wlan virtual-ap

Name of this profile.

Range: 1-63 characters

Default: default

Name of the AAA profile that applies to this virtual AP.

Default: default

The 5 GHz radio(s) on which to configure the virtual AP:

all—dual 5 GHz band only

first-5g-radio-only—first 5 GHz band only

second-5g-radio-only—second 5 GHz band only

Default: all

NOTE: This parameter is ignored if the AP has only one 5 GHz radio.

The band(s) on which to use the virtual AP:

a—5 GHz band only (802.11a)

g—2.4 GHz band only (802.11b/802.11g)

all—both 2.4 GHz and 5 GHz bands (802.11a and 802.11b/802.11g)

none—disable both 2.4 GHz and 5 GHz bands

Default: all

NOTE: The none option is supported from ArubaOS 8.9.0.0 or later versions.

Enable 6 GHz band to use the virtual AP.

NOTE: This field is applicable to Wi-Fi 6E APs only.

This option enables the allocation of more than 4 6GHz VAPs.

Anyspot Profile associated with this Virtual AP Profile. The anyspot client probe suppression feature decreases network traffic by suppressing probe requests from clients attempting to locate and connect to other known networks.

Time, in seconds, a client is blocked if it fails repeated authentication. A value of 0 blocks a client iindefinitely.

Range: 0-2,147,483,647 seconds

Default: 0

ARM’s band steering feature can encourage or require dual-band capable clients to stay on the 5 GHz band on dual-band APs. This frees up resources on the 2.4 GHz band for single band clients like VoIP phones.

Band steering reduces co-channel interference and increases available bandwidth for dual-band clients, because there are more channels on the 5 GHz band than on the 2.4 GHz band. Dual-band 802.11n-capable clients may see even greater bandwidth improvements, because the band steering feature will automatically select between 40MHz or 20 MHz channels in 802.11n networks. This feature is disabled by default, and must be enabled in a Virtual AP profile.

The band steering feature supports three steering modes, which can be configured via the steering-mode parameter:

Band steering can be configured on both campus APs and remote APs that have a virtual AP profile set to tunnel, decrypt-tunnel, split-tunnel or bridge forwarding mode. Note, however, that if a campus or remote APs has virtual AP profiles configured in bridge or split-tunnel forwarding mode but no virtual AP in tunnel mode, those APs will gather information about 5G-capable clients independently and will not exchange this information with other APs that also have bridge or split-tunnel virtual APs only.

Default: disabled

Enables detection of DoS attacks, such as ping or SYN floods, that are not spoofed deauth attacks.

Default: enabled

Number of seconds that a client is quarantined from the network after being blocked.

Range: 0-2,147,483,647 seconds

Default: 3600 seconds (1 hour)

Filter out broadcast and multicast traffic in the air.

all

NOTE: Do not enable this option for virtual APs configured in bridge forwarding mode. This configuration parameter is only intended for use for virtual APs in tunnel mode. In tunnel mode, all packets travel to the managed device, so the managed device is able to drop all broadcast traffic. When a virtual AP is configured to use bridge forwarding mode, most data traffic stays local to the AP, and the managed device is not able to filter out that broadcast traffic.

IMPORTANT: If you enable this option, you must also enable the Broadcast-Filter ARP parameter in the stateful firewall configuration to prevent ARP requests from being dropped. Note also that although a virtual AP profile can be replicated from a Mobility Conductor to managed device, stateful firewall settings do not. If you select the broadcast-filter all option for a Virtual AP Profile on a Mobility Conductor, you must enable the broadcast-filter arp setting on each individual managed device.

arp

If enabled, all broadcast ARP requests are converted to unicast and sent directly to the client. You can check the status of this option using the show ap active and the show datapath tunnel command. If enabled, the output will display the letter a in the flags column.

Do not enable this option for virtual APs configured in bridge forwarding mode. This configuration parameter is only intended for use for virtual APs in tunnel mode. In tunnel mode, all packets travel to the managed device, so the managed device is able to convert ARP requests directed to the broadcast address into unicast. When a virtual AP is configured to use bridge forwarding mode, most data traffic stays local to the AP, and the managed device is not able to convert that broadcast traffic.

