great-tk

2017年1月13日金曜日

Controller: Regulatory profile

(QA7210-203) #show ap regulatory

New DRT File
Regulatory Version :1.0_50970

(MC)#show ap allowed-max-EIRP ap-name AP225

Max EIRP setting for AP-225
---------------------------
Channel 1 2 3 4 5 6 7 8 9 10 11 12 13 14 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
------- - - - - - - - - - -- -- -- -- -- -- -- -- -- -- -- -- -- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
b 25 25 25 25 25 25 25 25 25 25 25 25 25 * * * * * * * * * * * * * * * * * * * * * * * * * *
g/a 25 25 25 25 25 25 25 25 25 25 25 25 25 * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
HT 20 25 25 25 25 25 25 25 25 25 25 25 25 25 * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
HT 40 25 25 25 25 25 25 25 25 25 25 25 25 25 * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
VHT 80 * * * * * * * * * * * * * * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *

(MC)#show ap allowed-max-EIRP ap-name AP275

Max EIRP setting for AP-275
---------------------------
Channel 1 2 3 4 5 6 7 8 9 10 11 12 13 14 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
------- - - - - - - - - - -- -- -- -- -- -- -- -- -- -- -- -- -- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
b 29 29 29 29 29 29 29 29 29 29 29 29 29 * * * * * * * * * * * * * * * * * * * * * * * * * *
g/a 29 29 29 29 29 29 29 29 29 29 29 29 29 * 22 22 22 22 22 22 22 22 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
HT 20 29 29 29 29 29 29 29 29 29 29 29 29 29 * 22 22 22 22 22 22 22 22 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
HT 40 29 29 29 29 29 29 29 29 29 29 29 29 29 * 22 22 22 22 22 22 22 22 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
VHT 80 * * * * * * * * * * * * * * 22 22 22 22 22 22 22 22 29 29 29 29 29 29 29 29 29 29 29 * * * * * *

(MC)#show ap allowed-max-EIRP ap-name AP215

Max EIRP setting for AP-215
---------------------------
Channel 1 2 3 4 5 6 7 8 9 10 11 12 13 14 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
------- - - - - - - - - - -- -- -- -- -- -- -- -- -- -- -- -- -- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
b 30 30 30 30 30 30 30 30 30 30 30 30 30 * * * * * * * * * * * * * * * * * * * * * * * * * *
g/a 30 30 30 30 30 30 30 30 30 30 30 30 30 * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
HT 20 30 30 30 30 30 30 30 30 30 30 30 30 30 * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *
HT 40 30 30 30 30 30 30 30 30 30 30 30 30 30 * 23 23 23 23 23 23 23 23 27 27 27 27 27 27 27 27 27 27 27 * * * * * *
VHT 80 * * * * * * * * * * * * * * 23 23 23 23 23 23 23 23 29 29 29 29 29 29 29 29 29 29 29 * * * * * *

(MC)#show ap allowed-max-EIRP ap-name AP205

Max EIRP setting for AP-205
---------------------------
Channel 1 2 3 4 5 6 7 8 9 10 11 12 13 14 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
------- - - - - - - - - - -- -- -- -- -- -- -- -- -- -- -- -- -- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
b 28 28 28 28 28 28 28 28 28 28 28 28 28 * * * * * * * * * * * * * * * * * * * * * * * * * *
g/a 28 28 28 28 28 28 28 28 28 28 28 28 28 * 23 23 23 23 23 23 23 23 30 30 30 30 30 30 30 30 30 30 30 * * * * * *
HT 20 28 28 28 28 28 28 28 28 28 28 28 28 28 * 23 23 23 23 23 23 23 23 30 30 30 30 30 30 30 30 30 30 30 * * * * * *
HT 40 28 28 28 28 28 28 28 28 28 28 28 28 28 * 22 22 22 22 22 22 22 22 28 28 28 28 28 28 28 28 28 28 28 * * * * * *
VHT 80 * * * * * * * * * * * * * * 22 22 22 22 22 22 22 22 28 28 28 28 28 28 28 28 28 28 28 * * * * * *

(MC)#show ap allowed-max-EIRP ap-name AP105

Max EIRP setting for AP-105
---------------------------
Channel 1 2 3 4 5 6 7 8 9 10 11 12 13 14 36 40 44 48 52 56 60 64 100 104 108 112 116 120 124 128 132 136 140 144 149 153 157 161 165
------- - - - - - - - - - -- -- -- -- -- -- -- -- -- -- -- -- -- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
b 24 24 24 24 24 24 24 24 24 24 24 24 24 * * * * * * * * * * * * * * * * * * * * * * * * * *
g/a 20 20 20 20 20 20 20 20 20 20 20 20 20 * 22 22 22 22 22 22 22 22 25 25 25 25 25 25 25 25 25 25 25 * * * * * *
HT 20 19 19 19 19 19 19 19 19 19 19 19 19 19 * 21 21 21 21 21 21 21 21 25 25 25 25 25 25 25 25 25 25 25 * * * * * *
HT 40 23 23 23 23 23 23 23 23 23 23 23 23 23 * 22 22 22 22 22 22 22 22 25 25 25 25 25 25 25 25 25 25 25 * * * * * *

