Dell Networking W-Series
ArubaOS 6.5.x
Command-Line Interface
Reference Guide
Copyright Information
©Copyright 2016 Hewlett PackardEnterpriseDevelopment LP. Dell™,theDELL™logo,andPowerConnect™ aretrademarksof DellInc.
Allrightsreserved. Specificationsinthismanualaresubject tochangewithout notice.
OriginatedintheUSA. Allothertrademarksaretheproperty of theirrespectiveowners.
Open Source Code
Thisproduct includescodelicensedundertheGNU GeneralPublicLicense,theGNU LesserGeneralPublic License,and/orcertainotheropensourcelicenses.
2| |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Thefollowingtableprovidestherevisionhistory of thisdocument.
Table 1: Revision History
Revision |
Change Description |
Revision01 |
Initial release. |
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
| 3 |
TheDellNetworkingW-SeriesArubaOS6.5.xcommand-lineinterface(CLI)allowsyoutoconfigureandmanage Dellcontrollers. TheCLI isaccessiblefromalocalconsoleconnectedtotheserialport onthecontrollersor throughaTelnet orSecureShell(SSH)sessionfromaremotemanagement consoleorworkstation.
Telnetaccess is disabledby default. Toenable Telnetaccess, enter the telnet CLIcommandfrom a serial connection or anSSH session, or inthe WebUInavigate tothe Configuration > Management > General page.
Thissectionliststhecommandsintroduced,modified,ordeprecatedinArubaOS6.5.x.
Commands in ArubaOS 6.5.0.0
New Commands
ThefollowingnewcommandsareintroducedinArubaOS6.5.0.0:
Command |
Description |
apconsolidated-provision |
This commandstores the consolidatedAP-provisionedinformationof |
info |
all APs connectedtoa controller inthe ap_provision_info.txt file. |
|
|
block-redirect-url |
This commandredirects the user sessiontoanexternal splashpage |
|
whenitencounters a webcc deny policy. |
|
|
crypto-local isakmpallow- |
This commandallows the controller toacceptthe subnets published |
via-subnet-routes |
by VIA-clients. By default, this feature is disabled. |
|
|
ipreputation |
This commandblocks connectivity toIPaddresses classifiedas |
|
malicious. |
|
|
ipprobe health-check |
This command configures WAN health-check ping-probes for measuring |
|
WAN availability and latency on branch controller uplinks. |
|
|
ntpstandalone |
This commandenables or disables controller toactas NTPserver. |
|
|
showapconsolidated- |
This commanddisplays the consolidatedAP-provisionedinformation |
provisioninfo |
for anaccess pointconnectedtothe controller. |
|
|
showip-reputation |
This commanddisplays the IPReputationstatus of various services. |
|
|
showiphealth-check |
Display the health-checkstatus of the uplinkinterfaces of a branch- |
|
office controller. |
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 4 |
Command |
Description |
showucc dns-ip-learning |
This commanddisplays the carrier’s evolvedPacketData Gateway |
|
(ePDG) IPaddress learnedby the controller. This commandis specific |
|
for Wi-Fi calling clients. |
|
|
showvoice facetime |
This commanddisplays the user configuredpatternthatis matched |
|
againstthe User-Agentfieldof the SIPmessages todetermine if the |
|
sessionis a Facetime session. |
|
|
showvoice wificalling |
This commanddisplays the Wi-Fi Calling ALG configurationonthe |
|
controller. |
|
|
showweb-proxy |
This commanddisplays informationaboutthe portandserver |
|
configuredfor the web-proxy. |
|
|
ssh |
This commandinitiate anSSH sessionfrom the controller toa remote |
|
host. |
|
|
telnet |
This commandinitiate a telnetsessionfrom the controller toa |
|
remote host. |
|
|
voice facetime |
This commandconfigures a patternpresentinthe user-agentfieldof |
|
the SIPsignaling message header todetermine if the media session |
|
is a Facetime session. |
|
|
voice wificalling |
This commandconfigures Wi-Fi Calling onthe controller. |
|
|
web-proxy server |
This commandconfigures the web-proxy server relatedinformation. |
|
|
Modified Commands
ThefollowingcommandsaremodifiedinArubaOS6.5.0.0:
Command |
Description |
|
aaa authenticationvia |
The ocsp-responder enable subcommandis introduced. |
|
connection-profile |
|
|
|
|
|
aaa profile |
The username-from-dhcp-opt12 parameter is introduced. |
|
|
|
|
apregulatory-domain-profile |
The valid-11a-160mhz-channel-group parameter is introduced. |
|
|
|
|
apsystem-profile |
The following newparameters are introduced: |
|
|
• ap-console-password |
|
|
• ap-console-protection |
|
|
• |
console-log-lvl |
|
• disable-tftp-image-upgrade |
|
|
• |
secondary-master |
|
|
|
5| The ArubaOS Command-Line Interface |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Command |
Description |
|
apwired-port-profile |
The portfast and portfast-trunk parameters are introduced. |
|
|
|
|
clear |
The port-security-error gigabitethernet <slot>/<module>/<port> |
|
|
parameter is introduced. This clears the port-security error from a |
|
|
gigabitEthernetIEEE 802.3 interface. |
|
|
|
|
copy |
The flash: parameter is introducedtocopy files from anFTPserver. |
|
|
|
|
web-server profile |
The excludes security headers is introducedtoexclude security |
|
|
headers from HTTPresponse. |
|
|
|
|
firewall |
The ip-classification parameter is introduced. |
|
|
|
|
interface fastethernet| |
The switchport port-security maximum commandis modifiedto |
|
gigabitethernet |
include level and interval sub-parameters. For level, the default |
|
|
value is logging. |
|
|
|
|
ipaccess-listip-geolocation |
The ip-geolocation parameter is introduced. |
|
|
|
|
ipradius |
The nas-vlan <nas-vlan> parameter is introduced, whichallows you |
|
|
toconfigure a RADIUS NAS IPfor a branchcontroller witha VLAN ID. |
|
|
|
|
ipprobe default |
The jitterparameter is introduced. |
|
|
|
|
mgmt-user |
The console-block parameter is introduced. |
|
|
|
|
mgmt-user |
The name parameter is introduced. |
|
|
|
|
rf arm-profile |
The following parameters are introduced. |
|
|
• |
160MHz-support |
|
• interfering-ap-weight |
|
|
• |
dynamic-bw |
|
• dynamic-bw-beacon-failed-thresh |
