Using DHCP Option 121 on ArubaOS 8.x Mobility Controller

Supporting Classless Static Route
(Option 121) on ArubaOS 8.x

Sometimes you need your ArubaOS 8.x Controller hosted DHCP Server IPv4 pool to offer a client a reservation that does not include option 3, the clients default gateway.  Instead you can use option 121 and offer these clients a single or list of DHCP derived static routes with a next-hop of your choice.

 Setting up DHCP Option 121 on ArubaOS
  • tested on: ArubaOS 8.3.0.[26]
  • need to: offer option 121 to clients of an DHCP server/scope hosted on an MC
  • issue: you cannot complete this configuration from the MM or Standalone MC GUI as the hex option is missing

  • see the following code sample implemented via the CLI that did work:
ip dhcp pool vlan_666 option 121 hex "18AC1E00C0A80101" network 192.168.1.0 255.255.255.0 authoritative
  • decoding the meaning of the hex value: 18AC1E00C0A80101
    • destmask: 18 = 24 bit mask
    • destip:      AC.1E.00 = 172.30.0
    • nexthop:   C0.A8.01.01 = 192.168.1.1
  • noteworthy comments
    • Campus APs (CAPs) do not support option 121 static routes (sadly)
If you think I should add or remove any information from this list, please let me know your thoughts.

Comments

Post a Comment

Popular posts from this blog

NET::ERR_CERT_INVALID Issues Using AirWave or NetEDIT with Chrome

Image
Using Chrome to login to Aruba Airwave or NetEdit with Unsupported Certificate.   Lately Chrome, Opera, Safari, etc... all but Firefox won't allow connection to ArubaNetworks Airwave with it's self-signed cert installed.  I has this issue with Airwave 8.2.11.  This also works with for similar errors on NetEdit 2.04. There is a workaround for Chrome...  while you are stuck with this issue:   NET::ERR_CERT_INVALID Click anywhere on the rendered page with the error, and simply type: thisisunsafe no need to press enter, just type it in, and you can proceed without probems!!! Credit to Hai Zheng of Twitter for this tip !!! If you think I should add or remove any information from this list, please let me know your thoughts.
Read more

ClearPass - Network Access Control (NAC) based on Windows Client OS Version and Build number

Image
How to manage Windows client network access based on their OS version and build number in CPPM Enforcement Policies Summary:  for enforcement policy to be based on "Windows OS Build version" you will need to implement OnGuard, and via the Health Check Service you will be able to witness the Windows Build version.  You will need to create a new Endpoint record to store these details, then create an Enforcement Profile to store the information in the EndpointDB.  From there you can then use roll mapping policies that reference the build number in your services. From CPPM > Monitoring > Live Monitoring > Access Tracker >  find a relevant Source = WEBAUTH, Service = Health Check Service record and open it to the Input tab Scroll down to the Computed Attributes section, here you can find version information collected by OnGuard agent in the Endpoint such as: Host:      OSArch                x86_64 Host:      OSName                Microsoft Windows 10 Enterprise Ed
Read more