Aruba Wi-Fi

Aruba AOS8 Mobility Controllers ESXi & Initial Setup

In this post, I will show you how to deploy virtual Aruba AOS8 Mobility Controller in VMware ESXi and add it to a Mobility Conductor cluster. I used AOS version, but the steps should be the same for other 8.x versions. Check out this post and this post if you require assistance setting up your Mobility Conductors. If you have physical Mobility Controllers, skip to the Mobility Controller setup wizard section.

Mobility Controller Virtual Machine Requirements

The table below shows the minimum resources required to operate Aruba AOS8 virtual Mobility Controllers on VMware ESXi.

vCPUsMemoryDisk SpaceTotal Supported NICs
MC-VA-1034GB6GB4 (3 Data, 1 MGMT)
MC-VA-5046GB6GB4 (3 Data, 1 MGMT)
MC-VA-25058GB8GB4 (3 Data, 1 MGMT)
MC-VA-1K616GB16GB4 (3 Data, 1 MGMT)
MC-VA-4K1248GB48GB4 (3 Data, 1 MGMT)
MC-VA-6K1464GB64GB4 (3 Data, 1 MGMT)

MC-VA-4K and MC-VA-6K are not orderable SKUs. However, you can scale up by installing multiple instances of MCVA-1K. For example, to deploy 4K APs on a single Mobility Controller Virtual Appliance, you need to add four MC-VA-1K licenses.

Image Verification

You must verify the MD5 or SHA256 checksum listed on the Aruba Support Portal to ensure it matches the computed checksum of the Mobility Controller ESXi image you downloaded. Don’t skip this step! There is nothing worse than having to re-download an image because it got corrupted somewhere along the way.

Aruba Support Portal AOS8 VM OVA SHA256 value

Using the PowerShell command cmdlet Get-FileHash I verified the SHA256 value:

Powershell command to verify the SHA256 hash of Aruba Mobility Controller OVA file

It’s a match! Otherwise, there are many GUI tools available if you prefer.

OVA Deployment

I access my ESXi console natively using HTTPS in my lab (no vSphere client).

First, we need to register the VM. Click Create / Register VM, and follow the prompts to select the image you downloaded from the Aruba Support Portal (ASP).

VMware ESXi Register VM Button

Select the storage where you want to install the VM and click Next.

VM Datastore selection

Map your Mobility Controller NICs to the appropriate VM network. I recommend using a VM port group that trunks/allows all VLANs (VLAN ID 4095) for scalability, but this choice boils down to one architectural decision. Do you plan on using your SSIDs in tunnel mode (client sessions terminate on the Controller)? Or do you plan on using your SSIDs in bridge mode (client sessions terminate on the switch connecting the APs. If the latter, technically, you only need to specify the management VLAN in this step.

Ensure Disk Provisioning is set to Thick. Untick the Power on automatically checkbox as we need to edit the VMs settings before it boots up.

Click Next to continue, then follow the prompts to confirm your setting and finalise the OVA deployment.

Aruba Mobility Controller Disk Provisioning

Additional VM Settings

Before we power on the VM, there are a number of settings that we need to modify. When the VM has finished deploying, click on the Mobility Controller’s hostname in the list of VMs, select the Actions menu and click Edit settings.

Allocate the required CPU, RAM, and Hard Disk resources per the VM Requirements. Tick Reserve all guest memory (all locked) under the memory settings. Allocate the necessary hard disk space to the Hard disk 2. Hard disk one stores the OS and its base configuration, so don’t modify it.

I only require a single NIC, so have left Network Adaptor 2 allocated to my Trunk-All_VLANs Port Group. It is best practice to disable any unused NICs and place them in a VLAN that is unrouteable within the LAN in case of any misconfigurations. The four VM NICs correspond to the following Mobility Controller AOS8 NICs.

  • Network Adaptor 1 – OOB Management
  • Network Adaptor 2 – Gigabit Ethernet 0/0/0
  • Network Adaptor 3 – Gigabit Ethernet 0/0/1
  • Network Adaptor 4 – Gigabit Ethernet 0/0/2

Click Save to continue.

Aruba Mobility Controller VM settings

The next step is critical but is often skipped. I have seen it become the root cause of many early deployment issues, so don’t let it happen to you. Find and edit your global vSwitch settings or edit the port group that you used to connect your Mobility Controller. Expand the Security settings and enable Promiscuous Mode and Forged Transmits. Click Save to continue.

Aruba AOS8 Mobility Conductor ESXi VM network security settings, promiscuous mode, forged transmits

Find the Mobility Controller in the list of VMs and select Power On.

Aruba Mobility Controller Power On

With your VM still selected, click Console and choose one of the available methods to access the VM.

Establish console session to VM

Add Mobility Controllers to Mobility Masters

Once the Mobility Controller has finished booting, you will be presented with a setup wizard requiring you to enter the following details:

  • System Name
  • Switch Role (md/standalone)
  • Mobility Conductor IP and IPSEC authentication type
  • Port Mode (access/trunk)
  • IP and Subnet Details
  • DNS Server
  • Location, date, and time details
  • Local administrator credentials

You will be presented with an option to review and confirm the configuration. You must specify the correct Master Switch (Mobility Conductor) IP and IPSec details here because the Controllers will continuously attempt to build a secure tunnel to the Mobility Conductors from this point forward. Modifying those settings isn’t an easy task if it can’t join the Conductor. When you are happy with your provided details, type in yes and hit enter to accept the changes.

Aruba Mobility Controller VM Setup Wizard

It will take time for the server to apply the changes and reboot, so be patient!

Add Mobility Controller to Mobility Conductors

Navigate to your mobility Conductor cluster. Click on the Mobility Master Folder, click Configuration, Controllers then click the + sign.

Add Aruba Mobility Controller to Mobility Conductors

Enter the IP address and IPSec key of the first Mobility Controller

Add Aruba Mobility Controller to Mobility Conductors IPSEC key and IP Address

SSH to your primary Mobility Conductor and issue the command show switches. You should see your Controller in the unknown state while it attempts to build a tunnel to the Mobility Conductors. Copy the MAC address listed in the configuration state.

Aruba Mobility Conductor SSH sessions to verify Mobility Controller Tunnel

Head to your Mobility Conductor dashboard and click on the + sign next to Managed Network.

Aruba Mobility Conductor Managed Network Group Folder Structure

For the purpose of this demo, my managed network is going to consist of the following group structure. Managed Network –> Company Name –> City Name. I will place the Mobility Controllers in the City group folder. If the company expanded to other cities, I would place their Mobility Controllers in the groups of the cities that the Controllers physically reside in. Create the group folders that you desire and click Submit to continue.

Create Aruba Mobility Controller Group Folder

Select the group where you want your Mobility Controllers to reside in and click the + sign. This time, click Controller and enter the Hostname, MAC Address (that you copied in the previous step), and model of Controller. Click Submit to continue.

Create Aruba Mobility Controller Hostname and MAC Address

After some time, you should see your Mobility Controller appear in the group folder that you specified.

Showing Aruba Mobility Controller in Mobility Conductor Managed Network Structure

Head back to your Mobility Conductor’s SSH session, type in show switches again, and confirm that the Controller status is up and the Configuration State is successful.

Verifying that Aruba Mobility Conductor has Mobility Controller connection via SSH - show switches command

I highly recommend adding a second Mobility Controller and forming a cluster to make use of the full range of HA and redundancy features that sets Aruba apart from other vendors. Repeat these steps to add the second Controller.

Leave a Reply