Aruba Instant Access Point Example Configuration Walkthrough

I recently upgraded my in home WiFi from Extreme/Zebra/Motorola RFS4010 with two AP650s with two Aruba IAP-205s. Here’s the configuration I used in setting up those Aruba IAPs.

We need to set the country, enable SSH (terminal-access), set the NTP server and timezone and enable both RF bands.

virtual-controller-country US
terminal-access
ntp-server 192.168.1.1
clock timezone Eastern-Time -05 00
clock summer-time EDT recurring second sunday march 02:00 first sunday november 02:00
rf-band all

Next we need to set some parameters for Adaptive Radio Management (ARM). We’ll enable 80 MHz and 40 MHz wide channels for the 5Ghz radio, set the min and max radio transmit power, enable band steering, set air-time fairness, and allow the APs to occasionally scan the RF space. We’re going to omit the “client aware” option because that will prevent the IAP from changing channels if there is a client associated to that specific IAP.

arm
 wide-bands 5ghz
 80mhz-support
 min-tx-power 18
 max-tx-power 127
 band-steering-mode prefer-5ghz
 air-time-fairness-mode fair-access
 scanning
 no client aware

Let’s set the admin password for future use

mgmt-user admin securepasswordforadmin

Here we’ll create a simple ACL for our WLAN, we could restrict traffic using this ACL if we needed to.

wlan access-rule MYWIFIWLAN
 rule any any match any any any permit

Here’s the meat and potatoes, we will create an SSID called MYWIFIWLAN with WPA2/AES PSK authentiation. It will be advertised over both 2.4Ghz (802.11b/g) and 5Ghz (802.11a/n) radios with a minimum Tx bandwidth of 5Mbps on the 2.4Ghz band and 12Mbps on the 5Ghz band.

wlan ssid-profile MYWIFIWLAN
 enable
 type employee
 essid MYWIFIWLAN
 wpa-passphrase MYWIFIWLANPSKPASSWORD
 opmode wpa2-psk-aes
 max-authentication-failures 0
 rf-band all
 captive-portal disable
 dtim-period 1
 broadcast-filter none
 g-min-tx-rate 5
 a-min-tx-rate 12
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64
 okc
 dot11k
 dot11v

I was originally using a broadcast filter of ARP with AirGroup enabled but my daughters quickly let me know that they could no longer play Minecraft together (peer to peer) on their laptops when connected to the wireless network. The client is likely using a broadcast packet to locate the server and the IAP was blocking the broadcast packet.

Cheers!