|
|
• dynamic-bw-cca-ibss-thresh |
|
|
• dynamic-bw-cca-intf-thresh |
|
|
• dynamic-bw-clear-time |
|
|
• dynamic-bw-wait-time |
|
|
|
|
rf dot11a-radio-profile |
The upper limitfor the beacon-period parameter is setto2000 |
|
|
milliseconds. |
|
|
|
|
rf dot11g-radio-profile |
The upper limitfor the beacon-period parameter is setto2000 |
|
|
milliseconds. |
|
|
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 6 |
Command |
Description |
|
showaparm history |
The Result columnis introducedtothe outputof this commandto |
|
|
indicate the status of the requestedchange inchannel or EIRPby |
|
|
ARM. |
|
|
|
|
showapdebug portstatus |
The Portfast parameter is introduced. |
|
|
|
|
showapportstatus |
The Portfast parameter is introduced. |
|
|
|
|
showapregulatory-domain- |
The Valid 802.11a 160MHz channel group parameter is introduced. |
|
profile |
|
|
|
|
|
showapsystem-profile |
The following parameters are introducedas partof the outputof this |
|
|
command: |
|
|
• |
Secondary Master IP/FQDN |
|
• Disable RAP Tftp Image Upgrade |
|
|
• |
AP Console Protection |
|
• |
AP Console Password |
|
|
|
showcrypto-local isakmp |
The allow-via-subnet-routes parameter is introduced. |
|
|
|
|
showdatapath |
The following IPClassificationrelatedparameters are introduced: |
|
|
• |
ip-geolocation [counters] |
|
• |
ip-reputation [counters|rtc] |
|
• session ip-classification |
|
|
|
|
showipaccess-list |
The global-geolocation-acl is introduced. |
|
|
|
|
showfirewall |
The IP classification parameter is introduced. |
|
|
|
|
showrf arm-profile |
The following parameters are introducedas partof the outputof this |
|
|
command: |
|
|
• |
160MHz-support |
|
• |
Interfering AP Weight |
|
• |
Dynamic Bandwidth Switch |
|
• Dynamic Bandwidth Switch Wait Time (sec) |
|
|
• Dynamic Bandwidth Switch Triggering Indicator CCA ibss |
|
|
|
Threshold (%) |
|
• Dynamic Bandwidth Switch Triggering Indicator Beacon |
|
|
|
Failed Threshold |
|
• Dynamic Bandwidth Switch Triggering Indicator CCA intf |
|
|
|
Threshold (%) |
|
• Dynamic Bandwidth Switch Clear Time (min) |
|
|
|
|
7| The ArubaOS Command-Line Interface |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Command |
Description |
|
showsnmptrap-list |
The following parameters are introducedas partof the outputof this |
|
|
command: |
|
|
• |
wlsxAPDown |
|
• |
wlsxAPUp |
|
|
|
showucc call-infocdrs |
The WiFi-Calling applicationparameter is introduced. |
|
|
|
|
showucc client-info |
The WiFi-Calling applicationparameter is introduced. |
|
|
|
|
showucc statistics |
The WiFi-Calling applicationparameter is introduced. |
|
|
|
|
showweb-server |
The Exclude Security Headers from HTTP Response parameter is |
|
|
introduced. |
|
|
|
|
showwlanvoip-cac-profile |
The Allow Idle VOIP Client parameter is introduced. |
|
|
|
|
web-server profile |
The exclude-http-security parameter is introduced. |
|
|
|
|
wlanvirtual-ap |
The cellular-handoff-assist parameter is introduced. This setting |
|
|
cannowbe appliedtoindividual virtual APs via the wlanvirtual-ap |
|
|
profile, andcanhelpa dual-mode, 3G/4G-capable Wi-Fi device such |
|
|
as aniPhone, iPad, or Androidclientatthe edge of Wi-Fi network |
|
|
coverage switchfrom Wi-Fi toanalternate 3G/4G radiothatprovides |
|
|
better networkaccess. |
|
|
|
|
wlanvoip-cac-profile |
The allow-idle-voip-client parameter is introduced. |
|
|
|
|
Deprecated Commands
ThefollowingcommandsaredeprecatedinArubaOS6.5.0.0:
Command |
Description |
apsystem-profile |
The shell-passwd parameter is deprecated. |
|
|
showapsystem-profile |
The Shell Password parameter is deprecatedfrom the outputof this |
|
command. |
|
|
ThisguidedescribestheDellNetworkingW-SeriesArubaOS6.5.xcommandsyntax. Thecommandsinthis guidearelistedalphabetically.
Thefollowinginformationisprovidedforeachcommand:
•CommandSyntax—Thecompletesyntaxof thecommand.
•Description—Abrief descriptionof thecommand.
•Syntax—Adescriptionof thecommandparameters,includinglicenserequirementsforspecificparameters if needed. Theapplicablerangesanddefault values,if any,arealsoincluded.
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 8 |
•UsageGuidelines—Informationtohelpyouusethecommand,including: prerequisites,prohibitions,and relatedcommands.
•Example—Anexampleof howtousethecommand.
•CommandHistory—Theversionof ArubaOSinwhichthecommandwasfirst introduced. Modificationsand changestothecommandarealsonoted.
•CommandInformation—Thistabledescribesany licensingrequirements,commandmodesandplatforms forwhichthiscommandisapplicable. Formoreinformationabout availablelicenses,seetheLicenses chapterof theDellNetworking W-Series ArubaOS 6.5.xUserGuide.
Thissectiondescribeshowtoconnect tothecontrollertousetheCLI.
Serial Port Connection
Theserialport islocatedonthefront panelof thecontroller. Connect aterminalorPC/workstationrunninga terminalemulationprogramtotheserialport onthecontrollertousetheCLI. Configureyourterminalor terminalemulationprogramtousethefollowingcommunicationsettings.
Baud Rate |
Data Bits |
Parity |
Stop Bits |
Flow Control |
9600 |
8 |
None |
1 |
None |
|
|
|
|
|
The Dell W-7200 Series controller supports baudrates between9600 and115200.
Telnet or SSH Connection
Telnet orSSH accessrequiresthat youconfigureanIPaddressandadefault gateway onthecontrollerand connect thecontrollertoyournetwork. Thisistypically performedwhenyouruntheInitialSetuponthe controller,asdescribedintheDellNetworking W-Series ArubaOS 6.5.xQuick StartGuide. Incertaindeployments, youcanalsoconfigurealoopbackaddressforthecontroller; seeinterfaceloopbackonpage458 formore information.
Configuration changes on Master Controllers
Somecommandscanonly beissuedwhenconnectedtoamastercontroller. If youmakeaconfiguration changeonamastercontroller,allconnectedlocalcontrollerswillsubsequently updatetheirconfigurationsas well. Youcanmanually synchronizeallof thecontrollersat any timeby savingtheconfigurationonthemaster controller.
Whenyouconnect tothecontrollerusingtheCLI,thesystemdisplaysitshost namefollowedby thelogin prompt. Loginusingtheadminuseraccount andthepasswordyouenteredduringtheInitialSetuponthe controller(thepassworddisplaysasasterisks). Forexample:
(host) User: admin
Password: *****
Whenyouareloggedin,theusermodeCLI prompt displays. Forexample:
9| The ArubaOS Command-Line Interface |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
(host) >
Usermodeprovidesonly limitedaccessforbasicoperationaltestingsuchasrunningping and traceroute.
Certainmanagement functionsareavailableinenable(alsocalled“privileged”)mode. Tomovefromusermode toenablemoderequiresyoutoenteranadditionalpasswordthat youenteredduringtheInitialSetup(the passworddisplaysasasterisks). Forexample:
(host) > enable Password: ******
Whenyouareinenablemode,the> prompt changestoapoundsign(#):
(host) #
Configurationcommandsareavailablein config mode. Movefromenablemodetoconfigmodeby entering configure terminal at the# prompt:
(host) # configure terminal
Enter Configuration commands, one per line. End with CNTL/Z
Whenyouareinbasicconfigmode,(config)appearsbeforethe# prompt:
(host) (config) #
There are several other subcommandmodes thatallowusers toconfigure individual interfaces, subinterfaces, loopbackaddresses, GRE tunnels andcellular profiles. For details onthe prompts andthe available commands for eachof these modes, see AppendixA:CommandModes onpage 2389.
Command Help
Youcanusethequestionmark(?)toviewvarioustypesof commandhelp.
Whentypedat thebeginningof aline,thequestionmarklistsallthecommandsavailableinyourcurrent mode orsub-mode. Abrief explanationfollowseachcommand. Forexample:
(host) > ?
enable |
Turn on Privileged commands |
logout |
Exit this session. Any unsaved changes are lost. |
ping |
Send ICMP echo packets to a specified IP address. |
traceroute |
Trace route to specified IP address. |
Whentypedat theendof apossiblecommandorabbreviation,thequestionmarkliststhecommandsthat match(if any). Forexample:
(host) > c?
clear |
Clear configuration |
clock |
Configure the system clock |
configure |
Configuration Commands |
copy |
Copy Files |
If morethanoneitemisshown,typemoreof thekeywordcharacterstodistinguishyourchoice. However,if only oneitemislisted,thekeywordorabbreviationisvalidandyoucanpresstaborthespacebartoadvance tothenext keyword.
Whentypedinplaceof aparameter,thequestionmarkliststheavailableoptions. Forexample:
(host) # write ? |
Erase and start from scratch |
erase |
|
file |
Write to a file in the file system |
memory |
Write to memory |
terminal |
Write to terminal |
<cr> |
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 10 |
The<cr> indicatesthat thecommandcanbeenteredwithout additionalparameters. Any otherparametersare optional.
Command Completion
Tomakecommandinput easier,youcanusually abbreviateeachkey wordinthecommand. Youneedtype only enoughof eachkeywordtodistinguishit fromsimilarcommands. Forexample:
(host) # configure terminal
couldalsobeenteredas:
(host) # con t
Threecharacters(con)represent theshortest abbreviationallowedforconfigure. Typingonly c orcowould not workbecausethereareothercommands(likecopy)whichalsobeginwiththoseletters. Theconfigure commandistheonly onethat beginswith con.
Asyoutype,youcanpressthespacebarortabtomovetothenext keyword. Thesystemthenattemptsto expandtheabbreviationforyou. If thereisonly onecommandkeywordthat matchestheabbreviation,it is filledinforyouautomatically. If theabbreviationistoovague(toofewcharacters),thecursordoesnot advanceandyoumust typemorecharactersorusethehelpfeaturetolist thematchingcommands.
Deleting Configuration Settings
Usethenocommandtodeleteornegatepreviously-enteredconfigurationsorparameters.
•Toviewalist of nocommands,typenoat theenableorconfigprompt followedby thequestionmark. For example:
(host) (config) # no?
•Todeleteaconfiguration,usethenoformof aconfigurationcommand. Forexample,thefollowing commandremovesaconfigureduserrole:
(host) (config) # no user-role <name>
•Tonegateaspecificconfiguredparameter,usethenoparameterwithinthecommand. Forexample,the followingcommandsdeletetheDSCPpriority mapforapriority mapconfiguration:
(host) (config) # priority-map <name>
(host) (config-priority-map) # no dscp priority high
EachDellcontrollercontainstwodifferent typesof configurationimages.
•Therunning-config holdsthecurrent controllerconfiguration,includingallpendingchangeswhichhaveyet tobesaved. Toviewtherunning-config,usethefollowingcommand:
(host) # show running-config
•Thestartup config holdstheconfigurationwhichwillbeusedthenext timethecontrollerisrebooted. It containsalltheoptionslast savedusingthewrite memory command. Toviewthestartup-config,usethe followingcommand:
(host) # show startup-config
WhenyoumakeconfigurationchangesviatheCLI,thosechangesaffect thecurrent runningconfiguration only. If thechangesarenot saved,they willbelost afterthecontrollerreboots. Tosaveyourconfiguration changessothey areretainedinthestartupconfigurationafterthecontrollerreboots,usethefollowing commandinenablemode:
(host) # write memory
Saving Configuration...
Saved Configuration
11| The ArubaOS Command-Line Interface |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Boththestartupandrunningconfigurationscanalsobesavedtoafileorsent toaTFTPserverforbackupor transfertoanothersystem.
Commands That Reset the Controller or AP
If youusetheCLI tomodify acurrently provisionedandrunningradioprofile,thosechangestakeplace immediately; youdonot reboot thecontrollerortheAPforthechangestoaffect thecurrent running configuration. Certaincommands,however,automatically forcethecontrollerorAPtoreboot. Youmay want toconsidercurrent networkloadsandconditionsbeforeissuingthesecommands,asthey may causea momentary disruptioninserviceastheunit resets. Notealsothat changingthelms-ipparameterinanAP systemprofileassociatedwithanAPgroupwillcauseallAPsinthat APgrouptoreboot.
