Hewlett Packard Enterprise aruba User manual

Aruba Instant AP
Troubleshooting Guide
Troubleshooting Guide

Copyright Information
© Copyright 2021 Hewlett Packard Enterprise Development LP.
Open Source Code
This product includes code licensed under the GNU General Public License, the GNU Lesser General
Public License, and/or certain other open source licenses. A complete machine-readable copy of the
source code corresponding to such code is available upon request. This offer is valid to anyone in
receipt of this information and shall expire three years following the date of the final distribution of
this product version by Hewlett Packard Enterprise Company. To obtain such source code, send a
check or money order in the amount of US $10.00 to:
Hewlett Packard Enterprise Company
6280 America Center Drive
San Jose, CA 95002
USA

Contents
Contents
Contents 3
Revision History 4
Preface 5
About this Guide 5
Intended Audience 5
Related Documents 5
Conventions 5
Terminology Change 6
Contacting Support 7
APProvisioning 8
APFails to Receive Provisioning Rule from Activate 8
APFails to Receive Provisioning Rule from DHCPServer 9
The SetMeUp SSIDfor APProvisioning is Not Broadcasted 11
Member AP Fails to Provision in an Instant Cluster 12
Instant APs Managed by Aruba Central 17
AP Fails to Connect to Aruba Central 17
AP Fails to Receive Configurations from Aruba Central 19
AP Fails to Download Software Image from Aruba Central 22
Instant APs Managed by AirWave 23
AP Fails to Connect to AirWave 23
AP Fails to Receive Configurations From AirWave 24
AP Fails to Download Software Image From AirWave 25
AP Fails to Download Certificates from AirWave 26
Wireless Client Connections 28
Wireless Client Unable to Connect to AP 28
Wireless Client Unable to Get an IP Address 30
Wireless Client Unable to Pass Traffic 30
Wireless Client Fails 802.1X Authentication 31
Wireless Client Fails MACAuthentication 32
Wireless Client Fails to Reach Captive Portal Authentication Page 32
Wireless Client Fails Captive Portal Authentication 33
ARM 35
Wireless Client Unable to Find SSID 35
AP Does Not Operate on Certain Channels 36
AP Changes Radio Channel Frequently 37
Mesh Networks 40
Aruba Instant AP | Troubleshooting Guide 3

Revision History | 4
Revision History
The following table lists the revisions of this document.
Revision Change Description
Revision 01 Initial release.
Table 1: Revision History

Chapter 1
Preface
Preface
About this Guide
The Aruba Instant AP Troubleshooting Guide contains information on how to troubleshoot common errors
encountered in Aruba Instant APs. This guide contains information on the symptom of the issue, procedures
to identify the cause, and steps to resolve them. The errors described in this guide are largely configuration
issues that can be resolved with basic troubleshooting. If the solution described in the guide does not
resolve the issue contact Aruba Technical Support.
Intended Audience
This guide is intended for network administrators who configure and use Instant APs.
Related Documents
In addition to this document, the Instant AP product documentation includes the following:
nAruba AP Software Quick Start Guide
nAruba Instant Access Point Installation Guides
nAruba Instant CLI Reference Guide
nAruba Instant Release Notes
nAruba Instant RESTAPIGuide
nAruba Instant Syslog Messages Reference Guide
nAruba Instant User Guide
Conventions
The following conventions are used throughout this manual to emphasize important concepts:
Style Type Description
Italics
This style is used to emphasize important terms and to mark the titles of
books.
System items This fixed-width font depicts the following:
nSample screen output
nSystem prompts
nFilenames, software devices, and specific commands when mentioned in
the text.
Table 2: Typographical Conventions
Aruba Instant AP | Troubleshooting Guide 5

