What's New

Important Notes

• The nodes of an Aruba Central On-Premises cluster must be deployed in the same data center and same VLAN Virtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. subnet. It is a prerequisite to get 10 Gbps Gigabits per second. throughput for intra-cluster communication.

• High Availability (HA) with n-1 Aruba Central On-Premises is supported in multi-node COP cluster, where ‘n’ denotes the number of nodes in the cluster. In the event of a single node failure in a multi-node cluster, COP cluster functions in High availability mode. Once the COP cluster enters the HA mode, Aruba Central On-Premises user interface might not be accessible as it takes approximately 30 minutes for the system to get stabilized after any one of the cluster node goes down.

  It is recommended to bring up the down nodes to join back to the COP cluster. This ensures that Aruba Central On-Premises runs with all the nodes up.

• It is recommended to upgrade all the Aruba Central On-Premises nodes to 512 GB for optimum performance. Starting from this release, 256 GB RAM Random Access Memory. is not supported.
• Admins must prepare all the Aruba Central On-Premises nodes to upgrade with HPE release Service Pack. This Service Pack fixes any kind of known vulnerabilities and provides security updates for the drivers along with additional features. It is recommended by HPE to keep ILO to the latest Service Pack as it improves reliability and performance of the servers.
  For more information, see Installing Service Pack and Upgrade ILO Using Service Pack.
  For more information on Service Pack software requirement, you can refer to the Support Advisory.

  Customers must sign-in to HPE Networking Support Portal to access this Support Advisory.

New Features

The following sections provide an overview of the new features that are added to Aruba Central On-Premises in this release.

Adding Subscription for Offline-Mode Installations

Aruba Central On-Premises has introduced manually adding the subscription A business model where a customer pays a certain amount as subscription price to obtain access to a product or service. on HPE GreenLake account home to support offline deployments. The license file is uploaded in the Device Subscriptions page under Manage Account > Subscriptions. For more information, see Subscription for Offline-Mode Installation.

Aruba Central NetConductor

Listed below are the features introduced for Aruba Central On-Premises, in this release: 

• Users can configure underlay network in Aruba Central On-Premises.

  For more information, see Network Wizard Overview .

• Aruba Central On-Premises now provides a re-sync button to resolve configuration conflicts within existing overlay fabrics. This button is only available when a configuration conflicts exists.

  For more information, see Fabric Wizard Overview .

• Aruba Central On-Premises now supports Layer 2 overlay segments for the default gateways.

  For more information, see Fabric Wizard Overview .

Cable Test Support for AOS-CX Switches

Aruba Central On-Premises now supports cable test for AOS-CX switches. This enables testing of the electrical connections in the switch cable. For more information, see Troubleshooting Device Issues.

Configuring Client Events for AOS-CX

Users can configure client events to generate authentication and DHCP Dynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network. events of clients. For more information, see Configuring Authentication and DHCP Related Client Events on AOS-CX

Configuring Port Profiles on AOS-CX

The Port profiles feature allows you to configure interface-specific commands at the group level through an editor that supports syntax and semantic checking. For more information, see Configuring Switch Ports on AOS-S Switches.

Configuring RADIUS Server Settings on AOS-S Switches

Aruba Central On-Premises supports Window Size and Time Window as the RADIUS Remote Authentication Dial-In User Service is a networking protocol that provides centralized authentication, authorization, and accounting management for users who connect and use a network service server parameters.

Window Size is used to configure replay protection for dynamic authorization messages. The window size is the time in seconds within which the received dynamic authorization requests are considered to be current and accepted for processing. A zero value means there is no time limit. A non-zero value indicates that the Event-Timestamp attribute is expected as part of all Change of Authorization and Disconnect request messages. If the timestamp attribute is not present the message is dropped. The default Window Size value is 300 seconds.

The Time Window option allows the user to select Positive or Plus minus window size. Positive (positive-time-window) sets the current acceptable time-window as + seconds. Plus minus (plus-or-minus-time-window) sets the current acceptable time-window as +/- seconds. When replay protection is enabled and positive-time-window is set, messages from the server must contain an Event-Timestamp attribute that differs from the current time by not more than the specified number of seconds.

When replay protection is enabled and plus-or-minus-time-window is set, messages from the server must contain an Event-Timestamp attribute that differs from the current time by no more than the (+/-) specified number of seconds. Messages with a timestamp value outside the valid window are considered stale and are ignored. Setting the time window to zero disables replay protection. The default window-type is positive-time-window.

For more information on Time Window and Window Size see Configuring RADIUS Server Settings on AOS-S Switches

Configuring Switch Ports on AOS-S Switches

Aruba Central On-Premises allows the user to enable or disable the unsupported transceivers (third-party transceivers).

