In this presentation, we will discuss how AirGroup configurations have changed to support hierarchical configuration in release 8.2. AirGroup configs will now be profile based and can be applied at any node. Check out the webinar recording where this presentation was used: http://community.arubanetworks.com/t5/Wireless-Access/Technical-Webinar-AirGroup-profiling-changes-across-8-1-amp-8-2/td-p/417153 Register for the upcoming webinars: https://community.arubanetworks.com/t5/Training-Certification-Career/EMEA-Airheads-Webinars-Jul-Dec-2017/td-p/271908

1. AIRGROUP PROFILING CHANGES ACROSS 8.1 & 8.2
– ARUBA OS 8.X
09:00 GMT | 10:00 CET | 13:00 GST
April 24th, 2018
Presenter: Harri S
Harri.Sengottaiyyan@hpe.com

2. 2
Welcome to the Technical Climb Webinar
Listen to this webinar using the computer
audio broadcasting or dial in by phone.
The dial in number can be found in the audio
panel, click additional numbers to view local
dial in numbers.
If you experience any difficulties accessing
the webinar contact us
using the questions panel.

3. 3
Housekeeping
This webinar will be recorded
All lines will be muted during the
webinar
How can you ask questions?
Use the question panel on your screen
The recorded presentation will be posted on Arubapedia for
Partners (https://arubapedia.arubanetworks.com/afp/)

4. 4
Rationale
• With the MM architecture, user is now able to do entire configuration for the network from a centralized
point. But AirGroup configurations are non-profile based and applicable only at /mm node.
• In a large deployment, a single mobility master ( MM) is used to manage large number of managed nodes
and clients. Having single configuration for the entire network is not desirable.
• Traditionally master-local are managed separately by location admins. In 8.x multiple such controllers can
come under a single MM. Hence each location admin may still want to configure and manage the
configuration as before.
• Hence AirGroup configurations are changed to support hierarchical configuration in release 8.2. AirGroup
configs will now be profile based and can be applied at any node.

5. 5
What is new
• In release 8.0 and 8.1, AirGroup would run centrally on the Mobility master with a single set of configs
applicable for all the MDs. This means AirGroup process runs only on the MM and does not run on the MDs.
All mDNS and SSDP/DLNA packets from MD would be punted to MM via Openflow. This mode is called
Centralized.
• With release 8.2 a new mode of running AirGroup, called Distributed is introduced. In this, there is no
Openflow involved. AirGroup process runs individually on each MD, that is enabled to run in distributed
mode.
• An MM-MD topology can either run in Centralized mode or Distributed mode or a mix of both - where few
MDs have Openflow configs enabled and run centralized and others run in distributed mode.

6. 6
Functionality
Following are the changes in Release 8.2
• All AirGroup commands are profile based
• No Boolean commands like enable/disable
• Attaching a profile to a node will enable all the features present in the profile
• New profile can be created and attached at any node thus overriding the profile
inherited from higher nodes.

7. 7
Topology
Following topologies supported
1. MCM – 72xx as master and any type of local
2. Standalone 72xx
3. VMM – Mobility master and multiple locals

8. CONFIGURATION IN PRE 8.2.X

9. 9
Enabling AirGroup in 8.0.x and 8.1.x
• Navigation: MM> Configuration > services > AirGroup

10. 10
Enabling AirGroup in 8.0.x and 8.1.x

11. 11
Enabling AirGroup in 8.0.x and 8.1.x
• Adding ClearPass and RFC server details

12. 12
AirGroup configuration in 8.0.x and 8.1.x

13. CONFIGURATION IN 8.2.X

14. 14
Configuration: AirGroup profile
• Navigation: md node or device node > Configuration > system > profiles > AirGroup Profile

15. 15
Configuration – CPPM profile
AirGroupprofile cppm “8.2-CPPM“
server-group “ClearPass"
rfc-3576-server "10.17.164.90"
!
However the aaa configurations for server-group and rfc server remains the same.

16. 16
Configuration – Domain profile
AirGroupprofile domain "8.2-Domain"
ip-addr 5.1.1.1
ip-addr 5.1.1.2
!
Domain can be used only in distributed mode.

17. 17
Configuration – Service profile
AirGroupprofile service "8.2 service"
id "_test._tcp"
description "test"
!