Terminology Change | 6
Style Type Description
Commands In the command examples, this style depicts the keywords that must be typed
exactly as shown.
<Arguments> In the command examples, italicized text within angle brackets represents
items that you should replace with information appropriate to your specific
situation. For example:
#send <text message>
In this example, you would type “send” at the system prompt exactly as shown,
followed by the text of the message you wish to send. Do not type the angle
brackets.
[Optional] Command examples enclosed in square brackets are optional. Do not type the
square brackets.
{Item A | Item B} In the command examples, items within curly brackets and separated by a
vertical bar represent the available choices. Enter only one choice. Do not type
the curly brackets or bars.
Table 2: Typographical Conventions
The following informational icons are used throughout this guide:
Indicates helpful suggestions, pertinent information, and important things to remember.
Indicates a risk of damage to your hardware or loss of data.
Indicates a risk of personal injury or death.
Terminology Change
As part of advancing HPE's commitment to racial justice, we are taking a much-needed step in overhauling
HPE engineering terminology to reflect our belief system of diversity and inclusion. Some legacy products
and publications may continue to include terminology that seemingly evokes bias against specific groups of
people. Such content is not representative of our HPE culture and moving forward, Aruba will replace
racially insensitive terms and instead use the following new language:
Usage Old Language New Language
Campus Access Points + Controllers Master-Slave Conductor-Member
Instant Access Points Master-Slave Conductor-Member
Switch Stack Master-Slave Conductor-Member
Wireless LAN Controller Mobility Master Mobility Conductor
Firewall Configuration Blacklist, Whitelist Denylist, Allowlist
Types of Hackers Black Hat, White Hat Unethical, Ethical

Aruba Instant AP | Troubleshooting Guide 7
Contacting Support
Main Site arubanetworks.com
Support Site https://asp.arubanetworks.com/
Airheads Social Forums and Knowledge
Base
community.arubanetworks.com
North American Telephone [phone] (Toll Free)
1-408-754-1200
International Telephone arubanetworks.com/support-services/contact-support/
Software Licensing Site lms.arubanetworks.com
End-of-life Information arubanetworks.com/support-services/end-of-life/
Security Incident Response Team Site: arubanetworks.com/support-services/security-bulletins/
Email: [e-mail]
Table 3: Contact Information

Chapter 2
APProvisioning
APProvisioning
The following are common issues observed during the provisioning process of an AP:
nAPFails to Receive Provisioning Rule from Activate
nAPFails to Receive Provisioning Rule from DHCPServer
nThe SetMeUp SSIDfor APProvisioning is Not Broadcasted
nMember AP Fails to Provision in an Instant Cluster
APFails to Receive Provisioning Rule from Activate
The APs after receiving its IP address, netmask, and gateway IP address from the DHCPserver will establish a
connection with the Activate server to retrieve the provisioning rule. In some cases, the AP might fail to
receive the provisioning rule and remain in the factory default state.
The following procedure describes how to troubleshoot issues, if the APfails to receive the provisioning rule
from Activate:
1. Check the Uplink of the AP
2. Check the Status of Activate Connection
3. Check if Access to Activate Server is Allowed in the Network Firewall
Check the Uplink of the AP
Ensure that the APhas an active uplink connection to reach the Activate server.
Run the show uplink status command to the view the state of uplink connections of the AP. If the state of
the active uplink connection is DOWN, resolve the issue with the AP uplink.
The sample below displays information of the uplink connection of the AP, generated by the show uplink
status command:
(Instant AP)# show uplink status
Uplink preemption :enable
Uplink preemption interval :600
Uplink enforce :none
Ethernet uplink eth0 :DHCP
Uplink Table
------------
Type State Priority In Use
---- ----- -------- ------
eth0 DOWN 0 Yes
Wifi-sta INIT 6 No
3G/4G INIT 7 No
Internet failover :disable
Max allowed test packet loss :10
Secs between test packets :30
VPN failover timeout (secs) :180
Internet check timeout (secs) :10
ICMP pkt sent :0
ICMP pkt lost :0
Aruba Instant AP | Troubleshooting Guide 8

