgrade is required only when you are upgrading on a controller running an ArubaOS pre fips version and you see the error message. Once your controller is running ArubaOS version FIPS, the double upgrade is not required. When the controller comes back up, the warning banner does not display. All the images are ready and the WebUI displays normally. Upgrading in a Multi-Controller Network In a multi-controller network (a network with two or more Aruba controllers), special care must be taken to upgrade all controllers based on the controller type (master or local). Be sure to back up all controllers being upgraded, as described in Backing up Critical Data on page 16. NOTE For proper operation, all controllers in the network must be upgraded with the same version of ArubaOS software. For redundant (VRRP) environments, the controllers should be the same model. To upgrade an existing multi-controller system to ArubaOS FIPS. 24 Upgrade Procedures ArubaOS FIPS Release Notes

25 1. Load the software image onto all controllers (including redundant master controllers). 2. If all the controllers cannot be upgraded with the same software image and reloaded simultaneously, use the following guidelines: a. Remove the link between the master and local mobility controllers. b. Upgrade the software image, then reload the master and local controllers one by one. c. Verify that the master and all local controllers are upgraded properly. d. Connect the link between the master and local controllers. Pre-shared Key for Inter-Controller Communication A pre-shared key (PSK) is used to create IPSec tunnels between a master and backup master controllers and between master and local controllers. These inter-controller IPSec tunnels carry management traffic such as mobility, configuration, and master-local information. NOTE An inter-controller IPSec tunnel can be used to route data between networks attached to the controllers. To route traffic, configure a static route on each controller specifying the destination network and the name of the IPSec tunnel. There is a default PSK to allow inter-controller communications, however, for security you need to configure a unique PSK for each controller pair. You can use either the WebUI or CLI to configure a 6-64 character PSK on master and local controllers.! CAUTION Do not use the default global PSK on a master or standalone controller. If you have a multi-controller network then configure the local controllers to match the new IPSec PSK key on the master controller. Leaving the PSK set to the default value exposes the IPSec channel to serious risk, therefore you should always configure a unique PSK for each controller pair. Downgrading after an Upgrade You can return to your previous version of ArubaOS-FIPS. Downgrading to ArubaOS FIPS 1. Use the write erase all command to restore the factory default settings. 2. Load the ArubaOS FIPS image. 3. Reload the controller. 4. When the controller comes up it is running the ArubaOS FIPS image with factory default settings. 5. Transfer the ArubaOS FIPS flash backup to the controller. 6. Restore the flash and the licenses from backup. 7. Copy the ArubaOS FIPS configuration file and the corresponding SHA-1 file from backup to the controller. 8. Use the boot config-file command to set the ArubaOS FIPS configuration file as the boot configuration file. 9. Reboot the controller. Downgrading to Pre-ArubaOS FIPS 1. Downgrade to ArubaOS FIPS first. ArubaOS FIPS Release Notes Upgrade Procedures 25

26 2. Follow the steps in the sections: Downgrading from x FIPS to FIPS and Downgrading from x FIPS to pre FIPS. Downgrading from x FIPS to FIPS! CAUTION This downgrade requires a restoration of the database from a snapshot backup. All current database contents will be lost. To downgrade from a x FIPSS image to the FIPS image: 1. Use the write erase all command to restore the factory default settings. 2. Load the FIPS image. 3. Reload the controller. When the controller comes up it will be running the FIPS image with factory default settings. 4. Connect to the controller and configure the network parameters. 5. Transfer the x FIPS flash backup into the controller. NOTE After a write erase and reload, the controller running 2.x-FIPS comes up with factory default settings. After reboot, you need to use a computer (the serial port on the controller is covered with a TEL) on subnet x to connect to the controller on to set network parameters. 6. Restore the flash and the licenses from backup. 7. Copy the x-FIPS configuration file and the corresponding SHA-1 file from backup to the controller. 8. Use the boot config-file command to set the x FIPS configuration file as the boot configuration file. 9. Reboot the controller. Downgrading from x FIPS to pre FIPS To downgrade from the x FIPS image to a pre FIPS image: 1. Follow Steps 1 7 in the previous section, Downgrading from x FIPS to FIPS on page Load the pre FIPS image. 3. Reload the controller. Controller Migration This section outlines the steps involved in migrating from an Aruba PPC controller environment to MIPS controller environment. These steps take into consideration the common Aruba WLAN controller environment. You must have an operational PPC controller in the environment when migrating to a new controller. The controllers are classified as: MIPS Controllers M3, 3000 Series, 600 Series PPC Controllers 200, 800, 2400, 5000 and SC1/SC2 NOTE Use this procedure to upgrade from one Aruba controller model to another. Take care to ensure that the new controller has equal or greater capacity than the controller you are replacing and verify that your new controller supports the ArubaOS version you are migrating to. Migration instructions include: Single-Controller Environment on page Upgrade Procedures ArubaOS FIPS Release Notes

27 Multiple-Master Controller Environment on page 27 Master/Local Controller Environment on page 27 Single-Controller Environment A single controller environment is one active controller, or one master controller that may have standby master controller that backs up the master controller. Replacing the standby controller Does not require downtime Replacing the master controller Requires downtime Multiple-Master Controller Environment An all master environment is considered an extension of the single master controller. You can back up the master controllers with a standby controller. In an all master controller deployment, each master controller is migrated as if it were in a standalone single controller environment. For every master-standby controller pair Replacing the standby controller Does not require downtime Replacing the master controller Requires downtime Master/Local Controller Environment In a master/local environment, replace the master controller first and then replace the local controllers. Replacing the local standbys (when present) Replacing local controllers one controller at a time Before Starting Migration You must have: Administrative access to the controller via the network Administrative access to the controller via the controller s serial port Pre-configured FTP/TFTP server that can be reached from the controller Aruba serial cable The ArubaOS version (same as the rest of the network) Basic Migration Steps 1. Ensure that the ArubaOS version on the newer controllers match the ArubaOS version on the rest of the controllers in your network. 2. Backup the old controller data and move the backup files to a safe place that is easily accessible through FTP/TFTP. 3. Physically swap the hardware (for example, mounting, cabling, power). 4. Initialize the new controller with the correct license. 5. Install the backed up data onto the new controller. 6. Test the new setup. Before Calling Technical Support Before you place a call to Technical Support, please follow these steps: ArubaOS FIPS Release Notes Upgrade Procedures 27