18. 18
Configuration - AirGroup profile UI

19. 19
Configuration - AirGroup profile CLI
AirGroupprofile "8.2-test"
service "default-airplay"
service "8.2 service"
disallow-vlan 1 type servers service "default-airprint"
disallow-role "logon" type users service "default-airplay"
active-domain-profile "8.2-Domain"
cppm-profile "8.2-CPPM"
!

20. 20
Configuration – Enable AirGroup UI
• Navigation: md node or device node > Configuration > Services > AirGroup

21. 21
Configuration – Enable AirGroup CLI
AirGroupprofile activate
AirGroupprofile "8.2-test" mode distributed
!
• At any node only one instance of this command will be present.
• If AirGroup needs to be disabled on any select node then an AirGroupprofile without any “AirGroupprofile
service” can be attached to that node. This will disable AirGroup service on that select node and all the nodes
under that hierarchy.

22. AIRGROUP - CENTRALIZED

23. 23
AirGroup - Centralized
• AirGroup would run centrally on the Mobility master with a single set of configs applicable for all the MDs.
This means AirGroup process runs only on the MM and does not run on the MDs.
• All mDNS and SSDP/DLNA packets from MD would be punted to MM via Openflow.
• AirGroup-domain profile present in the AirGroupprofile will be used only on the nodes which are running in
distributed mode. AirGroup-domain configuration present in the profile will be ignored by MM running in
centralized mode.
• MM will contact ClearPass when enforce registration is enabled

24. 24
AirGroup - Centralized

25. 25
AirGroup - Centralized

26. 26
AirGroup - Centralized

27. AIRGROUP - DISTRIBUTED

28. 28
AirGroup - Distributed
• In Distributed mode the AirGroup service / process will run locally on each MD
• Any AirGroup domain profile configured will be used under this mode.
• Each MD will contact ClearPass separately

29. 29
AirGroup - Distributed

30. 30
AirGroup - Distributed

31. 31
AirGroup - Distributed

32. 32
MM-MD topology - Example

33. 33
Configuration – Enabling AirGroup
In above sample MM-MD topology following configuration are made:
/md/NorthAmerica/NewYork# AirGroupprofile activate
AirGroupprofile “profile1” mode distributed
1: All the MDs under NewYork (Device M1) will run AirGroup service locally.
/md/APAC# AirGroupprofile activate
AirGroupprofile “profile3” mode centralised
2: All the MDs under APAC ( Device M3 and Device M4 ) will run AirGroup service centrally. It means that all the packets from
these devices will be picked up openflow and AirGroup policy will be enforced centrally from MM.
/md/NorthAmerica/California# AirGroupprofile activate
AirGroupprofile “profile2” mode centralised
3: M2 will run centralised

34. 34
Island with diagram

35. 35
Island concept
• In this case California and APAC will be considered as two different islands.
• Discovery will not work across the islands even if both the nodes are running centralized.

36. 36
Configuration – Node Specific
• In VMM(MM-MD) and MCM topology AirGroup configurations are allowed only on /md and
below. AirGroup configs are not allowed on /mm and /mm/mynode.
• In Standalone topology, AirGroup configurations are allowed only on /mm. AirGroup configs
are not allowed on /mynode. Because there is no md in a standalone controller .

37. 37
AirGroup Dashboard
• Navigation: Dashboard > AirGroup

38. 38
AirGroup Dashboard
• Navigation: Dashboard > AirGroup

39. 39
Show Commands – New
Following are the new show commands introduced in 8.2
This command will show the distribution of AirGroup switches and the profiles that are mapped.
#show AirGroup switches
AirGroup Switch table
---------------------
Mac IP Node path Config path Active Profile Centralised/Distributed
--- -- --------- ----------- -------------- -----------------------
00:1a:1e:00:05:90 10.15.20.41 /md/North America/Newyork /md/North America/Newyor profile1 Distributed
00:00:00:11:11:11 10.15.20.45 /md/North America/Californ /md/NorthAmerica profile2 Centralised
00:1a:1e:01:26:e8 10.15.20.40 /md/APAC/beijing /md profile3 Centralised
00:1a:1e:01:be:20 10.15.20.24 /md/APAC/Bangalore /md profile3 Centralised

40. 40
Show Commands – New

41. 41
Show Commands – New
• This command is node based.