APProvisioning | 9
Continuous pkt lost :0
VPN down time :0
AP1X type:NONE
Certification type:NONE
Validate server:NONE
Check the Status of Activate Connection
Run the show activate status command to view the status of Activate connection. The output of this
command will display the reason for failure, if the APfails to connect to Activate.
The following are possible states of the Activate connection:
Activate Status Inference
success The AP is connected to Activate and received a provisioning rule.
connection_failed The AP failed to connect to Activate. The reason for connection
failure is displayed in the Activate fail reason line.
connecting The AP is able to reach Activate but the provisioning rule is not
defined.
fail-prov-no-rule
fail-TCP-error There in an uplink error in the TCPport of the AP.
The sample below displays the Activate connection information of the AP, generated by the show activate
status command:
(Instant AP)# show activate status
IAP MAC Address :90:4c:81:c3:28:1e
IAP Serial Number :USGHK514D1
Cloud Activation Key :
Activate Server :device.arubanetworks.com
Activate Status :connection-failed
Activate fail reason :dns error
Provision interval :5 minutes
Check if Access to Activate Server is Allowed in the Network
Firewall
Check the network firewall and ensure that traffic to device.arubanetworks.com is allowed.
APFails to Receive Provisioning Rule from DHCPServer
After initial boot all APs connect to the DHCP server to receive IP address, netmask, and gateway IP address.
APs can be configured to receive the provisioning rule through the DHCP server by configuring DHCP
options- option 60 and option 43.
The following procedure describes how to troubleshoot issues, if the AP fails to receive provisioning rule
from DHCPserver:
1. Check the Configuration of DHCPOptions
2. Check if the AP has AirWave IP Configured
Check the Configuration of DHCPOptions

Aruba Instant AP | Troubleshooting Guide 10
Run the show dhcpc-opts command to view DHCPoptions received from the DHCPserver. If the DHCP
options, option 43 and option 60, are not displayed in the output, configure the options again in the
DHCPserver and retry provisioning. Ensure to use the correct syntax when configuring the DHCPoptions.
The following is the syntax to configure the DHCP options:
DHCPOption Syntax Example
Option 060 ArubaInstantAP — for Instant AP
deployments
ArubaInstantAP
Option 043 <Organization name>, <AirWave IP>,
<AirWave Shared key>
Aruba, 192.0.2.20, 12344567
<Organization name>, <AirWave domain>Aruba, aruba.support.com
The sample below displays the DHCP options received by the AP, generated by the show dhcp-opts
command:
[Instant AP]# show dhcpc-opts
------------------DHCP option43 --------------------
Not available
Check if the AP has AirWave IP Configured
APs will not use DHCPoptions for provisioning if AirWave IPis configured as AirWave configuration takes
precedence over DHCPoptions.
Run the show summary command to view the configuration summary of the AP. In the configuration
summary, check the AirWave server line to determine if the AirWave IP is configured. If AirWave IPis
confiigured, clear all configurations and reboot the AP to provision using the DHCPoptions.
The sample below displays the summary of AP configuration, generated by the show summary command:
[Instant AP]# show summary
Name :SetMeUp-CF:77:34
System Location :
Domain :
VC IP Address :0.0.0.0
VC IPv6 Address :::
AP1X :NONE
VC VLAN :0
VC Mask :0.0.0.0
VC Gateway :0.0.0.0
VC DNS :0.0.0.0
IP Mode :v4-only
Cluster-Security DTLS:disable
Content Filtering :disable
Terminal Access :enable
Telnet Server :disable
Activate Disable :disable
Organization :
Disable ciphers :
Airwave Server :
Airwave Backup Server:
Airwave Prov Backup :
Number of VC transition :0