2016年5月19日木曜日

Controller: 802.11v frame

AP機能のパケットキャプチャログ
WiresharkでもAiropeek/OmniPeekのカプセルに対応。

Signal/Noise/Data Rate/Channel等の表示がされている。

Probe Request (0x0004)を確認
Destination address : Broadcast(ff:ff:ff:ff:ff:ff)
BSS Id: Broadcast(ff:ff:ff:ff:ff:ff)

Wireless LAN management frame
SSID parameter:
Supported rates: 6, 9, 12, [Mbit/sec]
HT Capabilities : 802.11n D1.10
Extended Capabilities(8 octets)
Interworking
VHT Capabilities:
Vendor Specific: Microsof: unknown 8
Vendor Specific: Broadcom

Extended Capabilities: Octet 3
BSS Transition: Supported

Probe Response/Associate Requestにも同様にBSS Transition: Supportedが送信される。
Probe Response

Associate Request

2016年5月10日火曜日

ClearPass: Oauth

ClearPass Oauth Request送信方法。

参考リンク

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/How-to-create-update-delete-ClearPass-Guest-Accounts-using-REST/ta-p/243745

http://community.arubanetworks.com/aruba/attachments/aruba/aaa-nac-guest-access-byod/20924/1/Using%20the%20ClearPass%20HTTP%20APIs.pdf

curl -X POST "https://test.clearpassbeta.com/api/oauth" \

-H "Content-Type: application/json" \

-d $'{"grant_type": "password", "username": "qa", "password": "aruba123", "client_id": "meridian"}' \

-m 30 \

-v \

-k

---------------

Aruba-no-MacBook-Air-2:~ aruba$ curl -X POST "https://clearpass.arubademo.net/api/oauth" -H "Content-Type: application/json" -d $'{"grant_type": "password", "username": "kurokawa@hpe.com", "password": "3590", "client_id": "meridian"}' -m 30 -v -k

* Trying 104.36.251.158...

* Connected to clearpass.arubademo.net (104.36.251.158) port 443 (#0)

* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

* Server certificate: clearpass.arubademo.net

* Server certificate: Go Daddy Secure Certificate Authority - G2

* Server certificate: Go Daddy Root Certificate Authority - G2

> POST /api/oauth HTTP/1.1

> Host: clearpass.arubademo.net

> User-Agent: curl/7.43.0

> Accept: */*

> Content-Type: application/json

> Content-Length: 103

* upload completely sent off: 103 out of 103 bytes

< HTTP/1.1 200 OK

< Date: Tue, 10 May 2016 04:39:37 GMT

< Server: Apache

< X-Powered-By: PHP/5.5.30

< Cache-Control: no-store

< Pragma: no-cache

< Content-Length: 173

< Content-Type: application/json

* Connection #0 to host clearpass.arubademo.net left intact

{"access_token":"c646a32bb703c907502280bbee513c2a6f0e6e2d","expires_in":604800,"token_type":"Bearer","scope":null,"refresh_token":"f1953e0ed08e1b8b926d635aaf9669e4e33d33b6"}

Aruba-no-MacBook-Air-2:~ aruba$

-----------------

ClearPass API: access_tokenからの逆引き

https://clearpass.arubademo.net/api-docs/OperatorLogins-v1#!/GetAccount

Authorization:Bearer 7f216595d41eb90157944a8e67e76b09c2736376

{

"visitor_name": "TK",

"info": "XXX@hpe.com",

"name": "TK",

"guest_email": "XXX@hpe.com",

"badge_id": "102865"

}

-----------------

ClearPass API: access_tokenからの逆引きでcurlを使った場合

curl -X GET "https://clearpass.arubademo.net:443/api/oauth/me" \

-H "Accept: application/json" \

-H "Authorization: Bearer 7f216595d41eb90157944a8e67e76b09c2736376" \

-m 30 \

-v \

-k

Aruba-no-MacBook-Air-2:~ aruba$ curl -X GET "https://clearpass.arubademo.net:443/api/oauth/me" \

> -H "Accept: application/json" \

> -H "Authorization: Bearer 7f216595d41eb90157944a8e67e76b09c2736376" \

> -m 30 \

> -v \

> -k

* Trying 104.36.251.158...

* Connected to clearpass.arubademo.net (104.36.251.158) port 443 (#0)

* TLS 1.2 connection using TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

* Server certificate: clearpass.arubademo.net

* Server certificate: Go Daddy Secure Certificate Authority - G2

* Server certificate: Go Daddy Root Certificate Authority - G2

> GET /api/oauth/me HTTP/1.1

> Host: clearpass.arubademo.net

> User-Agent: curl/7.43.0

> Accept: application/json

> Authorization: Bearer 7f216595d41eb90157944a8e67e76b09c2736376

< HTTP/1.1 200 OK

< Date: Tue, 10 May 2016 04:45:58 GMT

< Server: Apache

< X-Powered-By: PHP/5.5.30

< Content-Length: 112

< Content-Type: application/json; charset=utf-8

* Connection #0 to host clearpass.arubademo.net left intact

{"visitor_name":"TK","info":"XXX@hpe.com","name":"TK","guest_email":"XXX@hpe.com","badge_id":"102865"}

