ArubaOS-Switch — 2530 and 2930

Configuration example for preparing a factory-default HPE Aruba Networking switch running ArubaOS-Switch (formerly ProVision) so that it works with PrivateLAN. Register the switch in PrivateLAN with type ArubaOS.

This guide is written for ArubaOS-Switch 16 and checked on a 2530-8-PoE+ (JL070A) with YB.16.11.0018:

ArubaOS-Switch is not ArubaOS-CX. If your switch answers to show running-config with interface 1/1/1 blocks and vlan access lines, it is a CX model (6100, 6200, 6300) and belongs to type ArubaOS-CX instead: a different guide and a different CLI.

Everything in this guide is entered once, on a factory-default switch, before you add it to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

The appliance only accepts syslog, RADIUS and time (NTP) traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

1. Console access and host name

Connect to the console port at 9600 8N1, no flow control. The console finds the speed itself: after a start it shows Waiting for Speed Sense. Press <Enter> twice to continue.

A factory-default switch on software 16.11 or later then asks you to set the manager account before anything else (Configure the manager credentials). Give it the PrivateLAN account and its password here: that is the account of section 2, and this question cannot be skipped. Older software opens the console without a password.

configure
hostname "SW-FLOOR1-01"

ArubaOS-Switch writes names between double quotes; type them that way.

2. The PrivateLAN account

password manager user-name privatelan plaintext ExampleSwitchPassword
password operator user-name operator plaintext ExampleEnablePassword

This is the manager account: it logs in straight to the # prompt, which the PrivateLAN driver needs, and it is also the console's login. There is no enable step on ArubaOS-Switch. Leave the Enable password field empty when you register the switch.

The operator account needs a password as well. A switch with a manager password and no operator password lets anyone in as operator who presses Enter at the console's Username:, without any password. Give the operator its own password and keep it with the switch's other passwords.

The switch never shows the user names or the passwords again: show running-config has only the lines password manager and password operator. Setting a manager password also turns off the DHCP option that points the switch at a management server (no dhcp tr69-acs-url appears by itself).

erase startup-config does not remove the manager and operator passwords. Use no password all in configuration mode for that.

3. SSH

PrivateLAN connects over SSH only.

ip ssh
ip ssh timeout 60
no telnet-server

SSH is on by default, with a 2048-bit RSA host key that the switch made itself; show ip ssh shows both. Telnet is on by default as well and is turned off here.

You do not need to disable paging on the switch. The driver sends no page itself on every session.

4. VLANs and the management address

vlan 10
   name "MGMT"
   exit
vlan 20
   name "DATA"
   exit
vlan 10
   ip address 192.168.10.21 255.255.255.0
   exit
vlan 1
   no ip address
   exit
ip default-gateway 192.168.10.1

A factory-default switch asks DHCP for an address on VLAN 1 (ip address dhcp-bootp). That second address ends up on whatever network the uplink's untagged VLAN is, so it is removed here.

Entering the same VLAN context more than once, as this guide does per section, is fine: each vlan 10 adds to the same VLAN.

5. The uplink

On ArubaOS-Switch a VLAN carries its ports: there is no trunk mode on the port itself. Tag every VLAN the uplink has to carry on the uplink port:

interface 24
   name "UPLINK"
   exit
vlan 10
   tagged 24
   exit
vlan 20
   tagged 24
   exit

The port stays an untagged member of VLAN 1. LLDP is on by default; PrivateLAN reads the neighbour of the uplink with it.

6. Time and time zone

time timezone 60
time daylight-time-rule western-europe
timesync ntp
ntp unicast
ntp server 192.168.10.5 iburst
ntp enable

ArubaOS-Switch has no time zone names: the zone is the offset from UTC in minutes (60 for the Netherlands and Belgium, 0 for the United Kingdom) and a summer-time rule. western-europe switches on the last Sundays of March and October, as the EU does.

Point the switch at the appliance's own address: the appliance passes on the time from the time server under System > Networking. Always give an address, never a name.

7. Sending syslog to the appliance

logging 192.168.10.5
logging severity info

8. RADIUS and 802.1X

This is what makes MAB, PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

radius-server host 192.168.10.5 key "ExampleSharedSecret"
aaa authentication port-access eap-radius
aaa port-access authenticator active
aaa accounting network start-stop radius

ArubaOS-Switch shows the shared secret in plain text in show running-config and show radius. Treat a copy of the configuration as you would the secret itself.