APProvisioning | 11
Airwave Shared Key :
Airwave Config Via :DHCP
Airwave :Not Set Up
Aruba Central Server :
Aruba Central :Not Set Up
Managed Via :Local
The SetMeUp SSIDfor APProvisioning is Not Broadcasted
During the initial boot of a factory default AP, a SetMeUp SSID is broadcasted by the AP on the 2.4 GHz
band. The provisioning rule for the AP can be defined using the Instant WebUI by logging into the SetMeUp
SSID. In certain cases, the SetMeUp SSID may not be broadcasted or the client may be fail to connect to the
SSID.
The following procedure describes how to troubleshoot issues, if the APfails to broadcast the SetMeUp
SSID:
1. Check if the AP Received a Provisioning Rule
2. Check the Uplink of the AP
3. Connect to the SSIDUsing a Different Client Device
Check if the AP Received a Provisioning Rule
The Set Me Up SSID is disabled automatically when the AP receives a provisioning rule from Activate,
AirWave, or DHCPserver.
Run show summary command to view the configuration summary of the AP. Check if the AP has any
provisioning rule from Activate, AirWave or the DHCP server. If the AP has a provisioning rule, clear all
configurations, reboot the AP, and retry provisioning.
The sample below displays the summary of AP configuration, generated by the show summary command:
[Instant AP]# show summary
Name :SetMeUp-CF:77:34
System Location :
Domain :IN
VC IP Address :0.0.0.0
VC IPv6 Address :::
AP1X :NONE
VC VLAN :0
VC Mask :0.0.0.0
VC Gateway :0.0.0.0
VC DNS :0.0.0.0
IP Mode :v4-only
Cluster-Security DTLS:disable
Content Filtering :disable
Terminal Access :enable
Telnet Server :disable
Activate Disable :disable
Organization :
Disable ciphers :
Airwave Server :
Airwave Backup Server:
Airwave Prov Backup :
Number of VC transition :0
Airwave Shared Key :
Airwave Config Via :DHCP

Aruba Instant AP | Troubleshooting Guide 12
Airwave :Not Set Up
Aruba Central Server :
Aruba Central :Not Set Up
Managed Via :Local
Check the Uplink of the AP
The broadcast of SetMeUp SSIDis disabled if the APdoes not have an active uplink connection.
Run the show uplink status command to the view the state of uplink connections of the AP. If the state of
the active uplink connection is DOWN, resolve the issue with the AP uplink.
The sample below displays information of the uplink connection of the AP, generated by the show uplink
status command:
(Instant AP)# show uplink status
Uplink preemption :enable
Uplink preemption interval :600
Uplink enforce :none
Ethernet uplink eth0 :DHCP
Uplink Table
------------
Type State Priority In Use
---- ----- -------- ------
eth0 DOWN 0 Yes
Wifi-sta INIT 6 No
3G/4G INIT 7 No
Internet failover :disable
Max allowed test packet loss :10
Secs between test packets :30
VPN failover timeout (secs) :180
Internet check timeout (secs) :10
ICMP pkt sent :0
ICMP pkt lost :0
Continuous pkt lost :0
VPN down time :0
AP1X type:NONE
Certification type:NONE
Validate server:NONE
Connect to the SSIDUsing a Different Client Device
In certain scenarios, the Windows client is unable to access instant.arubanetworks.com despite the AP
getting the IP address, netmask, and gateway IP address from the DHCPserver. This is a limitation identified
with certain versions of Windows. In such a scenario, connect to the SetMeUp SSID using a client running
macOS or a different version of Windows.
Member AP Fails to Provision in an Instant Cluster
When an Instant AP is plugged into a network with an existing Instant cluster, the AP advertises itself as a
member to the conductor AP and joins the cluster. However in certain scenarios the APmight fail to join the
conductor AP and remain unprovisioned.
The following procedure describes how to troubleshoot issues, if the member APfails to join the cluster:
1. Check if Auto Join is Enabled on the Conductor AP
2. Check if the Instant Cluster is DTLSEnabled