Meridian: memo post message

meridianのpost message

tcpdumpオプション。参考にしたページ。

http://qiita.com/LOUIS_rui/items/cc73ade2c115ee96b22a

tcpdump -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)’

[root@ip-172-31-27-217 ~]# tcpdump -A 'tcp dst port 80 and (tcp[((tcp[12:1] & 0xf0) >> 2):4] = 0x504f5354)'

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode

listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes

21:18:51.765462 IP 155.195.178.107.gae.googleusercontent.com.42996 > ip-172-31-27-217.ap-northeast-1.compute.internal.http: Flags [P.], seq 1195380886:1195381436, ack 1221387923, win 338, options [nop,nop,TS val 2878997545 ecr 1231919], length 550

E..Z....,...k..........PG@..H......R.......

...).../POST /top2.html/ HTTP/1.1

Host: 52.196.145.104

Content-Type: application/x-www-form-urlencoded

Authorization: Bearer e72e16c7e42f292c6912e7710c838347ae178b4a

Accept: application/json

X-Cloud-Trace-Context: 01b58a7df47243fb52270f4f0176afc5/10054798598419312497

Content-Length: 113

Connection: Keep-alive

User-Agent: AppEngine-Google; (+http://code.google.com/appengine; appid: s~meridianedit)

Accept-Encoding: gzip,deflate,br

campaign_id=5838267693924352&broadcaster_id=85BAEDEA-1ACE-404B-874D-29AC21C18D58%3A1000%3A1000&device_id=b312hb12

今度はCamupusAppで挑戦

21:29:10.431804 IP 155.195.178.107.gae.googleusercontent.com.56676 > ip-172-31-27-217.ap-northeast-1.compute.internal.http: Flags [P.], seq 3938895029:3938895605, ack 1002172944, win 338, options [nop,nop,TS val 2879616190 ecr 1850577], length 576

E..t....,...k........d.P....;......RK......

..t...<.POST /top2.html/ HTTP/1.1

Host: 52.196.145.104

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

Accept: application/json

X-Cloud-Trace-Context: c66fc58921ca8743c88a766b5bc0e585/11051419201282406574

Content-Length: 182

Connection: Keep-alive

User-Agent: AppEngine-Google; (+http://code.google.com/appengine; appid: s~meridianedit)

Accept-Encoding: gzip,deflate,br

is_enter=1&campaign_id=5838267693924352&broadcaster_id=85BAEDEA-1ACE-404B-874D-29AC21C18D58%3A16005%3A17237&device_id=34C1572A-FFB4-465E-B4D5-6AAB4D5C2CC3%3Acom.arubanetworks.Beacons

------------------------------------------------------------

[root@ip-172-31-27-217 ~]# tail /var/log/httpd/access_log

107.178.195.155 - - [09/May/2016:21:29:10 -0400] "POST /top2.html/ HTTP/1.1" 404 289 "-" "AppEngine-Google; (+http://code.google.com/appengine; appid: s~meridianedit)"

[root@ip-172-31-27-217 ~]# tail /var/log/httpd/access_log

107.178.195.155 - - [09/May/2016:21:29:10 -0400] "POST /top2.html/ HTTP/1.1" 404 289 "-" "AppEngine-Google; (+http://code.google.com/appengine; appid: s~meridianedit)"

AppViewerでキック

22:08:57.887969 IP 155.195.178.107.gae.googleusercontent.com.36438 > ip-172-31-27-217.ap-northeast-1.compute.internal.http: Flags [P.], seq 32345798:32346490, ack 2670821938, win 338, options [nop,nop,TS val 2882003602 ecr 4238022], length 692

E...c...,.0.k........V.P.....1.2...R.c.....

.....@..POST /top2.html/ HTTP/1.1

Host: 52.196.145.104

Accept-Language: en

Content-Type: application/x-www-form-urlencoded

Authorization: Bearer 7f216595d41eb90157944a8e67e76b09c2736376

Accept: application/json

X-Cloud-Trace-Context: 833b1b781f70a2ec7c26fdc0e0781ee8/9675176237563929392

Content-Length: 235

Connection: Keep-alive

User-Agent: AppEngine-Google; (+http://code.google.com/appengine; appid: s~meridianedit)

Accept-Encoding: gzip,deflate,br

is_enter=1&access_token=7f216595d41eb90157944a8e67e76b09c2736376&campaign_id=5838267693924352&broadcaster_id=85BAEDEA-1ACE-404B-874D-29AC21C18D58%3A16005%3A17237&device_id=34C1572A-FFB4-465E-B4D5-6AAB4D5C2CC3%3Acom.arubanetworks.campus

2016年4月13日水曜日

Linux: ping options

1) 以下のIPに断続のPingをしたい場合

10.215.1.0/24 - Office segment

.200-209 - reserved for TK

for ((i = 200 ; i <= 209 ; i++)); do ping -c 1 10.215.1.${i}; done

Aruba-no-MacBook-Air-2:~ aruba$ for ((i = 1 ; i <= 4 ; i++)); do ping -c 1 10.215.1.${i}; done

