This article covers a very specific case when you are importing a certificate and private key pair where the private key does not have a password. It does not explain the certificate types or use cases, certificate and key-file file formats or detail the intricacies of PKI. ClearPass requires certificates in order to operate securely (encrypt/decrypt traffic) and identify itself during RADIUS transactions. The most common certificates you would import are RADIUS, HTTPS and RadSec. There are others but these all require a private key. ClearPass allows you to import the certificate and private key as two separate files (you can also import them as a combined file). It is quite common to receive a private key file that is not protected by a password, whether it be from a public certificate authority or an internal CA service. When you try to import this file pair into ClearPass while leaving the "Private Key Password" field blank you will receive an error: The error states that the Private Key Password must be specified. The problem is there isn't one to be entered, so it can be confusing how you may proceed.
You can get around this error by entering anything (I haven't exhaustively tested every possible entry) into the Private Key Password field. During my first attempt I used "null", which worked. Then I used "asdf" which also worked. A simple, single character entry also appeared to work fine.
Comments
When using phone numbers in ClearPass guest self-registration, the system elevates US and UK to the top of the country codes selector by default. This isn't always suitable so you may want to change the country codes that are promoted to the top to be more appropriate for your user base. Generally this will come up when you are building a Guest Self-Registration workflow - but it may be relevant for any page which shows a phone number field in a ClearPass form. It is possible to edit the settings of the most commonly used visitor_phone Base Field. This should result in an update across all Forms which use this Field. This can be done from the ClearPass Guest Configuration page.
It is possible to edit this field on a per form basis so that portals and pages can have differing preferred country codes. This may be appropriate for ClearPass deployments that cater to global or multi-national use-cases.
So you've just had a contractor install 173 Access Points! Congrats! But, they haven't taken note of which one is where, nor did you create a table to show them which specific unit belongs in which location. Bummer dude! The problem with not knowing where each AP is is that you can't make finer adjustments of the system and troubleshooting location specific issues can be a nightmare.
There's an app for this problem... Well, maybe an API... Aruba Access Points have a function where each Access Point can advertise it's hostname in the beacon. It's still a manual job to go around and find each one with a survey tool or something like Wi-Fi Explorer, but it makes it easier than searching BSSIDs! To enable this handy feature on an Instant AP (or cluster) you can use the Command Line Interface (CLI). Go to the specific WLAN context and use the "advertise-ap-name" command. config
If you're using Aruba Central then you can't adjust the AP config via CLI. So you can use the API! For this particular feature (as of the date this is published) there is no specifically targeted API. You can use the AP Configuration API called "Replace AP configuration". With this essentially you are replacing the entire CLI for the Group or Swarm within a group. You can retrieve the existing CLI using "Get AP configuration", make your adjustments to include "advertise-ap-name" in the appropriate locations (for one fo the SSID profiles in the configuration) and then push it back to the AP using "Replace AP configuration". The specific use of the API is outside of the context of this blog post! Now go find an installer who documents their work! Windows Netsh Commands
To see the SSIDs near the client netsh wlan show networks netsh wlan show networks interface=<NIC> netsh wlan show networks mode=bssid netsh wlan show networks mode=bssid >> c:\testfolder\wirelessclientdata.txt mode=bssid adds more details about each network Find an SSID with specific text in the name: netsh wlan show networks | find “Employee" or netsh wlan show networks | select-string <your-SSID-name> Show WLAN profiles configured in windows netsh wlan show profile Wireless LAN Driver Properties netsh wlan show driver
ArubaOS (AOS) is the wireless LAN operating system for Aruba Instant Access Points and Wireless Gateways / Controllers. In AOS 8 you can use the following commands on a Mobility Controller (or a managed device, managed by a Mobility Master) to help troubleshoot various problems you may face with Access Points or Wi-Fi stations/clients.
These commands will need to be used directly on the controller (not the Mobility Master). You can jump to the controller by using the command mdc from within the Mobility Master (MM) CLI. First jump to the controller node-level with cd </md/node-hierarchy-path> so you are operating within the context of a particular managed node (controller/gateway/managed device). I prefer and recommend using this method over opening a direct SSH session to the single controller.
Take a look at the ap-debug statistics for a particular Access Points (AP). Look for Heartbeats, Interface counters, ARP cache Interface info, AP uptime, Ethernet Duplex/Speed, LMS info.
Check for high number of reboots or bootstraps (when the GRE keep-alive is missed).
It might be worth checking the AP system Profile for the “Bootstrap Threshold”. The current default is 8. If it is not specified in the config then its 8.
If your clients experiences issues there are commands to target statistics and logs specific to a station.
Look for tx/rx frames and data (if its incrementing then that’s positive), dropped frames, success vs retry.
Within the AP you can look at radio stats also. Look for radio resets, tx power changes, channel changes, noise floor, data drops and CRC errors increasing…
ARM history for the AP:
Show clients associated to a particular AP:
|
WifiHaxWe build and optimise networks. Continuous learning is our secret to being good. Along the learning journey we will share things here... Archives
May 2024
Categories
All
|