APProvisioning | 13
3. Check if the Member AP Received an IPaddress
4. Check if the Member AP and Conductor APare in Different Sub Networks
5. Check if the Member AP is Supported in the Instant Cluster
Check if Auto Join is Enabled on the Conductor AP
Either one of the following conditions has to be met for the new AP to join the cluster:
nAuto join mode must be enabled on the cluster.
nThe MACaddress of the new AP must be added to the APWhitelist table.
The AP cannot join the cluster if neither of these conditions are met.
Run the show allowed-aps command on the conductor AP to view the auto join setting and AP whitelist
table of the Instant cluster. If Allow New APs is set to disable, do any of the following:
nEnable Auto join mode in the Configuration > System >Advanced Options page of the Instant
webUI.
nAdd the MACaddress of the new APto the APwhitelist table using the allowed-ap <MAC address>
command.
The sample below displays the auto join setting of the cluster, generated by the show allowed-aps
command:
(Conductor AP)# show allowed-aps
Allow New APs :disable
AP Whitelist
------------
MAC Address
-----------
90:4c:81:c3:28:1e
90:4c:81:cf:77:34
Check if the Instant Cluster is DTLSEnabled
A DTLS-enabled Instant cluster only allows DTLS-enabled member APs to join the cluster. However if Auto
join mode is enabled on the cluster or the MACaddress of the new AP is added to the APWhitelist table, the
Instant cluster accepts a non-DTLSmember AP.
Run the show cluster-security command on the conductor AP to view the cluster security profile of the
Instant network. If Non-DTLS Members is set to Deny, do any of the following:
nSet Non-DTLSMembers to allow in the Configuration > System >Advanced Options page of the
Instant webUI
nEnable Auto join mode in the Configuration > System >Advanced Options page of the Instant
webUI.
nAdd the MACaddress of the new APto the APwhitelist table using the allowed-ap <MAC address>
command.
The sample below displays the security settings of the cluster, generated by the show cluster-security
command:
(Conductor AP)# show cluster-security
Cluster Security Profile

Aruba Instant AP | Troubleshooting Guide 14
------------------------
Parameter Value
--------- -----
DTLS config Enabled
DTLS state Enabled
Low assurance devices Deny
Non-DTLS Members Deny
Reboot required No
Check if the Member AP Received an IPaddress
Failure to receive or retain an IPaddress will cause the AP to reboot and go into a degraded state. The radio
lights of the APturns amber when the APis in degraded state. An AP fails to receive or retain an IPaddress
if:
nthe DHCP server is not working.
nthe DHCP scope is exhausted.
nthe lease period of assigned IP address is expired and the AP fails to renew it.
nthe conductor AP is configured with a static IP.
nthe default IP, Automatic Private IP Addressing (APIPA), is not allowed in the network.
Perform the following actions based on the network configuration to ensure that the AP receives a valid
IPaddress:
Network Configuration Action
Networks with a DHCPserver Ensure that the DHCP server has enough IP addresses for new APs.
Check the lease period of the IPaddresses.
Conductor APdefined with a
static IP
Assign a static IPfor member AP in the same sub network as the conductor AP.
Check if the Member AP and Conductor APare in Different Sub
Networks
The member AP must be in the same subnet as the conductor AP to join the cluster.
Run the show summary | include IPcommand on the member AP to view the IPaddress configurations
on the member AP. If the conductor APand the member APhave IP addresses in different sub networks,
move the member to the sub network of the conductor AP.
The sample below displays the summary of AP configuration, generated by the show summary | include
IP command:
(Member AP)# show summary | include IP
VC IP Address :0.0.0.0
VC IPv6 Address :::
IP Mode :v4-only
Conductor IP Address :10.16.21.2
IP Address :10.19.29.8
IPv6 Address :--
SLAAC IP Address :--
Link Local IP Address:--
Check if the Member AP is Supported in the Instant Cluster