The two aaa ... port-access lines enable 802.1X globally. PrivateLAN turns 802.1X and MAC authentication on per port when it programs a device onto it, from the templates under Devices > Device groups; you do not configure them on the ports yourself.

PrivateLAN stores a MAB device's RADIUS user name as the MAC address in twelve lowercase hexadecimal characters without separators (00155d5a6500). That is the ArubaOS-Switch default (aaa port-access mac-based addr-format no-delimiter); leave it.

9. Spanning tree

Spanning tree is off on a factory-default switch.

spanning-tree
spanning-tree config-name "PRIVATELAN"
spanning-tree config-revision 1
spanning-tree instance 1 vlan 10,20
spanning-tree bpdu-protection-timeout 300

The timeout brings a port that BPDU protection shut down back after five minutes; the default, 0, leaves it down until someone enables it. PrivateLAN turns BPDU protection on per device port.

ArubaOS-Switch runs MSTP. The region name, revision and VLAN map are the same as in the ArubaOS-CX guide, so the Aruba switches of one network form one region. Give your core switch the lowest priority, so that a new switch never becomes the root.

10. Third-party transceivers

allow-unsupported-transceiver

The switch asks Do you agree, and do you wish to continue enabling? (Y/N): answer y. Without it, a third-party SFP is not brought up.

11. Turning off the web interface and unused services

PrivateLAN manages the switch entirely over SSH. Nothing else needs to be reachable.

no web-management
no web-management ssl
no snmp-server community "public"
no stack
no tftp server
no dhcp config-file-update
no dhcp image-file-update

Software 16.11 and later start with Telnet and the web interface over HTTP already off, but with HTTPS on (web-management ssl) and the community public read-only; older software has HTTP on and public with write access. Either way the lines above turn them off. A factory-default switch also has the HP stacking protocol waiting to join a stack, a TFTP server, and DHCP options that load a configuration file or a software image from the network. All of them go. no stack is for the 2530 and the 2930's HP stacking, not for VSF.

If you use SNMP for anything else in your network, give it a v3 user rather than a community string. PrivateLAN itself does not use SNMP.

12. The console

console idle-timeout serial-usb 900

The console asks for the manager account of section 2. This logs an idle console session out after 15 minutes, so a cable left in a cabinet does not stay logged in.

13. Save and register in PrivateLAN

end
write memory

Then, in the appliance:

• Switches > Add: host name, management IP address 192.168.10.21, SSH port 22, type ArubaOS, user name privatelan and the switch password. Leave the enable password empty. Choose the switch group and enter the interface ranges in 1-24 form.
• 802.1x / RADIUS > Clients: add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Inspection > Compliance: run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

Complete example configuration

The whole configuration of this guide in one block, with the guide's values.

configure
hostname "SW-FLOOR1-01"
password manager user-name privatelan plaintext ExampleSwitchPassword
password operator user-name operator plaintext ExampleEnablePassword
ip ssh
ip ssh timeout 60
no telnet-server
vlan 10
   name "MGMT"
   exit
vlan 20
   name "DATA"
   exit
vlan 10
   ip address 192.168.10.21 255.255.255.0
   exit
vlan 1
   no ip address
   exit
ip default-gateway 192.168.10.1
interface 24
   name "UPLINK"
   exit
vlan 10
   tagged 24
   exit
vlan 20
   tagged 24
   exit
time timezone 60
time daylight-time-rule western-europe
timesync ntp
ntp unicast
ntp server 192.168.10.5 iburst
ntp enable
logging 192.168.10.5
logging severity info
radius-server host 192.168.10.5 key "ExampleSharedSecret"
aaa authentication port-access eap-radius
aaa port-access authenticator active
aaa accounting network start-stop radius
spanning-tree
spanning-tree config-name "PRIVATELAN"
spanning-tree config-revision 1
spanning-tree instance 1 vlan 10,20
spanning-tree bpdu-protection-timeout 300
allow-unsupported-transceiver
no web-management
no web-management ssl
no snmp-server community "public"
no stack
no tftp server
no dhcp config-file-update
no dhcp image-file-update
console idle-timeout serial-usb 900
end
write memory

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates