Configuring User-Based Tunneling for AOS-CX

User-based tunneling (UBT User-Based Tunneling. UBT allows you to redirect specific wired users traffic from the switches to the Gateway to enforce DPI and firewall functionality, application visibility, and bandwidth control offered by Aruba Gateway.) uses GRE Generic Routing Encapsulation. GRE is an IP encapsulation protocol that is used to transport packets over a network. to tunnel ingress traffic on a switch interface to a gateway for further processing. User-based tunneling enables a switch to provide a centralized security policy, using per-user authentication and access control to ensure consistent access and permissions.

User-based tunneling is supported on the following switches:

• AOS-CX 4100i switch series
• AOS-CX 6200 switch series
• AOS-CX 6300 switch series
• AOS-CX 6400 switch series

For provisioning User-based tunnel, the following configurations are necessary:

• All devices need to be Day 0 provisioned
• Underlay network is connected and reachability established
• All devices in the underlay and topology is clearly identified

To configure user-based tunnel, complete the following steps:

1. In the WebUI, select one of the following options:
   • To select a switch group in the filter:
     1. Set the filter to a group.
        

        The dashboard context for the group is displayed.

     2. Under Manage, click Devices > Switches.

        A list of switches is displayed in the List view.

     3. Click the Config icon to view the switch configuration dashboard.
   • To select a switch in the filter:
     1. Set the filter to Global or a group containing at least one switch.
     2. Under Manage, click Devices > Switches.
        

        A list of switches is displayed in the List view.

     3. Click an AOS-CX switch under Device Name.
        

        The dashboard context for the switch is displayed.

     4. Under Manage, click Device.
        

        The AOS-CX UI configuration page is displayed.

2. Click Security > Dynamic Segmentation.

   The Configure User Based Tunnel page is displayed.

3. Toggle User based tunneling switch to on position. The toggle switch is disabled by default. Enabling this toggle, shows a warning message on how to configure the User-based tunnel.
4. Enter Primary controller IP address and Backup controller IP address. Make sure that primary and backup IP address are different.
5. Enter the VLAN Virtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. ID under Client VLAN.
6. Click the Source interface drop-down and select Add new source interface.

   The Edit Source Interface window is displayed. Configure the following parameters.

   If a user-based tunnel source interface is already added in the Source Interface page, it will appear in the drop-down. For more information about source interface, see Configuring Source Interface for AOS-CX.

   New source interface

   Table 1: New Source Interface Parameters

   Name	Description	Value
   Interface	The interface or the service name. By default, only User-based tunneling is selected in the Dynamic Segmentation The Dynamic Segmentation feature is Aruba’s security architecture that provides the ability to dynamically assign roles to a wired port based on the access method of a client and enforce application-aware policies to all devices connecting to the infrastructure. page.	User-based tunneling
   Port/LAG Link Aggregation Group . A LAG combines a number of physical ports together to make a single high-bandwidth data path. LAGs can connect two switches to provide a higher-bandwidth connection to a public network.	Type of interface you want to configure. The name of this field is applicable only at the group level. At the device level, the field name is Port/LAG/VLAN/Address.	At the group level—Port or LAG At the device level—Port, LAG, VLAN, or Address
   Port name	Port number for the source interface. Applicable when you select Port in the Port/LAG drop-down at the group level or Port/LAG/VLAN/Address drop-down at the device level.	Select a port from the drop-down. NOTE:   At the group level—Only the ports that have routing enabled at the group level are available in this drop-down. At the device level—Only the ports that have routing enabled and IP address configured on the ports at the device level are listed in this drop-down.
   LAG name	LAG name for the source interface. Applicable when you select Port in the Port/LAG drop-down at the group level or Port/LAG/VLAN/Address drop-down at the device level.	Select a LAG from the drop-down. NOTE:   At the group level—Only the LAGs that have routing enabled at the group level are available in this drop-down. At the device level—Only the LAGs that have routing enabled and IP address configured on the LAGs at the device level are listed in this drop-down.
   VLAN ID	VLAN ID for the source interface. NOTE:   Available only at the device level. Applicable when you select VLAN in the Port/LAG/VLAN/Address drop-down at the device level.	Select a VLAN from the drop-down. NOTE:   Only the VLANs that have an IP address configured at the device level are listed in this drop-down. The IP address must be a static IP address. DHCP Dynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  server is not supported.
   Address	IP address for the source interface. NOTE:   Available only at the device level. Applicable when you select Address in the Port/LAG/VLAN/Address drop-down at the device level.	IPv4 address
   VRF Virtual Routing and Forwarding. VRF is a technology that allows multiple instances of a routing table to co-exist within the same router.	The VRF to be used for communicating with DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. and NTP Network Time Protocol. NTP is a protocol for synchronizing the clocks of computers over a network. servers.	Default

7. Click Save.