Configuring System Access for AOS-S Switches

Aruba Central On-Premises supports the following new features:

• TELNET toggle switch - Allows the user to enable or disable the login access via the TELNET server.

• Management Authentication - Allows the user to select either RADIUS, TACACS Terminal Access Controller Access Control System. TACACS is a family of protocols that handles remote authentication and related services for network access control through a centralized server.  , LOCAL as the primary management authentication server.

• MOTD Login Banner - Allows the user to enter the message to be displayed before the login prompt.

For more information, see Configuring System Parameters for AOS-S Switches.

Configuring TACACS Server Settings on AOS-S Switches

Aruba Central On-Premises now allows the user to configure TACACS server settings. For more information, see Configuring TACACS Server Settings on AOS-S Switches.

Datacenter Redundancy

The Datacenter Redundancy tab is introduced under System Management. This feature allows you to configure and pair two clusters in order to continue network functioning by switching roles, in case of a failover, within minimum downtime. For more information, see Datacenter Redundancy .

RAPIDS

Aruba Central On-Premises now allows users to enable or disable the RAPIDS feature as a whole on per customer basis. Users who want to configure rules can enable the Enable RAPIDS toggle button under Manage > Security > RAPIDS. Upon enabling the RAPIDS feature, users can see the Classification Rules table with the default configured rules. In addition to the default rules, users can configure a predefined set of customized classification criteria at the global level to determine the classification of a neighboring AP. For more information, see Configuring RAPIDS.

Support for AP-503 Access Points

Aruba Central On-Premises now supports configuring and monitoring of AP-503 access points (AP) using the UI User Interface. options and templates. For more information, see Supported APs.

Support for MultiZone Feature

Aruba Central On-Premises now supports the Multizone feature that allows you to monitor multiple isolated network zones within a single physical network infrastructure, such as an AP. You can group your devices in the WebUI to monitor and troubleshoot network problems that are specific to a particular group, site, or label. You can also create various types of reports for devices associated with groups, sites, and labels in a MultiZone setup. MultiZone has limited support in Aruba Central On-Premises and this feature is applicable from Aruba Central On-Premises 2.5.7.6 or later versions.

For more information, see MultiZone.

Support for Third-Party Devices

Aruba Central On-Premises now supports adding and monitoring third-party devices, such as Cisco 9200 and 9300 series switches. For more information, see Monitoring Third-Party Devices.

VSF Switchover

In AOS-CX switch stacks, the VSF Switchover option triggers the standby conductor switch to take over the conductor role. For more information, see Switching Over the Conductor Role

Aruba Central On-Premises Service Pack Upgrade

Aruba Central On-Premises now supports service pack upgrade through the ILO console and COP CLI console. Customers using lower versions of Aruba Central On-Premises has a low ILO and firmware version installed. For proper functioning of the Aruba Central On-Premises nodes, it is recommend to upgrade it to the latest service pack (SP) which includes all the latest firmwares.

You can trigger the Service Pack upgrade only from the ILO console whereas, you can check the installed Service Pack version and reset it from both ILO console and COP CLI console. You must download the ILO Service Pack from the HPE Support Portal, HPE Support Center and the Patched Service pack by HPE from, SPP Custom Download.. Aruba Central On-Premises supports only "2022.09.01.00", "2023.09.00.03", or "2023.03.00.00" service pack versions. On checking Service Pack version, the version details is displayed as Unknown if the service pack is not one of the supported versions or, the user checks it before applying the Service Pack. For more information, see Installing Service Pack and Upgrade ILO Using Service Pack.

Data Truncation for PDF Export in Reports

The widgets for PDF in the Resource Utilization Reports, Rapids, Guest, Network Report, New Infra Inventory Report, Security, Config & Audit Report, Switch capacity planning- and RF Health reports are truncated up to 2.5 lakh characters to support the PDF export. The complete data can be exported to CSV Comma-Separated Values. A file format that stores tabular data in the plain text format separated by commas. format. For more information, see Report Types.

Enhancements

The following sections provide an overview of the enhancements introduced in Aruba Central On-Premises in this release.

Access Logs

Users can now see logs for any kind of Aruba Central On-Premises access that is either done through the web or Command Line Interface (CLI). For more information, see Audit Trail.

Access Points Monitoring

The following AP monitoring enhancements are introduced in this release.

Controller AP Group

Aruba Central On-Premises now supports Controller AP Group parameter in the Access Points List and Access Points Overview page that displays the name of the AP group.

For more information, see the following topics:

• Monitoring Access Points in List View

• Viewing the Summary Tab

Support for Access Points Tab in the Controller Dashboard

Aruba Central On-Premises now supports Access Points tab under Manage > Access Points page in the controller dashboard that displays details of all the APs connected to a specific controller. For more information, see Access Points Tab in the Controller Dashboard.