APProvisioning | 15
The conductor APwill reject the association request of the member AP if its configuration is not supported
by the cluster. A member APwill be deemed incompatible by the cluster if there is a image class mismatch,
regulatory domain mismatch, or OEM mismatch between the member AP and the conductor AP.
Run the show swarm state command in the CLI of the member AP to view the swarm details. Check the
AP swarm state to see if the member AP is allowed in the network. The APswarm state will display
swarm_not_allowed if the member AP is not supported in the cluster. Use the show log system
command to get additional information about the cause for mismatch.
The sample below displays the swarm status of the member AP, generated by the show swarm state
command:
(Member AP)# show swarm state
AP Swarm State :swarm_not_allowed
mesh auto eth0 bridging :no
Config in flash :yes
factory SSID in flash :yes
extended-ssid configured :yes
extended-ssid active :yes
advanced-zone configured :no
Factory default status :no
Source of system time :Image file
Config load cnt :1
VC Channel index :1
IDS Client Gateway Detect :yes
Config Init success cnt for heartbeat :0
Config Init success cnt for register :0
Config Init skipping cnt for heartbeat :0
Config Init skipping cnt for register :0
Config Init last success reason :N/A
Config Init last success time :N/A
The following are probable causes for member-cluster incompatibility:
Type of
Mismatch Cause Log Event
Image class
mismatch
Member AP and
the APs in the
cluster belong to
different image
classes
APclass not match, Conductor-X, member -Y
Regulatory
domain
Mismatch
Member AP and
the APs in the
cluster are of
different
regulatory
domains
APregulatory domains don't match Conductor-X, member-Y
OEMMismatch Member AP and
the APs in the
cluster are of
different OEMs
APregulatory domains don't match Conductor-X, member-Y
NOTE: In the event of a image class mismatch, image download can be facilitated through Activate, or AirWave,
or Central platform. If either one of these management platforms are configured in the cluster, the member AP
will install the appropriate image file from the cloud platform, reboot, and join the cluster.

Aruba Instant AP | Troubleshooting Guide 16
Type of
Mismatch Cause Log Event
NOTE: In the event of a regulatory domain mismatch or OEMmismatch, the member AP cannot be provisioned
in a cluster.

Chapter 3
Instant APs Managed by Aruba Central
Instant APs Managed by Aruba Central
The following are common issues observed in Instant APs managed by Central:
nAP Fails to Connect to Aruba Central
nAP Fails to Receive Configurations from Aruba Central
nAP Fails to Download Software Image from Aruba Central
AP Fails to Connect to Aruba Central
The initial connection between the Instant AP and Central is facilitated through the Activate platform. For an
APto connect to Central, the AP must receive a provisioning rule from Activate containing the Central server
details. Therefore, connectivity to Activate is essential for Central connections.
The following procedure describes how to troubleshoot issues, if the AP fails to connect to Central:
1. Check if the AP is Connected to Central
2. Check the Status of Activate Connection
3. Check the APProvisioning Logs for Error Information
Check if the AP is Connected to Central
Run the show ap debug cloud-server | include Aruba command in the CLIof the AP to view details of
Aruba Central server. Check the Aruba Central Status to identify the state of Central connection. The
status is displayed as Login_done for successful connections. All other status imply that the APfailed to
establish a connection with Central.
The sample below displays details of the Central server, generated by the show ap debug cloud-server |
include Aruba command:
(Instant AP)# show ap debug cloud-server | include Aruba
Aruba Central server :internal.central.arubanetworks.com
Aruba Central server path :/ws
Aruba Central proxy server :None
Aruba Central redirect from :internal.central.arubanetworks.com
Aruba Central Protocol :WSS
Aruba Central uptimes :1h:0m:48s
Aruba Central status :Login_done
Check the Status of Activate Connection
The AP must retrieve the provision rule from Activate to connect to Central. The provision rule contains
details of the Central server and the cloud activation key that enables the AP to associate with the Central
server.
Run the show activate status command and to view the Activate connection details. Check the Activate
Status to identify the connection state of Activate. The following are possible connection states of Activate:
Aruba Instant AP | Troubleshooting Guide 17