PING 10.215.1.1 (10.215.1.1): 56 data bytes

64 bytes from 10.215.1.1: icmp_seq=0 ttl=63 time=2.580 ms

--- 10.215.1.1 ping statistics ---

1 packets transmitted, 1 packets received, 0.0% packet loss

round-trip min/avg/max/stddev = 2.580/2.580/2.580/0.000 ms

PING 10.215.1.2 (10.215.1.2): 56 data bytes

92 bytes from 10.215.250.1: Destination Host Unreachable

Vr HL TOS Len ID Flg off TTL Pro cks Src Dst

4 5 e0 5400 18b3 0 0000 3f 01 5102 10.215.250.100 10.215.1.2

参考リンク

http://hatyuki.hatenablog.jp/entry/20080123/1201055787

2016年1月27日水曜日

modem parameters

====================
SIM-tech
====================
設置値保持値
usb_type=2
usb_dev=0x05C6CEA5
usb_dial=ATDT*99***1#
usb_init=AT+CGDCONT=1,IP,lte-d.ocn.ne.jp
usb_tty=ttyUSB1

usb_type=2
usb_dev=0x05C6CEA5
usb_dial=ATDT*99***1#
usb_tty=ttyUSB1
usb_init=AT+CGDCONT=1,"IP","mopera.net"

usb_init=usb_init=AT+CGDCONT=1,"IP","lte-d.ocn.ne.jp","0.0.0.0”,0,0

設定入力値(apboot)
set usb_type 2
set usb_dev 0x05C6CEA5
set usb_dial ATDT*99***1#
set usb_tty ttyUSB1
set usb_init AT+CGDCONT=1,\"IP\",\"mopera.net\"

for one of MVNO services.
====================
Fujisoft
====================
設定保持値
usb_type=2
usb_dev=0x1c9e9b11
usb_dial=ATDT*99***1#
usb_tty=ttyUSB1
usb_modeswitch=-v 1c9e -p 9bfe -V 1c9e -P 9b11 -M 55534243123456780000000080000606f50402527600000000000000000000
usb_init=AT+CGDCONT=1,"IP","lte-d.ocn.ne.jp",,0,0,0
usb_user=mobileid@ocn.hoge
usb_passwd=mobile.hoge

*OCN
設定入力値(apboot)
set usb_type 2
set usb_dev 0x1c9e9b11
set usb_tty ttyUSB1
set usb_dial ATDT*99***1#
set usb_init AT+CGDCONT=1,\"IP\",\"lte-d.ocn.ne.jp\",,0,0,0
set usb_modeswitch "-v 1c9e -p 9bfe -V 1c9e -P 9b11 -M 55534243123456780000000080000606f50402527600000000000000000000"
set usb_user mobileid@ocn.hoge
set usb_passwd mobile.hoge

Mopera
設定入力値(apboot)
set usb_type 2
set usb_dev 0x1c9e9b11
set usb_tty ttyUSB1
set usb_dial ATDT*99***1#
set usb_init AT+CGDCONT=1,\"IP\",\"mopera.net\",,0,0,0
set usb_modeswitch "-v 1c9e -p 9bfe -V 1c9e -P 9b11 -M 55534243123456780000000080000606f50402527600000000000000000000"

2016年1月13日水曜日

UIApplication.sharedApplication().openURL(NSURL(string:"prefs:root=Bluetooth")!)

2015年12月16日水曜日

SHA2 support

Vendors support

General Japan's papers

IPA

https://www.ipa.go.jp/files/000013899.pdf

GlobalSign

https://jp.globalsign.com/information/important/detail.php?no=1444268118

Cybertrust

https://www.cybertrust.ne.jp/sureserver/productinfo/sha1ms.html

Blog

http://blogs.technet.com/b/jpsecurity/archive/2015/11/02/faq-microsoft-policy-on-sha1-deprecation.aspx

2015年11月4日水曜日

DFS

DFSのレーダーは約30分後にクリアされる

(Aruba3200) #show log all | include Radar
Nov 2 18:30:36 sapd[825]: <404076> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: Radar detected on interface wifi0, channel 100, typeid 11
Nov 2 18:30:37 sapd[825]: <404088> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: ARM HT Radar Detected Trigger Current Channel old 100+ new 132+/12
Nov 2 19:01:48 sapd[825]: <404102> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: ARM - Radar event cleared on channel 100
Nov 4 18:47:20 sapd[825]: <404076> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: Radar detected on interface wifi0, channel 100, typeid 5
Nov 4 18:47:20 sapd[825]: <404088> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: ARM HT Radar Detected Trigger Current Channel old 100+ new 108+/12
Nov 4 19:10:20 sapd[825]: <404076> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: Radar detected on interface wifi0, channel 108, typeid 0
Nov 4 19:10:21 sapd[825]: <404088> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: ARM HT Radar Detected Trigger Current Channel old 108+ new 132+/12
Nov 4 19:18:26 sapd[825]: <404102> <WARN> |AP AP2@10.215.1.27 sapd| AM 00:24:6c:83:3f:58: ARM - Radar event cleared on channel 100

