NOTE: If IPsec tunnel is required for AirWave, the switch requires Aruba Mobility Controller IP
address, which is provided through ZTP with DHCP Option 138 (CAPWAP).
Limitations
• ZTP is not supported through OOBM.
• The HTTPS check-in to AirWave does not support HTTPS proxy.
• For non-ZTP cases, the AirWave check-in starts by validating the following condition: Primary or Management
VLAN must be configured with the IP address and one of the interfaces must be UP. By default, VLAN 1 is the
primary VLAN.
Best Practices
• Implement ZTP in a secure and private environment. Any public access may compromise the security of the
switch, as follows:
◦ Since ZTP is enabled only on the factory default configuration of the switch, DHCP snooping is not
enabled. The Rogue DHCP server is to be manually managed.
◦ The DHCP offer is in plain data without encryption. Therefore, the offer can be listened by any device on
the network and they can in turn obtain the AirWave information.
◦ The TLS certificate of the server is not validated by the switch during the HTTPs check-in to AirWave. The
AirWave server must be hosted in a private and secure environment of the switch.
Configure AirWave details in DHCP (preferred method)
To configure a DHCP server for AirWave, from a Windows Server 2008, do the following steps:
Procedure
1. From the Start menu, select Server Manager.
Chapter 10 Zero Touch Provisioning with AirWave and Central 223
To Next Page