Instant APs Managed by Aruba Central | 18
Activate Status Inference
success The AP is connected to Activate and received a provisioning rule.
connection_failed The AP failed to connect to Activate. The reason for the connection
failure will be displayed in the Activate fail reason line.
connecting AP can reach Activate but a provisioning rule for the AP is not
defined in Activate.
fail-prov-no-rule
fail-TCP-error There in an uplink error in the TCPport of the AP.
The sample below displays the Activate connection details, generated by the show activate status
command:
38:17:c3:c0:56:32# show activate status
IAP MAC Address :7c:57:3c:c0:25:b4
IAP Serial Number :CNH7K51187
Cloud Activation Key :5XXXXXXP
Activate Server :device.arubanetworks.com
Activate Status :success
Aruba Central Server :device-prod2.central.arubanetworks.com
Last provision time :2020-04-23 07:48:56
Provision interval :10080 minutes
Check the APProvisioning Logs for Error Information
Run the show log provision command to view logs of AP provisioning. The AP provisioning logs indicate
issues faced by the AP when connecting to Activate or Central.
The following are possible errors that could occur in Activate or Central connections:
Error Cause Resolution
TCPerror This error occurs when there is an Internet
connectivity issue on port TCP 443 port.
Check TCPport 443 and ensure that traffic
is allowed in the port.
DNSerror This error occurs when the DNSserver
fails to resolve the domain names of
Activate and Central.
Check the DNSconfiguration of the AP and
ensure that a DNSserver is configured.
NTP sync failure This error occurs if there is a time and date
mismatch between Activate and the AP.
Check the status of the ntp server of the AP
and ensure that a NTP server is configured.
Provisioning error This occurs if provisioning is initiated
before the AP is added to the Device
Inventory in Central
Add the APin Central again and retry
provisioning.
The sample below displays the logs of APprovisioning, generated by the show log provision command:
38:17:c3:c0:56:32# show log provision
Provisioning Log
----------------
Time State Type Log Message
---- ----- ---- -----------
Thu Apr 23 10:40:57 2020 Central Debug Init Domain list
Thu Apr 23 10:40:58 2020 UAP ADP Warning ADP info: Get the provision rule from