Range: all, arp

Default: For the option all, the default value is disabled.

Default: For the option arp, the default value is enabled.

When both the client match and cellular handoff assist features are enabled, the cellular handoff assist feature can help a dual-mode, 3G or 4G-capable Wi-Fi device such as an iPhone, iPad, or Android client at the edge of Wi-Fi network coverage switch from Wi-Fi to an alternate 3G or 4G radio that provides better network access. This feature is disabled by default, and is recommended only for Wi-Fi hotspot deployments.

Default: disabled

Name of an existing traffic management profile from which parameter values are copied.

Select this check box to deny traffic between the clients using this virtual AP profile.

The firewall command includes an option to deny all inter-user traffic, regardless of the Virtual AP profile used by those clients.

If the global setting to deny inter-user traffic is enabled, all inter-user traffic between clients will be denied, regardless of the settings configured in the virtual AP profiles. If the setting to deny inter-user traffic is disabled globally but enabled on an individual virtual ap, only the traffic between un-trusted users and the clients on that particular virtual AP will be blocked.

Specify the name of the time range for which the AP will deny access. Time ranges can be defined using the CLI command time-range.

If enabled, virtual AP is disabled on 6 GHz band only when AP is provisioned as mesh.

NOTE: This field is applicable to Wi-Fi 6E APs only.

If enabled, APs ignore deauthentication frames from clients. This prevents a successful deauth attack from being carried out against the AP. This does not affect third-party APs.

Default: disabled

Name of an 802.11k profile to be associated with this VAP.

Default: default

Enable or /Disable dynamic multicast optimization. This parameter can only be enabled on a managed device with a PEFNG license.

Default: disabled

Maximum number of high-throughput stations in a multicast group beyond which dynamic multicast optimization stops.

Range: 2-255 stations

Default: 6 stations

This parameter enables seamless failover for silent clients, allowing them to re-associate. If you select this option, the managed device will generate a Layer 2 update on behalf of client to update forwarding tables in bridge devices.

Default: disabled

Controls whether 802.11 frames are tunneled to the managed device using generic routing encapsulation (GRE), bridged into the local Ethernet LAN (for remote APs), or a combination thereof depending on the destination (corporate traffic goes to the managed device, and Internet access remains local).

Select one of the following forward modes:

Tunnel: When an AP is in tunnel forwarding mode, the AP handles all 802.11 association requests and responses. The AP sends all 802.11 data packets, action frames and EAPOL frames over a GRE tunnel to the managed device for processing. The managed device removes or adds the GRE headers, decrypts or encrypts 802.11 frames and applies firewall rules to the user traffic as usual.

Bridge: When an AP is in bridge mode, data is bridged onto the local Ethernet LAN. When in bridge mode, the AP handles all 802.11 association requests and responses, encryption or decryption processes, and firewall enforcement. 802.11e and 802.11k action frames are also processed by the AP, which then sends out responses as needed. An AP in bridge mode supports only the 802.1X authentication type.

Split-Tunnel: Data frames are either tunneled or bridged, depending on the destination (corporate traffic goes to the managed device, and Internet access remains local). The AP handles all 802.11 association requests and responses, encryption or decryption, and firewall enforcement. 802.11e and 802.11k action frames are also processed by the AP, which then sends out responses as needed. An AP in split-tunnel mode supports only the 802.1X authentication type.

Decrypt-Tunnel: An AP in decrypt-tunnel forwarding mode decrypts and decapsulates all 802.11 frames from a station and sends the 802.3 frames through the GRE tunnel to the managed device, which then applies firewall policies to the user traffic. This mode allows a network to utilize the encryption or decryption capacity the AP while reducing the demand for processing resources on the managed device. APs in decrypt-tunnel forwarding mode also manage all 802.11 association requests and responses, and process all 802.11e and 802.11k action frames.

NOTE: Virtual APs in bridge or split-tunnel mode using static WEP should use key slots 2-4 on the managed device. Key slot 1 should only be used with Virtual APs in tunnel mode.

Range: tunnel, bridge. split-tunnel decrypt-tunnel

Default: tunnel

Enables 802.11mc Fine Timing Measurement (FTM) on radio (responder mode only).