2015年9月1日火曜日

Control-Plane-Security: CPSec

Step1. default はAuto Cert Provisioningはオフになっているので、オンにする。
Step2. リブート後に成功。

(Aruba7210-1) (Control Plane Security Profile) # show control-plane-security

Control Plane Security Profile
------------------------------
Parameter Value
--------- -----
Control Plane Security Enabled
Auto Cert Provisioning Disabled
Auto Cert Allow All Enabled
Auto Cert Allowed Addresses N/A

(Aruba7210-1) (Control Plane Security Profile) #auto-cert-?
auto-cert-allow-all When enabled, automatic certificate provisioning is
allowed on all APs. When disabled, only APs whose IP
addresses are in the ranges specified by
auto-cert-allowed-addrs are allowed.
auto-cert-allowed-add.. Range of AP IP addresses allowed for automatic
certificate provisioning. Multiple ranges may be
specified.
auto-cert-prov Enable or disable automatic provisioning of
certificates on legacy APs

(Aruba7210-1) (Control Plane Security Profile) #auto-cert-prov ?
<cr>

(Aruba7210-1) (Control Plane Security Profile) #auto-cert-prov
(Aruba7210-1) (Control Plane Security Profile) #show control-plane-security

Control Plane Security Profile
------------------------------
Parameter Value
--------- -----
Control Plane Security Enabled
Auto Cert Provisioning Enabled
Auto Cert Allow All Enabled
Auto Cert Allowed Addresses N/A

(Aruba7210-1) #show ap database

AP Database
-----------
Name Group AP Type IP Address Status Flags Switch IP Standby IP
---- ----- ------- ---------- ------ ----- --------- ----------
93H TK-BP 93H 4.4.4.0 Up 12d:21h:36m:8s RI 10.215.107.128 0.0.0.0
AP-205-1 TK-BP 205 10.215.1.96 Up 1m:48s 2 10.215.107.128 0.0.0.0
RAP-1 TK-BP 105 4.4.4.1 Down R 10.215.107.128 0.0.0.0

Flags: U = Unprovisioned; N = Duplicate name; G = No such group; L = Unlicensed
I = Inactive; D = Dirty or no config; E = Regulatory Domain Mismatch
X = Maintenance Mode; P = PPPoE AP; B = Built-in AP; s = LACP striping
R = Remote AP; R- = Remote AP requires Auth; C = Cellular RAP;
c = CERT-based RAP; 1 = 802.1x authenticated AP; 2 = Using IKE version 2
u = Custom-Cert RAP; S = Standby-mode AP; J = USB cert at AP
i = Indoor; o = Outdoor
M = Mesh node; Y = Mesh Recovery

2015年8月4日火曜日

AOS: RAP password based

How to configure password-based RAP's configuration

Step1: setting isakmp key on controller
crypto isakmp key aruba123 address 0.0.0.0 netmask 0.0.0.0

Step2: setting password for each AP on controller
local-userdb add username kuro password aruba123 remote-ip 4.4.4.1 role ap-role

!provision-ap copy-provisioning-params ap-name "6c:f3:7f:cb:61:a6"

Step3: setting APs for RAP. AP needs to be connected to controller once based on CAP at least.

conf t
provision-ap
read-bootinfo ap-name "6c:f3:7f:cb:61:a6"
pap-user "kuro"
pap-passwd "aruba123"
ikepsk "aruba123"
master 10.215.107.126
server-ip 10.215.107.126
ap-group "TK-BP"
ap-name "RAP-1"
remote-ap
show provisioning-params
reprovision ap-name "6c:f3:7f:cb:61:a6"

Step4: logging function

logging level debugging arm
logging level debugging arm subcat client-match
logging level debugging network process dhcpd
logging level informational network
logging level debugging network subcat dhcp
logging level debugging security process authmgr
logging level debugging security process crypto
logging level debugging security
logging level debugging security subcat aaa
logging level debugging security subcat ike
logging level debugging system process stm
logging level informational system
logging level debugging system process stm subcat ap
logging level debugging user
logging level debugging user subcat client-match
logging level informational wireless

2015年5月19日火曜日

電安法についてのあれこれ

・PSEマークはACケーブル独立で調達を海外からする場合には輸入業者が取得を行う。

・ACケーブルと製品が専用品であれば、ケーブルのPSEマークの取得はExceptionとして必要ない。

・ただし、専用品の場合はユーザーに混乱をきたさないように製品とケーブルを一緒に出荷する。

・ACアダプターは上記のACケーブルのようなExceptionはなく、必ず輸入業者がPSEの取得が必要。

・ACアダプターのみを輸入業者が代行をするのが一般的。この役割をメーカーのパートナーが担う。
・メーカーは外国の向上引き渡しで輸入はパートナーが行っていることになっている。
・APのような製品は通常はパートナーが輸入業者
・アダプターは日本で他が輸入したものをパートナーが日本で調達している。

【例外】

・日本の外資系メーカは会計上では物を販売していないことになっているので、輸入業者にはならない。
・同梱しているものは便宜上はArubaがアダプターのみ輸入しているのをパートナーに委託した形となっている。