Alerts and Events

The following Alerts & Events enhancements are introduced in this release:

IP Management System

A new alert type IP Management System is added under Alerts & Events. The following alert is added under IP Management System alert type:

IPMS Pool Capacity Alert—Generates an alert when IPMS pool allocation crosses 80% of assigned pool size. The alert is cleared when the pool capacity is below 80% of the assigned capacity in the network.

For more information, see IP Management System Alert.

Access Point Alerts

DPP Attack—Generates an alert when there is a DPP-related DoS Denial of Service.  DoS is any type of attack where the attackers send excessive messages to flood traffic and thereby preventing the legitimate users from accessing the service.  attack in the network.

For more information, see Access Point Alerts.

Central System Alerts

COP Disaster Recovery Alert Notifier—Generates an alert when the DR (Disaster Recovery) role is successfully changed to the Primary cluster.

Connectivity Alerts

The following new authentication alert types are added in Connectivity alerts to enhance user experience by adding detailed information regarding the server IP, authentication type, number of users impacted, and percentage of users effected.

• Wi-Fi Wi-Fi is a technology that allows electronic devices to connect to a WLAN network, mainly using the 2.4 GHz and 5 GHz radio bands. Wi-Fi can apply to products that use any 802.11 standard. Security Key-Exchange Failure Detected—Generates an alert when there are high number of client authentication failures (Wi-Fi Security Key-Exchange) in the network.

• Wi-Fi Security Key-Exchange Delay Detected—Generates an alert when there is excessive delay in the client authentication (Wi-Fi Security Key-Exchange) with the AP in the network.

• 802.1x Authentication Delay Detected—Generates an alert when there is excessive delay in the 802.1x authentication process in the network.

• 802.1x Authentication Failure Detected—Generates an alert when there are high number of 802.1x authentication failures in the network.

• MAC Media Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Authentication Delay Detected—Generates an alert when there is excessive delay in the MAC authentication process in the network.

• MAC Authentication Failure Detected—Generates an alert when there are high number of MAC authentication failures in the network.

• Captive Delay Detected—Generates an alert when there is excessive delay in the captive portal A captive portal is a web page that allows users to authenticate and sign in before connecting to a public-access network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for guest users. authentication process in the network.

• Captive Failure Detected—Generates an alert when there are high number of captive portal failures in the network.

This additional categorization of the authentication alerts enable users to quickly triage the alerts and take appropriate action.

For more information, see Connectivity Alerts

AOS-CX Switch Alerts

The following alerts are introduced in this release:

• Management module failure—Generates an alert when the state of the management module changes to down or failed.

• Line-card failure—Generates an alert when the state of the line card changes to down or failed.

• Fan tray failure —Generates an alert when the state of the fan tray in the slot changes to down or failed.

• Fan failure —Generates an alert when the state of the fan in the slot tray changes to fault.

• Power supply failure—Generates an alert when the state of the power supply in the slot changes to fault input or warning.

• Switch Uplink Port Status Change—Generates an alert when there is a change in the status of the uplink port. This alert is generated when the uplink port goes down and it is cleared when the port status is restored.

For more information, see AOS-CX Switch Alerts.

AOS-CX Switch Events

Support for the following events are available:

• MSTP Multiple Spanning Tree Protocol. MSTP configures a separate Spanning Tree for each VLAN group and blocks all but one of the possible alternate paths within each spanning tree. events

• RPVST events

• Loop protect events

For more information about the AOS-CX switch events, navigate to the AOS-CX Switch Software Documentation Portal. In the AOS-CX Switch Software Documentation portal, navigate to a switch model and click the View software feature and user guides (HTML) link. Click Software Release Version listed next to the Event Log Message Reference Guide to view the events for the software release version selected.

Aruba Central On-Premises ISO Installation

From now, during any Aruba Central On-Premises installation on the iLO Integrated Lights-Out (iLO) by Hewlett-Packard Enterprise is a proprietary embedded server management technology providing out-of-band management facilities. server, if there are any test ilo user accounts that were created by the customer, those accounts will be deleted. Only ‘administrator’ and ‘copilo’ ILO account can be created and retained as a part of the ISO An ISO file is an identical copy of an entire optical disk for example, a CD or a DVD, archived into a single file. This ISO file is also referred to as an ISO image, which is a smaller-sized copy of large sets of data. installation. This behavior is applicable to any upgrade from Aruba Central On-Premises 2.5.6 to Aruba Central On-Premises 2.5.7, and also when any customer migrates from Airwave to Aruba Central On-Premises.