42. 42
Show Commands – New

43. 43
Show Commands – New
These commands will remain same as in 6.x . But , the commands will remain node based.
• “show AirGroupservice”
• “show AirGroupservice verbose”
• “ show AirGroup servers”
• “ show AirGroup users”

44. 44
Debugging.
• Debugging logs and commands will remain same as in 6.x or 8.0
• For debugging AirGroup issues, enable debugging for mdns process under system, security and user debug
logs.
− #logging user process mdns level debugging
− #logging system process mdns level debugging
− #logging security process mdns level debugging
• In case of Centralized the debugs needs to enabled under /MM
• In case of Distributed the debugs need to enabled under /MD

45. 45
Debugging…

46. 46
Debugging…

47. 47
What has changed from earlier versions
• There is no change in functionality in 8.2. However, the method of configuring AirGroup has changed.
• No need for AirGroup mdns enable or AirGroup dlna enable – Based on the service ids present in the
profile mdns or dlna can be auto enabled or disabled internally.
• No need for AirGroup-service level enable – If a service is added as part of airgorupprofile then the service
is enabled otherwise its disabled.
• AirGroupprofile cppm now needs a profile name. One can have different AirGroupprofile cppm and attach it
to the profile. Thus single MM can be serviced by multiple cppm-server for AirGroup.

48. 48
MigrationUpgrade to 8.2
• When upgraded from 6.x to 8.2 with the Migration tool. AirGroup will be running Distributed and will have
all the configs similar to those in 6.x. The configs will be mapped under “migrated-config” profile
• Upgrade from 8.x to 8.2 . 8.x will have centralized by default . After upgrade 8.2 will continue to be running
in centralized .
• From 8.x to 8.2 all the old service names and the new default service names will be present after upgrade.
• This is supported for all topologies.

49. 49
Use Cases – Customer Deployment 6.x to 8.2
AirGroup enable
AirGroup mdns "enable"
AirGroup dlna "enable"
AirGroup location-discovery "enable"
AirGroup global-credits 2000 1500
AirGroup active-wireless-discovery "enable"
AirGroup vlan 1 "disallow” servers
AirGroup vlan 301 "disallow” users
AirGroupservice "airplay"
id "_airplay._tcp"
id "_raop._tcp"
id "_appletv-v2._tcp”
disallow-vlan "101” servers
disallow-role”employee” servers
disallow-role“guest” users
description "AirPlay”
AirGroup service "airplay" enable
AirGroup service "DIAL" enable
Configuration Example New format
AirGroupprofile service default-airplay
id _airplay._tcp
id _appletv-v2._tcp
id _raop._tcp
AirGroupprofile service default-dial
id urn:dial-multiscreen-org:service:dial:1
id urn:dial-multiscreen-org:device:dial:1
AirGroupprofile default
service default-airplay
service default-dial
disallow-vlan 1 servers
disallow-vlan 301 users
disallow-vlan 101 servers default_airplay
disallow-role employee servers default_airplay
disallow-role guest users default_airplay
>>> VLAN 1 and 301 are global disallow
>>> VLAN 101 are disallow only for airplay service
>>> No servers published by employee will be learnt
>>> No query from guest users will be allowed

50. 50
Deployment guidelines
Topology Recommendation
Distributed When the MDs are present in a remote location
and where latency and Bandwidth utilization
would be an overhead for the communication
between MD and MM
Centralized When MDs are co-located and latency or
bandwidth utilization would not be a concern.
Centralized with Islands When you want to run centralized , but want to
separate AirGroup functionality based on region
or building .

51. SCENARIOS AND KNOW ISSUES

52. 52
Server from other controllers not discoverable in centralized mode
• Here we have two nodes blr and che. Both mapped with AirGroup profiles blr and che respectively in
centralized mode.
• The users in each node are able to discover only the AG servers only on their respective MDs and not across
the MDs.

53. 53
Continued..

54. 54
Continued..
When one activates a profile in any node, it forms an island with that as the head. Now user will always see servers
of that island only.

55. 55
Known Issue
Symptom: AirGroup loses all the learned server and user details and also fails to learn any new
user or server details.
Scenario: This issue occurs whenever an AirGroup service or profile is modified. This issue is
observed in ArubaOS 8.2.0.0 or later versions in centralized mode.
Workaround: Re-enable AirGroup on the node by using the following commands:
no AirGroupprofile activate
!
AirGroupprofile activate AirGroupprofile <profile-name > mode <mode>
!

56. THANK YOU!