Table 2: ResetCommands
Commands that Reset an AP
•ap-regroup
•ap-rename
•apboot
•provision-ap
•apwired-ap-profile <profile> forward-mode {bridge|splittunnel|tunnel}
•wlanvirtual-ap<profile-name> {aaa-profile <profilename> |forward-mode {tunnel|bridge|split- tunnel|decrypt-tunnel} |ssid-profile <profile-name>|vlan <vlan>...}
•apsystem-profile <profile> {bootstrap-threshold <number> |lms-ip<ipaddr> |}
•wlanssid-profile <profile-name> {battery-boost|deny- bcast|essid|opmode|strict-svp|wepkey1 <key> |wepkey2 <key>|wepkey3 <key>|wepkey4 <key>|weptxkey <index> |wmm |wmm-be-dscp<best- effort>|wmm-bk-dscp<background>|wmm-ts-min-inact- int<milliseconds>|wmm-vi-dscp<video>|wmm-vo-dscp <voice>|wpa-hexkey <psk> |wpa-passphrase <string> }
•wlandotllk<profile-name> {bcn-measurement- mode|dot11k-enable|force-dissasoc
Commands that Reset a Controller
•reload
Thefollowingconventionsareusedthroughout thismanualtoemphasizeimportant concepts:
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 12 |
Table 3: TextConventions
Type Style |
Description |
Italics |
This style is usedtoemphasize importantterms and |
|
tomarkthe titles of books. |
|
|
Boldface |
This style is usedtoemphasize commandnames |
|
andparameter options whenmentionedinthe text. |
|
|
Commands |
This fixed-widthfontdepicts commandsyntaxand |
|
examples of commands andcommandoutput. |
|
|
<angle brackets> |
Inthe commandsyntax, textwithinangle brackets |
|
represents items thatyoushouldreplace with |
|
informationappropriate toyour specific situation. |
|
For example: |
|
ping <ipaddr> |
|
Inthis example, youwouldtype “ping”atthe system |
|
promptexactly as shown, followedby the IPaddress |
|
of the system towhichICMPechopackets are tobe |
|
sent. Donottype the angle brackets. |
|
|
[square brackets] |
Inthe commandsyntax, items enclosedinbrackets |
|
are optional. Donottype the brackets. |
|
|
{Item_A|Item_B} |
Inthe commandexamples, single items within |
|
curledbraces andseparatedby a vertical bar |
|
representthe available choices. Enter only one |
|
choice. Donottype the braces or bars. |
|
|
{ap-name <ap-name>}|{ipaddr <ip-addr>} |
Twoitems withincurledbraces indicate thatboth |
|
parameters mustbe enteredtogether. If twoor |
|
more sets of curledbraces are separatedby a |
|
vertical bar, like inthe example tothe left, enter only |
|
one choice Donottype the braces or bars. |
|
|
Thesystemrecordsyourmost recently enteredcommands. Youcanreviewthehistory of youractions,or reissuearecent commandeasily,without havingtoretypeit.
Toviewitemsinthecommandhistory,usetheup arrowkey tomovebackthroughthelist andthedown arrow key tomoveforward. Toreissueaspecificcommand,pressEnter whenthecommandappearsinthe commandhistory. Youcanevenusethecommandlineeditingfeaturetomakechangestothecommandprior toenteringit. Thecommandlineeditingfeatureallowsyoutomakecorrectionsorchangestoacommand without retyping. Table1 liststheeditingcontrols. Tousekey shortcuts,pressandholdtheCtrl buttonwhile youpressaletterkey.
13| The ArubaOS Command-Line Interface |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Table 4: LineEditing Keys
Key |
Effect |
Description |
Ctrl A |
Home |
Move the cursor tothe beginning of the line. |
|
|
|
Ctrl B or the |
Back |
Move the cursor one character left. |
leftarrow |
|
|
|
|
|
Ctrl D |
Delete Right |
Delete the character tothe rightof the cursor. |
|
|
|
Ctrl E |
End |
Move the cursor tothe endof the line. |
|
|
|
Ctrl F or the |
Forward |
Move the cursor one character right. |
rightarrow |
|
|
|
|
|
Ctrl K |
Delete Right |
Delete all characters tothe rightof the cursor. |
|
|
|
Ctrl N or the |
Next |
Display the nextcommandinthe command |
downarrow |
|
history. |
|
|
|
Ctrl P or |
Previous |
Display the previous commandinthe |
uparrow |
|
commandhistory. |
|
|
|
Ctrl T |
Transpose |
Swapthe character tothe leftof the cursor |
|
|
withthe character tothe rightof the cursor. |
|
|
|
Ctrl U |
Clear |
Clear the line. |
|
|
|
Ctrl W |
Delete Word |
Delete the characters from the cursor upto |
|
|
andincluding the firstspace encountered. |
|
|
|
Ctrl X |
Delete Left |
Delete all characters tothe leftof the cursor. |
|
|
|
Thissectiondescribesaddressesandotheridentifiersthat youcanreferenceinCLI commands.
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 14 |
Table 5: Addresses and Identifiers
Address/Identifier |
Description |
IPaddress |
For any commandthatrequires entry of anIPaddress tospecify a network |
|
entity, use IPv4 networkaddress formatinthe conventional dotteddecimal |
|
notation(for example, 10.4.1.258). |
|
|
Netmaskaddress |
For subnetaddresses, specify a netmaskindotteddecimal notation(for |
|
example, 255.255.255.0). |
|
|
Media Access |
For any commandthatrequires entry of a device’s hardware address, use the |
Control (MAC) |
hexadecimal format(for example, 00:05:4e:50:14:aa). |
address |
|
|
|
Service SetIdentifier |
A unique character string (sometimes referredtoas a networkname), |
(SSID) |
consisting of nomore than32 characters. The SSID is case-sensitive (for |
|
example, WLAN-01). |
|
|
Basic Service Set |
This entry is the unique hard-wireless MAC address of the AP. A unique BSSID |
Identifier (BSSID) |
applies toeachfrequency— 802.11a and802.11g—usedfrom the AP. Use the |
|
same formatas for a MAC address. |
|
|
ExtendedService |
Typically the unique logical name of a wireless network. If the ESSID includes |
SetIdentifier (ESSID) |
spaces, youmustenclose the name inquotationmarks. |
|
|
FastEthernetor |
Any commandthatreferences a FastEthernetor GigabitEthernetinterface |
GigabitEthernet |
requires thatyouspecify the corresponding portonthe controller inthe |
interface |
format<slot>/<module>/<port>. |
|
Use the show port status commandtoobtainthe interface information |
|
currently available from a controller. |
|
|
15| The ArubaOS Command-Line Interface |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Table 6: ContactInformation
Web Site Support
MainWebsite dell.com
ContactInformation dell.com/contactdell
SupportWebsite dell.com/support
DocumentationWebsite dell.com/support/manuals
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
The ArubaOS Command-Line Interface | 16 |
aaa auth-survivability cache-lifetime enable
server-cert
Description
ThiscommandconfiguresAuthenticationSurvivability ona controller.