For more information, see ISO and Aruba Central On-Premises Software Installation

Certificates

Certificates are enhanced to support the following:

• Web UI And API Gateway services support Elliptical Curve Cryptography (ECC) certificate.
• Client Certificate are now supported in Aruba Central On-Premises.
• Server certificate can now be applied to verify RadSec RadSec is an authentication and authorization protocol for transporting RADIUS datagrams over TCP and TLS. protocol.
• Secure AMON Advanced Monitoring. AMON is used in Aruba WLAN deployments for improved network management, monitoring, and diagnostic capabilities. service now supports DTLS Datagram Transport Layer Security is a communications protocol providing security to datagram-based applications by allowing them to communicate in a way designed to prevent tampering, message forgery or eavesdropping. protocol.

For more information on certificates, see Manage Certificates.

Device Override Visualization

Users can now view the local override configuration details of a switch or its group. For more information, see Using Configuration Status on AOS-CX.

Handling Aruba Central On-Premises Upgrade for Datacenter Redundancy

For Aruba Central On-Premises upgrade from one version to another, it is beneficial to have a secondary cluster for safe management of software and hardware systems. To upgrade the secondary cluster, you must first upgrade the primary cluster. Primary cluster can be upgraded through user interface or command line interface (CLI) option whereas, the secondary cluster can only be upgraded through CLI.

For more information, see the following topics:

• Handling Upgrade for Datacenter Redundancy

• Datacenter Redundancy

• Disaster Recovery

Host Upgrade Parallelization

The time to perform a host upgrade from Aruba Central On-Premises 2.5.6 to Aruba Central On-Premises 2.5.7 for a 7 node cluster is now reduced to 1.5 hours - 2 hours.

Incremental Backup

A new option, Incremental Backup, is added to the Backup Later schedule under Maintain > System Management > Backup and Restore. This option is provided to aid in taking daily backup of voluminous databases in a segregated manner. For more information, see Schedule Incremental Backup.

Managing Local Overrides for AOS-CX Switches

Aruba Central On-Premises now allows users to view the local overrides of a switch or its group. For more information, see Using Configuration Status on AOS-CX.

NAE Scripts

In this version of Aruba Central On-Premises, new NAE scripts are supported. For more information, see Express Configuration Using MultiEdit on AOS-CX.

New Infra Inventory Report

A new column Controller AP Group is added to the Total APs table of the New Infra Inventory report.

For more information, see Report Categories.

OPA Gatekeeper for Public Image Restriction

Aruba Central On-Premises now downloads packages from private allow listed repositories and uses signed packages for images.

For more information, see the following topics:

• Legal Disclaimer: The resource assets in this website may include abbreviated and/or legacy terminology for HPE Aruba Networking products. See www.arubanetworks.com for current and complete HPE Aruba Networking product lines and names.

• Configure Communication Ports

Password Specifications for Aruba Central On-Premises Configuration

The password must be alphanumeric. The minimum requirement is eight characters that includes a combination of letters, numbers, and special characters.

This password specification is applicable for the following operations:

• For setup-wizard through a web browser during fresh installation.

• For setup-cluster through CLI during fresh installation.

• GUI Graphical User Interface (GUI), is a type of UI enabling user interaction with electronic devices through symbols, graphical icons, and other visual metaphors instead of typed commands or text-based UIs. password change through CLI.

• CLI password change through CLI.

Table 1: Password Requirements

Requirement	Description
Password length	The minimum number of alphanumeric characters required for a password is 8. Range: 8 - 64 (combination of alphabets, numbers, and special characters).
Upper Case characters	Use a minimum of 1 uppercase alphabet in password. Alphabets A to Z.
Lower Case characters	Use a minimum of 1 lowercase alphabet in password. Alphabets a to z.
Numbers	Use a minimum of 1 digit (number) in password. Numbers 0 - 9.
Special characters	Use a minimum of 1 special character in password. Supported special characters are ~, !, @, #, $, %, ^, &, *, (, ), <, >, {, }, ;, :, . and ,.

For more information, see Aruba Central Configuration .

Removing Multiple Devices from a Site

Aruba Central On-Premises now allows users to remove multiple devices at a time. For more information, see Manage Sites.

Replacement Details Page

You can now view the device replacement details page for a particular device by clicking on the old device serial from the Devices Under Replacement and Replacement History pages. For more information, see Device Replacement

Support for Resolving FQDNs

Aruba Central On-Premises now requires the FQDNs to be resolved on both the primary and secondary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. servers.

System Security

The System Management tab now includes the System Security tab. The System Security tab provides the option to configure insecure algorithms for backup on older servers that do not support secure protocols, and to restrict management access on Aruba Central On-Premises. For more information, see Configuring System Security.

Multi- Node Cluster Update

In case of multi-node cluster, Aruba Central On-Premises CLI option 1-1 Reboot System enables you to perform a wide cluster reboot or a single cluster reboot based on your requirement. Following are options that you can choose:

• Cluster Reboot

• Current Node Reboot

For more information, see The CLI Bank.