2015年5月9日土曜日

AP: AP's setenv

apbootのコマンド:
name: AP-name
group: AP-group
master: controller
serverip: controller

name=AP1
group=test1
master=1015.200.197
serverip=0.197
a_ant_gain=cd373c172b56f83028d3a730ab478e0d12540551000020x002
g_ant_gain=cd373c172b56f83028d3a730ab478e0d12540551000020x002

リバースエンジニアリング的には以下のスペックが分かる。メモリは512Mbytes

Model: AP-22x
CPU0: P1020E, Version: 1.1, (0x80ec0011)
Core: E500, Version: 5.1, (0x80212051)
Clock:
CPU0: 800 MHz
CPU1: 800 MHz
CCB: 400 MHz
DDR: 333.333 MHz (666.667 MT/s data rate) (Asynchronous)

DRAM: Configuring DDR for 666.667 MT/s data rate
DDR: 512 MB (DDR3, 32-bit, CL=5, ECC off)

APのインターフェースは
anul0, ap0, bond0, br0, eht0, eth1, gre0, lo等がある。br0に外部からのAPのアドレスがふられている。

以下APのコンソールログ

~ # ifconfig
anul0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

ap0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP RUNNING MTU:0 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

bond0 Link encap:Ethernet HWaddr 6C:F3:7F:C6:77:7A
inet6 addr: fe80::6ef3:7fff:fec6:777a/64 Scope:Link
UP BROADCAST RUNNING MASTER MULTICAST MTU:1500 Metric:1
RX packets:82 errors:0 dropped:0 overruns:0 frame:0
TX packets:24 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:8206 (8.0 KiB) TX bytes:2820 (2.7 KiB)

br0 Link encap:Ethernet HWaddr 6C:F3:7F:C6:77:7A
inet addr:10.215.1.22 Bcast:10.215.1.255 Mask:255.255.255.0
inet6 addr: fe80::6ef3:7fff:fec6:777a/64 Scope:Link
UP BROADCAST RUNNING ALLMULTI MULTICAST MTU:1500 Metric:1
RX packets:82 errors:0 dropped:0 overruns:0 frame:0
TX packets:71 errors:0 dropped:69 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

eth0 Link encap:Ethernet HWaddr 6C:F3:7F:C6:77:7A
UP BROADCAST RUNNING SLAVE MULTICAST MTU:9000 Metric:1
RX packets:82 errors:0 dropped:0 overruns:0 frame:0
TX packets:24 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:8206 (8.0 KiB) TX bytes:2820 (2.7 KiB)
Base address:0xa000

eth1 Link encap:Ethernet HWaddr 6C:F3:7F:C6:77:7A
UP BROADCAST SLAVE MULTICAST MTU:9000 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)
Base address:0x2000

gre0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
UP RUNNING MTU:0 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:16436 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:0 (0.0 B) TX bytes:0 (0.0 B)

~ # Switching to Full Access
~ # rebot
/bin/sh: rebot: not found
~ # reboot
The system is going down NOW !!
Sending SIGTERM to all processes.
Please stand by while rebooting the system.
Restarting system.

APBoot 1.4.0.2 (build 37665)
Built: 2013-03-18 at 15:36:24

Model: AP-22x
CPU0: P1020E, Version: 1.1, (0x80ec0011)
Core: E500, Version: 5.1, (0x80212051)
Clock:
CPU0: 800 MHz
CPU1: 800 MHz
CCB: 400 MHz
DDR: 333.333 MHz (666.667 MT/s data rate) (Asynchronous)
LBC: 25 MHz
L1: D-cache 32KB enabled
I-cache 32KB enabled
I2C: ready
DRAM: Configuring DDR for 666.667 MT/s data rate
DDR: 512 MB (DDR3, 32-bit, CL=5, ECC off)
POST1: memory passed
Flash: 32 MB
L2: 256 KB enabled
Power: 802.3at POE
PCIe1: RC, link up, x1
dev fn venID devID class rev MBAR0 MBAR1 MBAR2 MBAR3
00 00 14e4 43a2 00002 03 80000004 00000000 80200004 00000000
PCIe2: RC, link up, x1
dev fn venID devID class rev MBAR0 MBAR1 MBAR2 MBAR3
00 00 14e4 43a1 00002 03 a0000004 00000000 a0200004 00000000
Net: eth0, eth1
Radio: bcm43460#0, bcm43460#1

Hit <Enter> to stop autoboot: 0
apboot> printenv
bootdelay=2
baudrate=9600
autoload=n
boardname=Ardmore
servername=aruba-master
bootcmd=boot ap
autostart=yes
bootfile=e500.ari
ethaddr=6c:f3:7f:c6:77:7a
name=AP1
group=test1
master=1015.200.197
serverip=0.197
a_ant_gain=cd373c172b56f83028d3a730ab478e0d12540551000020x002
g_ant_gain=cd373c172b56f83028d3a730ab478e0d12540551000020x002
start_type=warm_start
stdin=serial
stdout=serial
stderr=serial
ethact=eth0

