ArubaOS 8.x AP Console Protection

Recent versions of ArubaOS 8.x  have introduced the concept of AP console protection.

 

This includes default enablement of:

• AP console protection (a password is required to access the CLI)
• a randomized password (is automatically applied to protect your console)

To see that randomized password:

find your AP's Controller

• on your Mobility Conductor (formerly known as Mobility Master)
• #cd /mm
• #show ap database
• find the AP your interested in, notice it's Group and switch IP

(MM-1) [mm] #show ap database

           

AP Database

-----------

Name  Group    AP Type  IP Address   Status    Flags  Switch IP    Standby IP

----  -----    -------  ----------   ------    -----  ---------    ----------

AP1   default  335      10.1.13.150  Up 9m:0s  2      10.1.13.100  0.0.0.0

• #logon "your switch IP"
• notice you just performed a SSO logon to your gateway/controller

• on your Mobility Controller

• #show ap-group <your ap-group> | include "AP system profile"
• notice the profile-name in the output
• replace" Group" with the group name in the show ap database output

(MC1) [MDC] #show ap-group default | include "system profile"

AP system profile                        default  

• #encrypt disable
• allow your passwords to be displayed on your show output
• "encrypt enable" should automatically be applied after a few minutes

• #show ap system-profile "profile-name" | include Password
• notice you AP Console Password in the output

(MC1) [MDC] #show ap system-profile default | include Password

AP Console Password                        4636a15d+|H!~.

Change the AP Console randomized password to "aruba123":

• on your Mobility Conductor
• #cd /md
• #configure terminal
• #ap system-profile default
• #ap console-password aruba123
• write memory

(MM-1) [mm] #cd /md

(MM-1) [md] #configure terminal

Enter Configuration commands, one per line. End with CNTL/Z

(MM-1) [md] (config) #ap system-profile default

(MM-1) ^[md] (AP system profile "default") #ap-console-password aruba123

(MM-1) ^[md] (AP system profile "default") #write memory 

Disable the AP Console password

• #cd /md
• #configure terminal
• #ap system-profile default
• #no ap console-protection
• write memory

(MM-1) [mm] #cd /md

(MM-1) [md] #configure terminal

Enter Configuration commands, one per line. End with CNTL/Z

(MM-1) [md] (config) #ap system-profile default

(MM-1) ^[md] (AP system profile "default") #no ap-console-protection

(MM-1) ^[md] (AP system profile "default") #write memory