Syntax
Parameter |
Description |
Default |
cache-lifetime <hrs> |
This parameter specifies the lifetime inhours for the |
24 hours |
|
cachedaccess credential inthe local Survival Server. When |
|
|
the specifiedcache-lifetime expires, the cachedaccess |
|
|
credential is deletedfrom the controller. |
|
|
The validrange is from 1 to72 hours. |
|
|
|
|
enable |
This parameter controls whether touse the Survival Server |
Disabled |
|
whennoother servers inthe server groupare in-service. |
|
|
This parameter alsocontrols whether tostore the user |
|
|
access credential inthe Survival Server whenitis |
|
|
authenticatedby anexternal RADIUS or LDAPserver inthe |
|
|
server group. AuthenticationSurvivability is enabledor |
|
|
disabledoneachcontroller. |
|
|
NOTE: Authenticationsurvivability will notactivate if the |
|
|
AuthenticationServer DeadTime is configuredas 0 |
|
|
|
|
server-cert |
This parameter allows youtoviewthe name of the server |
— |
|
certificate usedby the local Survival Server. The local |
|
|
Survival Server is providedwitha defaultserver certificate |
|
|
from AOS. The customer server certificate mustbe |
|
|
importedintothe controller first, andthenyoucanassign |
|
|
the server certificate tothe local Survival Server. |
|
|
NOTE: Inthe deploymentenvironment, itis recommended |
|
|
thatyouswitchtoa customer server certificate. |
|
|
|
|
Usage Guidelines
Usethiscommandtoconfigureauthenticationsurvivability onastandalone,local,ormastercontroller.
Toconfigureauthenticationsurvivability onabranchcontroller,youmust usetheSmart ConfigWebUI. Onthe branchcontroller,navigateto Configuration > BRANCH> Smart Config.
Command History
Version Description
ArubaOS 6.4.3.0 |
Commandintroduced. |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa auth-survivability | 17 |
Command Information
Platforms |
Licensing |
Command Mode |
W-7000 Series |
Base operating system |
Enable or Config mode oncontrollers |
|
|
|
18| aaa auth-survivability |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication captive-portal <profile> apple-cna-bypass
auth-protocol mschapv2|pap|chap black-list <black-list>
clone <source-profile> default-guest-role <role> default-role <role> enable-welcome-page guest-logon ip-addr-in-redirection <ipaddr> login-page <url>
logon-wait {cpu-threshold <percent>}|{maximum-delay <seconds>}|{minimum-delay <seconds>} logout-popup-window
max-authentication-failures <number> no ...
protocol-http redirect-pause <seconds> redirect-url <url> server-group <group-name> show-acceptable-use-policy show-fqdn
single-session switchip-in-redirection-url <ipaddr> url-hash-key <key> user-idle-timeout
user-logon user-vlan-in-redirection-url <vlan> welcome-page <url>
white-list <white-list>
Description
ThiscommandconfiguresaCaptivePortalauthenticationprofile.
Syntax
Parameter |
Description |
Range |
Default |
apple-cna-bypass |
Enable this knobtobypass Apple |
— |
|
|
CNA oniOS devices suchas iPad, |
|
|
|
iPhone, andiPod. Youneedto |
|
|
|
perform Captive Portal |
|
|
|
authenticationfrom browser. |
|
|
|
|
|
|
<profile> |
Name thatidentifies aninstance of |
— |
“default” |
|
the profile. The name mustbe 1-63 |
|
|
|
characters. |
|
|
|
|
|
|
authentication-protocol |
This parameter specifies the type |
mschap |
pap |
mschapv2|pap|chap |
of authenticationrequiredby this |
v2 |
|
|
profile, PAPis the default |
pap |
|
|
authenticationtype. |
|
|
|
|
|
|
|
|
chap |
|
|
|
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication captive-portal | 19 |
Parameter |
Description |
Range |
Default |
black-list |
Name of anexisting blacklistonan |
— |
— |
|
IPv4 or IPv6 networkdestination. |
|
|
|
The blacklistcontains websites |
|
|
|
(unauthenticated) thata guest |
|
|
|
cannotaccess. |
|
|
|
Specify a netdestinationhostor |
|
|
|
subnettoaddthatnetdestinationto |
|
|
|
the captive portal blacklist. |
|
|
|
If youhave notyetdefineda |
|
|
|
netdestination, use the CLI |
|
|
|
command netdestination todefine |
|
|
|
a destinationhostor subnetbefore |
|
|
|
youaddittothe blacklist. |
|
|
|
|
|
|
clone |
Name of anexisting Captive Portal |
— |
— |
|
profile from whichparameter |
|
|
|
values are copied. |
|
|
|
|
|
|
default-guest-role |
Role assignedtoguest. |
— |
guest |
|
|
|
|
default-role <role> |
Role assignedtothe Captive Portal |
— |
guest |
|
user whenthatuser logs in. When |
|
|
|
bothuser andguestlogons are |
|
|
|
enabled, the defaultrole applies to |
|
|
|
the user logon;users logging in |
|
|
|
using the guestinterface are |
|
|
|
assignedthe guestrole. |
|
|
|
|
|
|
enable-welcome- |
Displays the configuredwelcome |
enabled/ |
enabled |
page |
page before the user is redirected |
disabled |
|
|
totheir original URL. If this optionis |
|
|
|
disabled, redirectiontothe web |
|
|
|
URLhappens immediately after the |
|
|
|
user logs in. |
|
|
|
|
|
|
guest-logon |
Enables Captive Portal logon |
enabled/ |
disabled |
|
withoutauthentication. |
disabled |
|
|
|
|
|
ipaddr-in-redirection-url |
Sends the controller’s interface IP |
— |
— |
<ipaddr> |
address inthe redirectionURL |
|
|
|
whenexternal captive portal |
|
|
|
servers are used. Anexternal |
|
|
|
captive portal server can |
|
|
|
determine the controller from |
|
|
|
whicha requestoriginatedby |
|
|
|
parsing the ‘switchip’ variable inthe |
|
|
|
URL. This parameter requires the |
|
|
|
Public Access license. |
|
|
|
|
|
|
login-page <url> |
URLof the page thatappears for |
— |
/auth/index. |
|
the user logon. This canbe setto |
|
html |
|
any URL. |
|
|
|
|
|
|
20| aaa authentication captive-portal |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Parameter |
