Aruba Instant 8.10.0.0 Release Notes

Copyright Information

© Copyright 2022 Hewlett Packard Enterprise Development LP.

Open Source Code

This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise Company. To obtain such source code, send a check or money order in the amount of US $10.00 to:

Hewlett Packard Enterprise Company
6280 America Center Drive
San Jose, CA 95002
USA

Revision History

The following table provides the revision history of this document.

Chapter 1: Release Overview

This Aruba Instant release notes includes the following topics:

• What's New
• Supported Hardware Platforms on page 12
• Regulatory Updates on page 14
• Resolved Issues on page 15
• Known Issues and Limitations on page 16
• Upgrading an Instant AP on page 18

For the list of terms, refer to the Glossary.

Related Documents

The following guides are part of the complete documentation for the Aruba user-centric network:

• Aruba AP Software Quick Start Guide
• Aruba Instant User Guide
• Aruba Instant CLI Reference Guide
• Aruba Instant REST API Guide
• Aruba Instant Syslog Messages Reference Guide
• Aruba Instant AP Troubleshooting Guide

Supported Browsers

The following browsers are officially supported for use with the Instant WebUI:

• Microsoft Internet Explorer 11 on Windows 7 and Windows 8
• Microsoft Edge (Microsoft Edge 38.14393.0.0 and Microsoft EdgeHTML 14.14393) on Windows 10
• Mozilla Firefox 48 or later on Windows 7, Windows 8, Windows 10, and macOS
• Apple Safari 8.0 or later on macOS
• Google Chrome 67 or later on Windows 7, Windows 8, Windows 10, and macOS

Chapter 6: Terminology Change

As part of advancing HPE's commitment to racial justice, Hewlett Packard Enterprise is taking a much-needed step in overhauling HPE engineering terminology to reflect its belief system of diversity and inclusion. Some legacy products and publications may continue to include terminology that seemingly evokes bias against specific groups of people. Such content is not representative of HPE culture and moving forward, Aruba will replace racially insensitive terms and instead use the following new language:

Contacting Support

Chapter 2: What's New

This chapter describes the features, enhancements, and behavioral changes introduced in this release.

New Features and Enhancements

Captive Portal

Dynamic Control of Ports 8080 and 8081

Starting from Aruba Instant 8.10.0.0, the ports 8080 and 8081 will be open or closed dynamically based on the AP configuration. Ports 8080 and 8081 are closed by default and will be opened only when the related features are configured. The show ap debug port-8080-status command is used to view the current status of ports 8080 and 8081.

Aruba Central

Enhancements for Aruba Central (on-premises) Connections

Instant APs can now automatically detect Aruba Central (on-premises) mode and route management traffic through the IAP-VPN tunnel. The status of Aruba Central (on-premises) mode is now added to the outputs of show debug cloud-server and show ap debug airwave commands.

Datapath / Firewall

New CLI parameter Added in the VPN Tunnel Profile Command

A new parameter called probe-ip is introduced in the vpn tunnel-profile command. This parameter allows an IP address or hostname to probe connections, when VIG is enabled.

IDS

Ghost Tunnel Attack Detection

The Intrusion Detection System in Instant APs can now detect ghost tunnel attacks and issue alerts. When enabled, Instant AP analyzes abnormal probe request behavior to detect attacks from the client side and analyzes abnormal beacon packets to detect attacks from the server side.

IoT

Configuring IoT Antenna Gain Value

A new CLI command iot-ant-gain is introduced to configure an antenna gain value for Instant APs with external antennas.

DRT support for BLE and 802.15.4 Introduced in New Access Points.

The output of the show ap debug received-reg-table command will now display the DRT information for BLE and 802.15.4 standard for 580 Series access points.

Enhancement to Tx Power Value for IoT BLE or Zigbee Radio Profile

The maximum configurable value of Tx power for BLE and Zigbee-based radio profiles is increased from -40 to 20.

SES-Imagotag and Wi-Fi Co-Existence Support for Wi-Fi 6 and Wi-Fi 6E Access Points

Aruba Instant now supports SES-Imagotag and Wi-Fi Co-existence for Wi-Fi 6 and Wi-Fi 6E access points.

SouthBound API Support for AP USB Dongle

A new show command show ap debug ble-session-status device-mac <mac_address> is added to display the current running Southbound API session status.

Support BSC Computer Version of the EnOcean USB Dongle

Instant now supports the BSC computer version of the EnOcean USB dongle.