Aruba Instant AP | Troubleshooting Guide 19
flash.
Thu Apr 23 10:40:59 2020 UAP ADP Warning ADP info: Reset the provision status
for new conductor.
Thu Apr 23 10:41:25 2020 Activate In progress Attempting provisioning via Activate
server: device.arubanetworks.com
Thu Apr 23 10:41:25 2020 UAP ADP Warning ADP info: Check with activate after
configuration sync up.
Thu Apr 23 10:41:25 2020 UAP ADP Warning ADP info: Send one first provision
request.
Thu Apr 23 10:41:27 2020 Activate Debug Sent challenge response to Activate
Server: device.arubanetworks.com
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Explicit type of rule is
configured for the AP.
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Original source is unknow and
new is cloud
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Provision rule from activate
isn't changed.
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Retrieve the valid provision
rule.
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Save the Central rule from
cloud into flash.
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info:
internal.central.arubanetworks.com
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Save new provision rule into
a file.
Thu Apr 23 10:41:29 2020 UAP ADP Warning ADP info: Save provision rule to flash.
Thu Apr 23 10:41:29 2020 Central Debug Program Domain for Aruba central server
internal.central.arubanetworks.com
Thu Apr 23 10:41:29 2020 Activate Completed Received instruction from Activate
Server to connect to Aruba Central server at internal.central.arubanetworks.com
Thu Apr 23 10:42:03 2020 Activate In progress Attempting provisioning via Activate
server: device.arubanetworks.com
Thu Apr 23 10:42:03 2020 Central In progress Connecting to Aruba Central server at
internal.central.arubanetworks.com
Thu Apr 23 10:42:03 2020 UAP ADP Warning ADP info: Send one interval provision
request.
Thu Apr 23 10:42:08 2020 Central Debug Program Domain for Aruba central server
internal.central.arubanetworks.com
Thu Apr 23 10:42:08 2020 Central In progress Connecting to Aruba Central server
internal.central.arubanetworks.com, triggered by athena redirect
Thu Apr 23 10:42:08 2020 Central In progress Received new Aruba Central server
address: internal.central.arubanetworks.com
Thu Apr 23 10:42:13 2020 Activate Debug Sent challenge response to Activate
Server: device.arubanetworks.com
Thu Apr 23 10:42:16 2020 UAP ADP Warning ADP info: Central provision rule is not
changed.
Thu Apr 23 10:42:16 2020 UAP ADP Warning ADP info: Explicit type of rule is
configured for the AP.
Thu Apr 23 10:42:16 2020 UAP ADP Warning ADP info: Provision rule from activate
isn't changed.
Thu Apr 23 10:42:16 2020 UAP ADP Warning ADP info: Retrieve the valid provision
rule.
Thu Apr 23 10:42:16 2020 Central In progress Estabished connection with Aruba
Central server internal.central.arubanetworks.com, authenticating...
Thu Apr 23 10:42:18 2020 Central Completed Login done to Aruba Central server
internal.central.arubanetworks.com by websocket
The show log ap-debug | include awc command can also be used to view the provisioning logs
between the APand the management platform.
AP Fails to Receive Configurations from Aruba Central

Instant APs Managed by Aruba Central | 20
In Central managed networks, the AP and Central communicate over a websocket connection to exchange
configuration and monitoring data. Therefore, uninterrupted connectivity is integral in Central managed
networks and loss in internet connectivity can stall configuration changes and monitoring updates.
The following procedure describes how to troubleshoot issues, if the AP fails to receive configurations from
Central:
1. Check the Configuration Status of Central
2. Ensure That the APis Placed in a Configuration Group in Central
3. Verify the Configurations Received from Central
4. Restart the Central Websocket Connection
Before starting the troubleshooting process, ensure that the AP is connected to Central.
Check the Configuration Status of Central
Run the show ap debug cloud-server command in the CLIof the AP to view the status of the Central
connection. Check cloud config recved to identify if the AP has received configurations from Central. A
TRUE state implies that the AP has received configurations and a FALSEstate implies that the AP has not
received configurations.
The sample below displays the Central connection status, generated by the show ap debug cloud-server
command:
(Instant AP)# show ap debug cloud-server
IAP mgmt mode :athena-mgmt
cloud config recved :TRUE
autojoin mode :disable
state diff :disable
Device Cert status :SUCCESS
Device info send :SUCCESS
Aruba Central server :internal.central.arubanetworks.com
Aruba Central server path :/ws
Aruba Central proxy server :None
Aruba Central redirect from :internal.central.arubanetworks.com
Aruba Central Protocol :WSS
Aruba Central uptimes :1h:0m:48s
Aruba Central status :Login_done
Cloud Debug Statistics
-----------------------
Key Value
--- -----
Connect establish success 1(10)
Connect establish failed 0(2)
Login done to init 0(9)
Login done times 1(10)
Connect retry times 1(12)
clarity send 60(871)
Device Info send 1(10)
Domain list receive 1(10)
Domain response send 1(10)
Cloud Last connect status
-------------------------
Last connect ID :12
Last connect time :2020-04-24 00:23:20
Last connect trigger :login down, retry
Cloud Last connect fail status
-------------------------
Last fail server :internal.central.arubanetworks.com
Last fail time :2020-04-23 22:44:38
Last fail reason :tcp connect error
Cloud Last login down status