Description |
Range |
Default |
logon-wait |
Configure parameters for the logon |
1-100 |
60% |
|
waitinterval. |
|
|
|
|
|
|
cpu-threshold <percent> |
CPU utilizationpercentage above |
1-100 |
60% |
|
whichthe logonwaitinterval is |
|
|
|
appliedwhenpresenting the user |
|
|
|
withthe logonpage. |
|
|
|
|
|
|
maximum-delay <seconds> |
Maximum time, inseconds, the |
1-10 |
10 seconds |
|
user will have towaitfor the logon |
|
|
|
page topopupif the CPU loadis |
|
|
|
high. This works inconjunctionwith |
|
|
|
the LogonwaitCPU utilization |
|
|
|
thresholdparameter. |
|
|
|
|
|
|
minimum-delay <seconds> |
Minimum time, inseconds, the user |
1-10 |
5 seconds |
|
will have towaitfor the logonpage |
|
|
|
topopupif the CPU loadis high. |
|
|
|
This works inconjunctionwiththe |
|
|
|
LogonwaitCPU utilization |
|
|
|
thresholdparameter. |
|
|
|
|
|
|
logout-popup- |
Enables a pop-upwindowwiththe |
enabled/ |
enabled |
window |
Logoutlinkthatallows the user to |
disabled |
|
|
log out. If this optionis disabled, the |
|
|
|
user remains loggedinuntil the |
|
|
|
user timeoutperiodhas elapsedor |
|
|
|
the stationreloads. |
|
|
|
|
|
|
max-authentication-failures |
Maximum number of |
0-10 |
0 |
<number> |
authenticationfailures before the |
|
|
|
user is blacklisted. |
|
|
|
|
|
|
no |
Negates any configured |
— |
— |
|
parameter. |
|
|
|
|
|
|
protocol-http |
Use HTTPprotocol onredirection |
enabled/ |
disabled |
|
tothe Captive Portal page. If you |
disabled |
(HTTPS is used) |
|
use this option, modify the captive |
|
|
|
portal policy toallowHTTPtraffic. |
|
|
|
|
|
|
redirect-pause <secs> |
Time, inseconds, thatthe system |
1-60 |
10 seconds |
|
remains inthe initial welcome page |
|
|
|
before redirecting the user tothe |
|
|
|
final webURL. If setto0, the |
|
|
|
welcome page displays until the |
|
|
|
user clicks onthe indicatedlink. |
|
|
|
|
|
|
redirect-url <url> |
URLtowhichanauthenticateduser |
— |
— |
|
will be directed. This parameter |
|
|
|
mustbe anabsolute URLthat |
|
|
|
begins witheither http:// or |
|
|
|
https://. |
|
|
|
|
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication captive-portal | 21 |
Parameter |
Description |
Range |
Default |
server-group <group-name> |
Name of the groupof servers used |
— |
— |
|
toauthenticate Captive Portal |
|
|
|
users. See aaa server-groupon |
|
|
|
page 107. |
|
|
|
|
|
|
show-fqdn |
Allows the user tosee andselect |
enabled |
disabled |
|
the fully-qualifieddomainname |
disabled |
|
|
(FQDN) onthe loginpage. The |
|
|
|
FQDNs shownare specifiedwhen |
|
|
|
configuring individual servers for |
|
|
|
the server groupusedwithcaptive |
|
|
|
portal authentication. |
|
|
|
|
|
|
show-acceptable-use-policy |
Showthe acceptable use policy |
enabled |
disabled |
|
page before the loginpage. |
disabled |
|
|
|
|
|
single-session |
Allows only one active user session |
— |
disabled |
|
ata time. |
|
|
|
|
|
|
switchip-in-redirection-url |
Sends the controller’s IPaddress in |
enabled |
disabled |
|
the redirectionURLwhenexternal |
disabled |
|
|
captive portal servers are used. An |
|
|
|
external captive portal server can |
|
|
|
determine the controller from |
|
|
|
whicha requestoriginatedby |
|
|
|
parsing the ‘switchip’ variable inthe |
|
|
|
URL. |
|
|
|
|
|
|
url-hash-key <key> |
Issue this commandtohashthe |
— |
disabled |
|
redirectionURLusing the specified |
|
|
|
key. |
|
|
|
|
|
|
user-idle-timeout |
The user idle timeoutfor this |
— |
disabled |
|
profile. Specify the idle timeout |
|
|
|
value for the clientinseconds. Valid |
|
|
|
range is 30-15300 inmultiples of |
|
|
|
30 seconds. Enabling this option |
|
|
|
overrides the global settings |
|
|
|
configuredinthe AAA timers. If this |
|
|
|
is disabled, the global settings are |
|
|
|
used. |
|
|
|
|
|
|
user-logon |
Enables Captive Portal with |
enabled |
enabled |
|
authenticationof user credentials. |
disabled |
|
|
|
|
|
user-vlan-in-redirection-url |
Addthe user VLAN inthe |
enabled |
disabled |
<ipaddr> |
redirectionURL. This parameter |
disabled |
|
|
requires the Public Access license. |
|
|
|
|
|
|
|
|
|
|
user-vlan-redirection-url |
Sends the user’s VLAN ID inthe |
— |
— |
|
redirectionURLwhenexternal |
|
|
|
captive portal servers are used. |
|
|
|
|
|
|
22| aaa authentication captive-portal |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Parameter |
Description |
Range |
Default |
welcome-page <url> |
URLof the page thatappears after |
— |
/auth/welcome |
|
logonandbefore redirectiontothe |
|
.html |
|
webURL. This canbe settoany |
|
|
|
URL. |
|
|
|
|
|
|
white-list <white-list> |
Name of anexisting white listonan |
— |
— |
|
IPv4 or IPv6 networkdestination. |
|
|
|
The white listcontains |
|
|
|
authenticatedwebsites thata guest |
|
|
|
canaccess. If youhave notyet |
|
|
|
defineda netdestination, use the |
|
|
|
CLIcommand netdestination to |
|
|
|
define a destinationhostor subnet |
|
|
|
before youaddittothe whitelist. |
|
|
|
|
|
|
Usage Guidelines
YoucanconfiguretheCaptivePortalauthenticationprofileinthebaseoperatingsystemorwiththeNext GenerationPolicy Enforcement Firewall(PEFNG)licenseinstalled. Whenyouconfiguretheprofileinthebase operatingsystem,thenameof theprofilemust beenteredfortheinitialroleintheAAAprofile. Also,whenyou configuretheprofileinthebaseoperatingsystem,youcannot definethedefault-role.
Example
ThefollowingexampleconfiguresaCaptivePortalauthenticationprofilethat authenticatesusersagainst the controller’sinternaldatabase. Userswhoaresuccessfully authenticatedareassignedtheauth-guest role.