Environment size: 408/131068 bytes
apboot> printenv

2015年4月22日水曜日

IAP: RADIUS

IETFのSession-Timeout (27) とIdle-Timeout (28)でコントロール出来ます。

===========================

Default (3600 secs = 60 minutesに再認証間隔を設定。idle-timeout はデフォルトは1000

===========================

6c:f3:7f:c5:35:68# show clients debug

Client List

-----------

Name IP Address MAC Address OS Network Access Point Channel Type Role Signal Speed (mbps) *Reauth Age *Reauth Interval *Reauth ESSID *Authenticated DEL Age Vlan *ESSID *Private role info Accouting Session Name Accouting Start time BSSID Idle Timeout csum *mcast groups *Acct Interval *Class Attribute *Dhcp-Opt Vlan *Dhcp-Opt role Intercept Offline *FB Token *FB RxBytes *FB TxBytes

---- ---------- ----------- -- ------- ------------ ------- ---- ---- ------ ------------ ----------- ---------------- ------------- -------------- --- --- ---- ------ ------------------ ---------------------- -------------------- ----- ------------ ---- ------------- -------------- ---------------- -------------- -------------- --------- ------- --------- ----------- -----------

user1 10.215.1.35 7c:fa:df:80:7f:da TK-IAP-205-EAP 6c:f3:7f:c5:35:68 52+ AN TK-IAP-205-EAP 31(good) 60(ok) 10 3600 TK-IAP-205-EAP yes no 7 1(SSID) TK-IAP-205-EAP(EAP-PEAP) 144(RADIUS-7fff) user1 1422259993 6c:f3:7f:d3:56:93 1000 5c75e7c8 (0) 600 5e0cacfea57c4aa8af726af160b77caeb90b0000000000005230303030303036372d30312d35346335663737310000000000000000000000 0,(null) ,0,0-0 no no null null nul

================================

idel-timeout(300)をRADIUSで設定

================================

6c:f3:7f:c5:35:68# show clients debug

Client List

-----------

user2 10.215.1.35 7c:fa:df:80:7f:da TK-IAP-205-EAP 6c:f3:7f:c5:35:68 52+ AN TK-IAP-205-EAP 30(good) 60(ok) 36 3600 TK-IAP-205-EAP yes no 6 1(SSID) TK-IAP-205-EAP(EAP-PEAP) 144(RADIUS-7fff) user2 1422260822 6c:f3:7f:d3:56:93 300 81a84b14 (0) 600 null 0,(null) ,0,0-0 no no null null null

6c:f3:7f:c5:35:68#

================================

session-timeout(1200) をRADIUSで設定

================================

6c:f3:7f:c5:35:68# show clients debug

Client List

-----------

Name IP Address MAC Address OS Network Access Point Channel Type Role Signal Speed (mbps) *Reauth Age *Reauth Interval *Reauth ESSID *Authenticated DEL Age Vlan *ESSID *Private role info Accouting Session Name Accouting Start time BSSID Idle Timeout csum *mcast groups *Acct Interval *Class Attribute *Dhcp-Opt Vlan *Dhcp-Opt role Intercept Offline *FB Token *FB RxBytes *FB TxBytes

user3 10.215.1.35 7c:fa:df:80:7f:da TK-IAP-205-EAP 6c:f3:7f:c5:35:68 52+ AN TK-IAP-205-EAP 29(good) 60(poor) 10 1200 TK-IAP-205-EAP yes no 7 1(SSID) TK-IAP-205-EAP(EAP-PEAP) 144(RADIUS-7fff) user3 1422261196 6c:f3:7f:d3:56:93 1000 5aa8d979 (1)224.0.0.251 600 null 0,(null) ,0,0-0 no no null null null

6c:f3:7f:c5:35:68#

2015年4月19日日曜日

IAP/AOS:WISPR RADIUS Authentication&Accounting

Aruba-AP-Group is
Aruba-Location-ID is IAP's MAC address

IAP's WISPr RADIUS Authentication & Accounting thru ClearPass

Username:

user1

End-Host Identifier:

0811968a546c

Access Device IP/Port:

10.215.1.39:0

RADIUS Request

Radius:Aruba:Aruba-AP-Group	instant-C5:86:02
Radius:Aruba:Aruba-Essid-Name	Yokohama-Wi-Fi
Radius:Aruba:Aruba-Location-Id	6c:f3:7f:c5:35:68
Radius:IETF:Called-Station-Id	6cf37fc53568
Radius:IETF:Calling-Station-Id	0811968a546c
Radius:IETF:NAS-IP-Address	10.215.1.39
Radius:IETF:NAS-Port	0
Radius:IETF:NAS-Port-Type	19
Radius:IETF:Service-Type	1
Radius:IETF:User-Name	user1
Radius:WISPr:WISPr-Location-ID	isocc=JP,cc=81,ac=0,network=Yokohama-Wi-Fi
Radius:WISPr:WISPr-Location-Name	Wi2Connect,Yokohama-Wi-Fi
Radius:WISPr:WISPr-Logoff-URL	https://securelogin.arubanetworks.com/cgi-bin/login?cmd=logout