Zone Configuration for IoT Transport Profile and Radio Profile

A new parameter called Zone is introduced in the IoT Transport profile and Radio profile configuration. When a zone is defined in the transport profile or radio profile and the same zone name is defined on an Instant AP, the transport profile or radio profile is created on that Instant AP. This allows different IoT transport or radio profiles to work in different zones. The iot-zone <zone_name> command is used to enable the IoT transport or radio profile zone on an Instant AP.

Platform

580 Series Access Points

The Aruba 580 Series access points (AP-584, AP-585, AP-585EX, AP-587, and AP-587EX) are high performance, dual-radio, outdoor access points that can be in either controller-based (ArubaOS) or controller-less (Aruba Instant) network environments. These APs deliver high performance concurrent 2.4 GHz and 5 GHz 802.11ax Wi-Fi functionality with MIMO radios (4x4 in 2.4 GHz and 5 GHz), while also supporting 802.11a, 802.11b, 802.11g, 802.11n, and 802.11ac wireless services.

Additional features include:

• Support for high power BLE.
• Support for 10G SFP+ (SX and LX) and 1G (SX and LX).
• Support for 1G PSE Out.
• Support for GPS.
• Support for AC power over new Molex connector kit.
• AP-584 access points with external antennas.
• AP-585 and AP-585EX access points with internal omni-directional antennas.
• AP-587 and AP-587EX access points with internal directional antennas.

For complete technical details and installation instructions, see Aruba 580 Series Access Points Installation Guide.

650 Series Access Points

The Aruba 650 Series access points (AP-655) are high performance, tri-radio, indoor access points that can be deployed in either controller-based (ArubaOS) or controller-less (Aruba Instant) network environments. These APs deliver high performance concurrent 2.4 GHz, 5 GHz, and 6 GHz 802.11ax Wi-Fi (Wi-Fi 6E) functionality with MIMO radios (4x4 in 2.4 GHz, 5 GHz, and 6 GHz), while also supporting 802.11a, 802.11b, 802.11g, 802.11n, and 802.11ac wireless services.

Additional features include:

• IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, and IEEE 802.11ax operation as a wireless access point.
• IEEE 802.11a, IEEE 802.11b, IEEE 802.11g, IEEE 802.11n, IEEE 802.11ac, and IEEE 802.11ax spectrum monitor.
• Two Ethernet ports, ENET0 and ENET1, each capable of data rates up to 5 Gbps.
• Compatible with IEEE 802.3bt, IEEE 802.3at, and IEEE 802.3af PoE standards on both Ethernet ports.
• Mesh
• Thermal management

For complete technical details and installation instructions, see Aruba 650 Series Access Points Installation Guide.

Automatic Opening and Closing of Ports Used by AP Services

Instant APs now automatically open and close the TCP/UDP ports used by various AP services. When an AP service is initialized, the AP opens the required TCP/UDP port and closes the port when the service operation is completed. This enhances the security of the AP by ensuring that the ports used by services remain closed when the services are inactive.

Enhancements to Intelligent Power Management and Intelligent Thermal Management

Additional reduction steps are introduced in the ipm command that allows you to reduce the power consumption and the operating temperature of the AP when IPM is enabled. The following are the reduction steps introduced in this release:

These reduction steps can be configured only using the CLI and are available in the ipm command. For more information on these parameters, see the Aruba Instant 8.x CLI Reference Guide.

New Command to View the List of Radio Mode Changes in the AP

A new command, show radio-mode-history, is introduced. This command displays the list of changes to the radio mode of the AP radios, allowing users to see the log of radio mode changes since the last AP boot.

Release Type Identifier

A new tag indicates the release type of the software version. This release type tag helps identify the maintenance schedule of the software version and can be viewed in the Instant webUI and the CLI. Aruba Instant releases are classified as either:

• Long Supported Release (LSR) - Long supported releases extend support for patches up to 5 years.
• Short Supported Release (SSR) - Short supported releases extend support for up to 2 years.

For more information, refer to Aruba Instant 8.10.0.x User Guide.

Support for Aruba USB LTE Modems

Aruba Instant supports the new Aruba USB LTE modem that connects the AP to the Internet through a 3G or 4G cellular connection. The USB modem supports plug and play provisioning, allowing the AP to connect to the Internet without any manual configuration.

Support for EAP with TLS 1.3

Aruba Instant 8.10.0.0 supports EAP with TLS 1.3 in data packet transmission between the supplicant and the RADIUS server. EAP with TLS 1.3 is not supported with the following AP functions in this release:

• Internal RADIUS server functions.
• EAP-Termination.
• Internal 802.1X authentication (AP1X).

Station Management

Advertise Wide Channel Bandwidth Information Element in Neighbor Report Responses

The wide channel bandwidth information element is included in the neighbor report responses by default, when the dot11k setting is enabled on the Instant AP as part of the dot11k-profile configuration. The disable-nb-resp_wide-band-ie parameter in the dot11k-profile command can be used to disable the setting when dot11k is enabled and stop the wide channel bandwidth information element from being included in the neighbor report responses.

Wi-Fi Driver

Enhancements to Hotspot 2.0 Profile

Instant APs now automatically send Chargeable User Identity attribute as defined by RFC 4372 and RADIUS location data as defined by RF 5580 to the RADIUS server for clients connecting to an Hotspot 2.0 profile. These attributes are enabled by default and can be turned off using the radius-cui-disable and radius-loc-disable parameters in the Hotspot profile using the hotspot hs-profile command. For more information on these parameters, see the Aruba Instant 8.x CLI Reference Guide.

Behavioral Changes

This section describes the changes that take effect on the Instant AP on upgrading to this release.

Authentication

Change in Key Exchange Method for SSH Communications

Starting from Aruba Instant 8.10.0.0, Instant APs no longer use DH key exchange for SSH communications. Instead, ECDH key exchange will be used for SSH communications.

Chapter 3: Supported Hardware Platforms

The following table displays the Instant AP platforms supported in Aruba Instant 8.10.0.x release.

Chapter 4: End-of-Support

This chapter provides information on the Aruba products that are not supported for a particular release. Aruba Instant 8.10.x.x is the last release that supports the following AP platforms:

• 203H Series
• 203R Series
• 207 Series
• 320 Series
• 330 Series
• 340 Series
• AP-387

Chapter 5: Regulatory Updates

This chapter contains the Downloadable Regulatory Table (DRT) file version introduced in this release. Periodic regulatory changes may require modifications to the list of channels supported by an AP. For a complete list of channels supported by an AP using a specific country domain, access the controller Command Line Interface (CLI) and execute the show ap allowed-channels country-code <country-code> ap-type <ap-model> command.

For a complete list of countries and the regulatory domains in which the APs are certified for operation, refer to the Downloadable Regulatory Table or the DRT Release Notes at asp.arubanetworks.com.

The following DRT file version is part of this release:

• DRT-1.0_83672

Chapter 6: Resolved Issues

The following issues are resolved in this release.

Chapter 7: Known Issues and Limitations

Limitations

This section describes the limitations in Aruba Instant 8.10.0.0.

AP-635 and AP-655 Access Points

AP-635 and AP-655 access points do not support Wi-Fi uplink on the 6 GHz radio channel.

AP Hostname Character Limit Extension

The number of ASCII characters allowed in the Instant AP hostname is increased from 32 to 128 characters. The following configuration settings do not support the new limit of 128 ASCII characters in Instant 8.8.0.0:

• The AP Name field in Role Derivation or VLAN Derivation.
• The AP Name field in beacon and probe response frames.
• The AP Name field in the show ap mesh link and ap mesh neighbor commands.

Dynamic Multicast Optimization Unsupported with VLAN Derivation

Aruba Instant does not support Dynamic Multicast Optimization when the SSID is configured with VLAN derivation.

Inbound Firewall

The apip-all configuration is not supported by the inbound-firewall command in Instant AP cluster deployments. It is only supported in standalone or single-AP modes of deployment.

Unified Communications Manager

UCM does not prioritize NAT traffic.

Known Issues

Following are the known issues observed in this release.

Chapter 8: Upgrading an Instant AP

This chapter describes the Instant software upgrade procedures and the different methods for upgrading the image on the Instant AP. While upgrading an Instant AP, you can use the image check feature to allow the Instant AP to find new software image versions available on a cloud-based image server hosted and maintained by Aruba. The location of the image server is fixed and cannot be changed by the user. The image server is loaded with the latest versions of the Instant software.

Topics in this chapter include:

• Upgrading an Instant AP and Image Server on page 18
• Upgrading an Instant AP Using the Automatic Image Check on page 20
• Upgrading to a New Version Manually Using the WebUI
• Upgrading an Instant AP Image Using CLI on page 22
• Upgrade from Instant 6.4.x.x-4.2.x.x to Instant 8.10.0.x on page 22

Upgrading an Instant AP and Image Server

Instant supports mixed Instant AP class Instant deployment with all Instant APs as part of the same virtual controller cluster.

Image Management Using AirWave

If the multi-class Instant AP network is managed by AirWave, image upgrades can only be done through the AirWave WebUI. The Instant AP images for different classes must be uploaded on the AMP server. If new Instant APs joining the network need to synchronize their software with the version running on the virtual controller, and if the new Instant AP belongs to a different class, the image file for the new Instant AP is provided by AirWave. If AirWave does not have the appropriate image file, the new Instant AP will not be able to join the network.

The virtual controller communicates with the AirWave server if AirWave is configured. If AirWave is not configured on the Instant AP, the image is requested from the Image server.

Image Management Using Cloud Server

If the multi-class Instant AP network is not managed by AirWave, image upgrades can be done through the Cloud-Based Image Check feature. If a new Instant AP joining the network needs to synchronize its software version with the version on the virtual controller and if the new Instant AP belongs to a different class, the image file for the new Instant AP is provided by the cloud server.

Configuring HTTP Proxy on an Instant AP

If your network requires a proxy server for Internet access, ensure that you configure the HTTP proxy on the Instant AP to download the image from the cloud server. The Username and Password configuration is supported only for cloud services. After setting up the HTTP proxy settings, the Instant AP connects to the Activate server, AMP, Central, OpenDNS, or web content classification server through a secure HTTP connection. The proxy server can also be configured and used for cloud services. You can also exempt certain applications from using the HTTP proxy (configured on an Instant AP) by providing their host name or IP address under exceptions.

The following procedure describes how to configure the HTTP proxy settings using the webUI:

1. Navigate to Configuration > System > Proxy.
2. Enter the HTTP proxy server IP address in the Auth Server text box.
3. Enter the port number in the Port text box.
4. If you want to set an authentication username and password for the proxy server, enable the Proxy requires authentication toggle switch.
5. Enter a username in the Username text box.
6. Enter a password in the Password text box.
7. If you do not want the HTTP proxy to be applied for a particular host, click + to enter that IP address or domain name of that host in the Exceptions section.
8. Click Save.

The following procedure describes how to configure the HTTP proxy settings using the CLI:

(Instant AP)(config)# proxy server 192.0.2.1 8080 example1 user123
(Instant AP)(config)# proxy exception 192.0.2.2
(Instant AP)(config)# end
(Instant AP)# commit apply

HTTP Proxy Support through Zero Touch Provisioning

Instant APs experience issues when connecting to AirWave, Central, or Activate through the HTTP proxy server which requires a user name and password. The ideal way to provide seamless connectivity for these cloud platforms is to supply the proxy information to the Instant AP through a DHCP server. Starting with Aruba Instant 8.4.0.0, besides being able to authenticate to the HTTP proxy server, the factory default Instant APs can also communicate with the server through a HTTP proxy server DHCP which does not require authentication. In order for the factory default Instant AP to automatically discover the proxy server, you need to configure the HTTP proxy information in the DHCP server option. The Instant AP will receive the proxy information and store it in a temporary file.

To retrieve the port and the proxy server information, you need to first configure the DHCP option 60 to ArubaInstantAP as shown below:

(Instant AP)(config)# ip dhcp <profile_name>
(Instant AP)("IP DHCP profile-name")# option 60 ArubaInstantAP

Secondly, use the following command to configure the proxy server:

(Instant AP)(config)# proxy server <host> <port> [<username> <password>]

Use the text string option 148 text server=host_ip,port=PORT,username=USERNAME,password=PASSWORD to retrieve the details of the proxy server.

Rolling Upgrade on Instant APs with AirWave

Starting from Aruba Instant 8.4.0.0, Rolling Upgrade for Instant APs in standalone mode is supported with AirWave. The upgrade is orchestrated through NMS and allows the Instant APs deployed in standalone mode to be sequentially upgraded such that the APs upgrade and reboot one at a time. With Rolling Upgrade, the impact of upgrading a site is reduced to a single AP at any given point in time. This enhances the overall availability of the wireless network. For more information, see AirWave 8.2.8.2 Instant Deployment Guide and AirWave 8.2.8.2 Release Notes.

Upgrading an Instant AP Using the Automatic Image Check

You can upgrade an Instant AP by using the Automatic Image Check feature. The automatic image checks are performed once, as soon as the Instant AP boots up and every week thereafter. If the image check locates a new version of the Instant software on the image server, the New version available link is displayed on the Instant main window.

If AirWave is configured, the automatic image check is disabled.

The following procedure describes how to check for a new version on the image server in the cloud using the webUI:

1. Go to Maintenance > Firmware.
2. In the Automatic section, click Check for New Version. After the image check is completed, one of the following messages is displayed:
   • No new version available—If there is no new version available.
   • Image server timed out—Connection or session between the image server and the Instant AP is timed out.
   • Image server failure—If the image server does not respond.
   • A new image version found—If a new image version is found.
3. If a new version is found, the Upgrade Now button becomes available and the version number is displayed.
4. Click Upgrade Now.

The Instant AP downloads the image from the server, saves it to flash, and reboots. Depending on the progress and success of the upgrade, one of the following messages is displayed:

• Upgrading—While image upgrading is in progress.
• Upgrade successful—When the upgrade is successful.
• Upgrade failed—When the upgrade fails.

If the upgrade fails and an error message is displayed, retry upgrading the Instant AP.

Upgrading to a New Version Manually Using the WebUI

If the Automatic Image Check feature is disabled, you can manually obtain an image file from a local file system or from a remote server accessed using a TFTP, FTP or HTTP URL.

The following procedure describes how to manually check for a new firmware image version and obtain an image file using the webUI:

1. Navigate to Maintenance > Firmware.
2. Expand Manual section.
3. The firmware can be upgraded using a downloaded image file or a URL of an image file.
4. To update firmware using a downloaded image file:
   • Select the Image file option. This method is only available for single-class Instant APs.
   • Click on Browse and select the image file from your local system. The following table describes the supported image file format for different Instant AP models:

To upgrade firmware using the URL of an image file:

1. Select the Image URL option to obtain an image file from a HTTP, TFTP, or FTP URL.
2. Enter the image URL in the URL text field. The syntax to enter the URL is as follows:
   • HTTP - http://<IP-address>/<image-file>. For example, http://<IP-address>/ArubaInstant_Hercules_8.10.0.x_xxxx
   • TFTP - tftp://<IP-address>/<image-file>. For example, tftp://<IP-address>/Aruba Instant_ Hercules_8.10.0.x_xxxx
   • FTP - ftp://<IP-address>/<image-file>. For example, ftp://<IP-address>/Aruba Instant_ Hercules_8.10.0.x_xxxx
   • FTP - ftp://<user name:password>@<IP-address>/<image-file>. For example, ftp://<aruba:123456>@<IP-address>/ArubaInstant_Hercules_8.10.0.x_xXXX

The FTP server supports both anonymous and username:password login methods. Multiclass Instant APs can be upgraded only in the URL format, not in the local image file format.

Upgrading an Instant AP Image Using CLI

The following procedure describes how to upgrade an image using a HTTP, TFTP, or FTP URL:

(Instant AP)# upgrade-image <ftp/tftp/http-URL>

The following is an example to upgrade an image by using the FTP URL :

(Instant AP)# upgrade-image ftp://192.0.2.7/ArubaInstant_Hercules_8.10.0.x_xxxx

The following procedure describes how to upgrade an image without rebooting the Instant AP:

(Instant AP)# upgrade-image2-no-reboot <ftp/tftp/http-URL>

The following is an example to upgrade an image without rebooting the Instant AP:

(Instant AP)# upgrade-image2-no-reboot ftp://192.0.2.7/Aruba Instant_Hercules_ 8.10.0.x_xxxx

The following command describes how to view the upgrade information:

(Instant AP)# show upgrade info
Image Upgrade Progress
---------------------
Mac IP Address AP Class Status Image Info Error Detail
--- --------- -------- ------ ---------- -----------
d8:c7:c8:c4:42:98 10.17.101.1 Hercules image-ok image file none
Auto reboot : enable
Use external URL : disable

Upgrade from Instant 6.4.x.x-4.2.x.x to Instant 8.10.0.x

Before you upgrade an Instant AP running Instant 6.5.4.0 or earlier versions to Instant 8.10.0.x, follow the procedures mentioned below:

1. Upgrade from Instant 6.4.x.x-4.2.x.x or any version prior to Instant 6.5.4.0 to Instant 6.5.4.0.
2. Refer to the Field Bulletin AP1804-1 at asp.arubanetworks.com.
3. Verify the affected serial numbers of the Instant AP units.