Tocreatetheauth-guest userroleshowninthisexample,thePEFNG licensemust beinstalledinthecontroller.
aaa authentication captive-portal guestnet default-role auth-guest
user-logon
no guest-logon server-group internal
Command History
Version |
Description |
ArubaOS 3.0 |
Commandintroduced. |
|
|
ArubaOS 6.0 |
The max-authentication-failures parameter nolonger requires a |
|
license. |
|
|
ArubaOS 6.1 |
The sygate-on-demand, black-list and white-list parameters were |
|
added. |
|
|
ArubaOS 6.2 |
the auth-protocol parameter was added, andthe user-chap parameter |
|
was deprecated. |
|
|
ArubaOS 6.3 |
The user-idle-timeout parameter was introduced. |
|
|
ArubaOS 6.4 |
The url-hash-key parameter was introduced. |
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication captive-portal | 23 |
Command Information
Platforms |
Licensing |
Command Mode |
All platforms |
Base operating system, except |
Config mode onmaster controllers |
|
for notedparameters |
|
|
|
|
24| aaa authentication captive-portal |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication dot1x {<profile>|countermeasures} ca-cert <certificate>
cert-cn-lookup clear
clone <profile> delete-keycache eapol-logoff enforce-suite-b-128 enforce-suite-b-192 framed-mtu <mtu>
heldstate-bypass-counter <number> ignore-eap-id-match ignore-eapolstart-afterauthentication
machine-authentication blacklist-on-failure|{cache-timeout <hours>}|enable| {machine-default-role <role>}|{user-default-role <role>}
max-authentication-failures <number> max-requests <number> multicast-keyrotation
no ...
opp-key-caching reauth-max <number>
reauth-server-termination-action reauthentication
server {server-retry <number>|server-retry-period <seconds>} server-cert <certificate>
termination {eap-type <type>}|enable|enable-token-caching|{inner-eap-type (eapgtc|eap- mschapv2)}|{token-caching-period <hours>}
timer {idrequest_period <seconds>}|{keycache-tmout <kc-tmout>}|{mkey-rotation-period <seconds>}|{quiet-period <seconds>}|{reauth-period <seconds>}|{ukey-rotation-period <seconds>}|{wpa- groupkey-delay <seconds>}|{wpa-key-period <milliseconds>}|wpa2-key-delay <milliseconds>
tls-guest-access tls-guest-role <role> unicast-keyrotation use-session-key use-static-key validate-pmkid voice-aware wep-key-retries <number> wep-key-size {40|128} wpa-fast-handover wpa-key-retries <number> xSec-mtu <mtu>
Description
Thiscommandconfiguresthe802.1X authenticationprofile.
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication dot1x | 25 |
Syntax
Parameter |
Description |
Range |
Default |
<profile> |
Name thatidentifies an |
— |
“default” |
|
instance of the profile. The |
|
|
|
name mustbe 1-63 |
|
|
|
characters. |
|
|
|
|
|
|
clear |
Clear the CachedPMK, Role |
— |
— |
|
andVLAN entries. This |
|
|
|
commandis available in |
|
|
|
enable mode only. |
|
|
|
|
|
|
countermeasures |
Scans for message integrity |
— |
disabled |
|
code (MIC) failures intraffic |
|
|
|
receivedfrom clients. If there |
|
|
|
are more than2 MIC failures |
|
|
|
within60 seconds, the APis |
|
|
|
shutdownfor 60 seconds. |
|
|
|
This optionis intendedtoslow |
|
|
|
downanattacker whois |
|
|
|
making a large number of |
|
|
|
forgery attempts ina short |
|
|
|
time. |
|
|
|
|
|
|
ca-cert <certificate> |
CA certificate for client |
— |
— |
|
authentication. The CA |
|
|
|
certificate needs tobe loaded |
|
|
|
inthe controller. |
|
|
|
|
|
|
cert-cn-lookup |
If youuse clientcertificates |
— |
— |
|
for user authentication, |
|
|
|
enable this optiontoverify |
|
|
|
thatthe certificate's common |
|
|
|
name exists inthe server. |
|
|
|
This parameter is disabledby |
|
|
|
default. |
|
|
|
|
|
|
delete-keycache |
Delete the key cache entry |
— |
disabled |
|
whenthe user entry is deleted. |
|
|
|
|
|
|
eapol-logoff |
Enables handling of EAPOL- |
— |
disabled |
|
LOGOFFmessages. |
|
|
|
|
|
|
enforce-suite-b-128 |
Configure Suite-B 128 bitor |
|
disabled |
|
more security level |
|
|
|
authenticationenforcement |
|
|
|
|
|
|
enforce-suite-b-192 |
Configure Suite-B 192 bitor |
|
disabled |
|
more security level |
|
|
|
authenticationenforcement |
|
|
|
|
|
|
26| aaa authentication dot1x |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Parameter |
Description |
Range |
Default |
framed-mtu <MTU> |
Sets the framedMTU |
500- |
1100 |
|
attribute senttothe |
1500 |
|
|
authenticationserver. |
|
|
|
|
|
|
heldstate-bypass-counter <number> |
(This parameter is applicable |
0-3 |
0 |
|
when802.1X authenticationis |
|
|
|
terminatedonthe controller, |
|
|
|
alsoknownas AAA |
|
|
|
FastConnect.) Number of |
|
|
|
consecutive authentication |
|
|
|
failures which, whenreached, |
|
|
|
causes the controller tonot |
|
|
|
respondtoauthentication |
|
|
|
requests from a clientwhile |
|
|
|
the controller is ina heldstate |
|
|
|
after the authentication |
|
|
|
failure. Until this number is |
|
|
|
reached, the controller |
|
|
|
responds toauthentication |
|
|
|
requests from the clienteven |
|
|
|
while the controller is inits |
|
|
|
heldstate. |
|
|
|
|
|
|
ignore-eap-id- |
Ignore EAPID during |
— |
disabled |
match |
negotiation. |
|
|
|
|
|
|
ignore-eapol |
Ignores EAPOL-START |
— |
disabled |
start-afterauthentication |
messages after |
|
|
|
authentication. |
|
|
|
|
|
|
machine-authentication |
(For Windows environments |
|
|
|
only) These parameters set |
|
|
|
machine authentication: |
|
|
|
NOTE:This parameter |
|
|
|
requires the PEFNG license. |
|
|
|
|
|
|
blacklist-on-failure |
Blacklists the clientif machine |
— |
disabled |
|
authenticationfails. |
|
|
|
|
|
|
cache-timeout <hours> |
The timeout, inhours, for |
1-1000 |
24 hours |
|
machine authentication. |
|
(1 day) |
|
|
|
|
enable |
Selectthis optiontoenforce |
— |
disabled |
|
machine authentication |
|
|
|
before user authentication. If |
|
|
|
selected, either the machine- |
|
|
|
default-role or the user- |
|
|
|
default-role is assignedtothe |
|
|
|
user, depending onwhich |
|
|
|
authenticationis successful. |
|
|
|
|
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication dot1x | 27 |
Parameter |
Description |
Range |
Default |
machine-default-role <role> |
Defaultrole assignedtothe |
— |
guest |
|
user after completing only |
|
|
|
machine authentication. |
|
|
|
|
|
|
user-default-role <role> |
Defaultrole assignedtothe |
— |
guest |
|
user after 802.1X |
|
|
|
authentication. |
|
|
|
|
|
|
max-authentication-failures <number> |
Number of times a user can |
0-5 |
0 |
|
try tologinwithwrong |
|
(disable |
|
credentials after whichthe |
|
d) |
|
user is blacklistedas a |
|
|
|
security threat. Setto0 to |
|
|
|
disable blacklisting, otherwise |
|
|
|
enter a non-zerointeger to |
|
|
|
blacklistthe user after the |
|
|
|
specifiednumber of failures. |
|
|
|
|
|
|
max-requests <number> |
Maximum number of times ID |
1-10 |
5 |
|
requests are senttothe |
|
|
|
client. |
|
|
|
|
|
|
multicast-key |
Enables multicastkey rotation |
— |
disabled |
rotation |
|
|
|
|
|
|
|
no |
Negates any configured |
— |
— |
|
parameter. |
|
|
|
|
|
|
opp-key-caching |
Enables a cachedpairwise |
— |
enabled |
|
master key (PMK) derived |
|
|
|
witha clientandan |
|
|
|
associatedAPtobe used |
|
|
|
whenthe clientroams toa |
|
|
|
newAP. This allows clients |
|
|
|
faster roaming withouta full |
|
|
|
802.1X authentication. |
|
|
|
NOTE:Make sure thatthe |
|
|
|
wireless client(the 802.1X |
|
|
|
supplicant) supports this |
|
|
|
feature. If the clientdoes not |
|
|
|
supportthis feature, the client |
|
|
|
will attempttorenegotiate the |
|
|
|
key whenever itroams toa |
|
|
|
newAP. As a result, the key |
|
|
|
cachedonthe controller can |
|
|
|
be outof sync withthe key |
|
|
|
usedby the client. |
|
|
|
|
|
|
reauth-max <number> |
Maximum number of |
1-10 |
3 |
|
reauthenticationattempts. |
|
|
|
|
|
|
reauth-server-termination-action |
Specifies the termination- |
|
|
|
actionattribute from the |
|
|
|
server. |
|
|
|
|
|
|
28| aaa authentication dot1x |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
Parameter |
Description |
Range |
Default |
reauthentication |
Selectthis optiontoforce the |
— |
disabled |
|
clienttodoa 802.1X |
|
|
|
reauthenticationafter the |
|
|
|
expirationof the defaulttimer |
|
|
|
for reauthentication. (The |
|
|
|
defaultvalue of the timer is |
|
|
|
24 hours.) If the user fails to |
|
|
|
reauthenticate withvalid |
|
|
|
credentials, the state of the |
|
|
|
user is cleared. |
|
|
|
If derivationrules are usedto |
|
|
|
classify 802.1X-authenticated |
|
|
|
users, thenthe |
|
|
|
reauthenticationtimer per |
|
|
|
role overrides this setting. |
|
|
|
|
|
|
reload-cert |
ReloadCertificate for 802.1X |
— |
— |
|
termination. This commandis |
|
|
|
available inenable mode only. |
|
|
|
|
|
|
server |
Sets options for sending |
|
|
|
authenticationrequests tothe |
|
|
|
authenticationserver group. |
|
|
|
|
|
|
server-retry <number> |
Maximum number of |
0-3 |
3 |
|
authenticationrequests that |
|
|
|
are senttoserver group. |
|
|
|
|
|
|
server-retry-period <seconds> |
Server groupretry interval, in |
5-65535 |
5 |
|
seconds. |
|
seconds |
|
|
|
|
server-cert <certificate> |
Server certificate usedby the |
— |
— |
|
controller toauthenticate |
|
|
|
itself tothe client. |
|
|
|
|
|
|
termination |
Sets options for terminating |
|
|
|
802.1X authenticationonthe |
|
|
|
controller. |
|
|
|
|
|
|
eap-type <type> |
The Extensible Authentication |
eap- |
eap- |
|
Protocol (EAP) method, either |
peap/ |
peap |
|
EAP-PEAPor EAP-TLS. |
eap-tls |
|
|
|
|
|
enable |
Enables 802.1X termination |
— |
disabled |
|
onthe controller. |
|
|
|
|
|
|
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |
aaa authentication dot1x | 29 |
Parameter |
Description |
Range |
Default |
enable-token |
If youselectEAP-GTC as the |
— |
disabled |
-caching |
inner EAPmethod, youcan |
|
|
|
enable the controller tocache |
|
|
|
the username andpassword |
|
|
|
of eachauthenticateduser. |
|
|
|
The controller continues to |
|
|
|
reauthenticate users withthe |
|
|
|
remote authenticationserver, |
|
|
|
however, if the authentication |
|
|
|
server is notavailable, the |
|
|
|
controller will inspectits |
|
|
|
cachedcredentials to |
|
|
|
reauthenticate users. |
|
|
|
|
|
|
inner-eap-type eap-gtc|eap-mschapv2 |
WhenEAP-PEAPis the EAP |
eap- |
eap- |
|
method, one of the following |
gtc/eap- |
mschap |
|
inner EAPtypes is used: |
mschap |
v2 |
|
EAP-Generic Token Card |
v2 |
|
|
|
|
|
|
(GTC):DescribedinRFC 2284, |
|
|
|
this EAPmethodpermits the |
|
|
|
transfer of unencrypted |
|
|
|
usernames andpasswords |
|
|
|
from clienttoserver. The |
|
|
|
mainuses for EAP-GTC are |
|
|
|
one-time tokencards suchas |
|
|
|
SecureID andthe use of LDAP |
|
|
|
or RADIUS as the user |
|
|
|
authenticationserver. You |
|
|
|
canalsoenable caching of |
|
|
|
user credentials onthe |
|
|
|
controller as a backuptoan |
|
|
|
external authentication |
|
|
|
server. |
|
|
|
EAP-Microsoft Challenge |
|
|
|
Authentication Protocol |
|
|
|
version 2 (MS-CHAPv2): |
|
|
|
DescribedinRFC 2759, this |
|
|
|
EAPmethodis widely |
|
|
|
supportedby Microsoft |
|
|
|
clients. |
|
|
|
|
|
|
token-caching-period <hours> |
If youselectEAP-GTC as the |
(any) |
24 hours |
|
inner EAPmethod, youcan |
|
|
|
specify the timeoutperiod, in |
|
|
|
hours, for the cached |
|
|
|
information. |
|
|
|
|
|
|
timer |
Sets timer options for 802.1X |
|
|
|
authentication: |
|
|
|
|
|
|
idrequest- |
Interval, inseconds, between |
1-65535 |
5 |
period <seconds> |
identity requestretries. |
|
seconds |
|
|
|
|
30| aaa authentication dot1x |
Dell Networking W-Series ArubaOS 6.5.x | Reference Guide |