Computed Attributes

Authentication:ErrorCode	0
Authentication:Full-Username	user1
Authentication:Full-Username-Normalized	user1
Authentication:MacAuth	NotApplicable
Authentication:OuterMethod	PAP
Authentication:Posture	Unknown
Authentication:Source	[Local User Repository]
Authentication:Status	User
Authentication:Username	user1
Authorization:Sources	[Local User Repository]
Connection:AP-Mac	6cf37fc53568
Connection:Client-Mac-Address	0811968a546c
Connection:Client-Mac-Address-Colon	08:11:96:8a:54:6c
Connection:Client-Mac-Address-Dot	0811.968a.546c
Connection:Client-Mac-Address-Hyphen	08-11-96-8a-54-6c
Connection:Client-Mac-Address-NoDelim	0811968a546c
Connection:Client-Mac-Vendor	Intel Corporate
Connection:Dest-IP-Address	10.215.107.105
Connection:Dest-Port	1812
Connection:NAD-IP-Address	10.215.1.39
Connection:Protocol	RADIUS
Connection:Src-IP-Address	10.215.1.39
Connection:Src-Port	49160
Connection:SSID	Yokohama-Wi-Fi

Account Session ID:

6CF37FD35694-0811968A546C-552CA6C5

Start Timestamp:

Apr 14, 2015 14:33:57 JST

End Timestamp:

Apr 14, 2015 14:35:22 JST

Status:

Inactive

Termination Cause:

Admin-Reset

Service Type:

Number of Authentication Sessions:

Network Details

NAS IP Address:	10.215.1.39:0
NAS Port Type:	Wireless-802.11
Calling Station ID:	0811968a546c
Called Station ID:	6cf37fc53568
Framed IP Address:	10.215.1.95
Account Auth:	-

Utilization

Active Time:	85 Sec
Account Delay Time:	-
Account Input Octets :	566288
Account Output Octets :	768014
Account Input Packets :	1601
Account Output Packets :	1065

Authentication Sessions Details

SessionId	Type	Time Stamp
R00000052-01-552ca6c5	initial	Apr 14, 2015 14:33:57 JST

6c:f3:7f:c5:35:68# show ap bss-table

Aruba AP BSS Table

------------------

bss ess port ip phy type ch/EIRP/max-EIRP cur-cl ap name in-t(s) tot-t

--- --- ---- -- --- ---- ---------------- ------ ------- ------- -----

6c:f3:7f:d3:56:90 IAP-guest ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:51s

6c:f3:7f:d3:56:92 TK-IAP-205-1 ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:43s

6c:f3:7f:d3:56:93 TK-IAP-205-EAP ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:94 Yokohama-Wi-Fi ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:95 wayport ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

6c:f3:7f:d3:56:96 Wayport_Access ?/? 10.215.1.39 a-HT ap 132+/15/22 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

6c:f3:7f:d3:56:80 IAP-guest ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:47s

6c:f3:7f:d3:56:82 TK-IAP-205-1 ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:83 TK-IAP-205-EAP ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:84 Yokohama-Wi-Fi ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:42s

6c:f3:7f:d3:56:85 wayport ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

6c:f3:7f:d3:56:86 Wayport_Access ?/? 10.215.1.39 g-HT ap 11/18/18 0 6c:f3:7f:c5:35:68 0 22d:23h:22m:41s

Channel followed by "*" indicates channel selected due to unsupported configured channel.

"Spectrum" followed by "^" indicates Local Spectrum Override in effect.

Num APs:12

Num Associations:0

6c:f3:7f:c5:35:68# show summary

Name :instant-C5:86:02
System Location :
Domain :JP3
VC IP Address :10.215.1.206
VC VLAN :0
VC Mask :0.0.0.0
VC Gateway :0.0.0.0
Content Filtering :disable
Terminal Access :enable
Telnet Server :enable
Organization :Shimbashi
Airwave Server :10.215.1.103
Airwave Backup Server:
Airwave Prov Backup :
Number of VC transition :0
Airwave Shared Key :f9011638d60b55ebf3c9bf0ca7fd20c48c529a62a9a29f2b
Airwave Config Via :UI
Airwave :Connected
Airwave Mode :Monitor
Aruba Central Server :
Aruba Central :Not Set Up
Managed Via :Airwave
Syslog Server :10.215.200.97
Syslog Level :debug
Band :all
Master IP Address *:10.215.1.39
IP Address :10.215.1.39
Netmask :255.255.255.0
Gateway :10.215.1.254
NameServer :10.44.10.10
NameServer :10.44.11.10

DNSDomain :arubanetworks.com

IAP's Condiguration:

wlan ssid-profile Yokohama-Wi-Fi
enable
index 4
type guest
essid Yokohama-Wi-Fi
opmode opensystem
max-authentication-failures 0
auth-server External-RADIUS
rf-band all
captive-portal external profile ClearPass
wispr
dtim-period 1
inactivity-timeout 1000
broadcast-filter arp
radius-accounting
dmo-channel-utilization-threshold 90
local-probe-req-thresh 0
max-clients-threshold 64
wmm-video-share 50
wmm-voice-share 50
!
wlan wispr-profile
wispr-location-name-operator-name Wi2Connect
wispr-location-name-location Yokohama-Wi-Fi
wispr-location-id-network Yokohama-Wi-Fi
wispr-location-id-cc 81
wispr-location-id-ac 0

wispr-location-id-isocc JP

登録: 投稿 (Atom)