This feature is supported on 500 Series, 500H Series, 510 Series, 530 Series, 550 Series, 560 Series, 570 Series, 630 Series, and 650 Series access points.

Default: disabled

If enabled, home agent discovery is triggered on client association instead of home agent discovery based on traffic from client. Mobility on association can speed up roaming and improve connectivity for clients that do not send many uplink packets to trigger mobility (VoIP clients). Best practices is to leave this parameter disabled, as it increases IP mobility control traffic between managed devices in the same mobility domain. Enable this parameter only when voice issues are observed in VoIP clients.

NOTE: ha-disc-onassoc parameter works only when IP mobility is enabled and configured on the managed device.

Default: disabled

Enables or disables a hotspot profile.

Default: enabled

This parameter specifies the MBSSID group to which a 6GHz VAP will be assigned.

Enables or disables IP mobility on a virtual AP. This is enabled by default. L3 mobility service is active on a VAP only if router mobile is also enabled on the managed device.

Default: enabled

Negates any configured parameter.

Enables OpenFlow on AP forwarding path.

This parameter allows clients to retain their previous VLAN assignment if the client disassociates from an AP and then immediately re-associates either with same AP or another AP on same managed device.

Configures when the virtual AP operates on a remote AP:

always—Permanently enables the virtual AP (Bridge Mode only). This option can be used for non-802.1X bridge VAPs.

backup—Enables the virtual AP if the remote AP cannot connect to the managed device (Bridge Mode only). This option can be used for non-802.1X bridge VAPs.

persistent—Permanently enables the virtual AP after the remote AP initially connects to the managed device (Bridge Mode only). This option can be used for any (Open or PSK or 802.1X) bridge VAPs.

standard—Enables the virtual AP when the remote AP connects to the managed device. This option can be used for any (bridge or split-tunnel or tunnel or d-tunnel) VAPs.

Range: always, backup, persistent, standard

Default: standard

Name of the SSID profile that applies to this virtual AP.

Default: default

Band steering supports three different band steering modes.

Force-5GHz: When the AP is configured in force-5GHz band steering mode, the AP will try to force 5 GHz-capable APs to use that radio band.

Prefer-5GHz (Default): If you configure the AP to use prefer-5GHz band steering mode, the AP will try to steer the client to 5G band (if the client is 5G capable) but will let the client connect on the 2.4G band if the client persists in 2.4G association attempts.

Balance-bands: In this band steering mode, the AP tries to balance the clients across the two radios in order to best utilize the available 2.4G bandwidth. This feature takes into account the fact that the 5 GHz band has more channels than the 2.4 GHz band, and that the 5 GHz channels operate in 40 MHz while the 2.5 GHz band operates in 20 MHz.

NOTE: Steering modes do not take effect until the band steering feature has been enabled. The band steering feature in ArubaOS versions 3.3.2-5.0 does not support multiple band-steering modes. The band-steering feature in these versions of ArubaOS functions the same way as the default prefer-5GHz steering mode available in ArubaOS 6.0 and later.

Range: Force-5 GHz, prefer-5 GHz, balance-bands

Default: prefer-5 GHz

If enabled, the AP denies client association requests if the AP and client station have no common rates defined. Some legacy client stations which are not fully 802.11-compliant may not include their configured rates in their association requests. Such non-compliant stations may have difficulty associating with APs unless strict compliance is disabled.

Default: disabled

Enable or disable the virtual AP.

Default: enabled

The VLAN(s) into which users are placed in order to obtain an IP address. Enter VLANs as a comma-separated list of existing VLAN IDs or VLAN names. A mixture of names and numeric IDs are not allowed.

NOTE: You must add an existing VLAN ID to the Virtual AP profile.

Default: 1

VLAN mobility retains the client VLAN on roaming irrespective of the VAP VLAN, provided the user VLANs are extended.

VLAN mobility and mobile IP are mutually exclusive.

VLAN mobility does not re-use user firewall sessions on roaming as the sessions will have to be recreated locally on the roamed managed device.

Default: disabled

Specify the wan-operation to enable Virtual AP depending on the state of the WAN link.

Range: always, backup, primary

Default: always