Overlay Tunnel Orchestration

The Overlay Tunnel Orchestrator (OTO) builds overlay mappings. The OTO discovers the WAN uplinks of the devices and associated attributes to orchestrate the tunnels between points. A tunnel agent registers each uplink and associated attributes with the OTO and gathers all necessary information from the tunnel agent running on every device.

Use OTO to:

  • Discover public/private IP addresses and uplink attributes.

  • Exchange and send keys to devices.

  • Refresh keying material before the old key expires.

  • Build IPSec tunnels.

Configuring an OTO-LAN

To configure an OTO-LAN, complete the following steps.

Note: Note the value of Update Spec Received in the output of show ata counters on your target access points before configuration. This value is used to verify changes after configuration.

  1. Configure a gateway cluster.
    For more information, see Gateway Clustering Profiles.

  2. Configure roles on the gateways.
    For more information for UI configuration, see Assign Roles.
    For more information for API configuration, see Configuring Roles using APIs.

    Note:

    Roles cannot be assigned to device collections.

  3. If you are using APIs to configure OTO-LAN, configure policies.
    For more information, see Configuring Policies using APIs.

    Note:

    Policies can only be assigned at the Global and Site levels.

  4. Configure Overlay WLAN SSID in tunnel mode.
    For more information on UI configuration, see WLAN Profiles.

    For more information on API configuration, see Creating a WLAN SSID.

API Workflows

To configure OTO-LAN using APIs, use the following sections.

Note: In the following sections, the name !oto_cop_demo is used as an example.

Configuring Roles using APIs

To configure roles and assign them a scope, use the following sequence of APIs.

  1. Create a role:

    URI: https://<IP address>/network-config/v1alpha1/roles

    Input payload:

    { "role": [ {     "name": “!oto_cop_demo”, "description": "string" } ] }

  2. Assign a scope to the role:

    URI (POST): https://<IP address>/network-config/v1alpha1/roles

    Input payload:

    { "role": [ {     "name": “!oto_cop_demo”, "description": "string" } ] }

  3. Create and assign policies for OTO-LAN using APIs.

    URI (POST): https://<IP address>/network-config/v1alpha1/scope-maps

    Input payload:

    { "scope-map":[ { "scope-name": "609337757", "persona": "MOBILITY_GW", "resource": "roles/ “!oto_cop_demo" } ] }
    or
    { "scope-map":[ { "scope-name": "609337757", "persona": “CAMPUS_AP", "resource": "roles/ “!oto_cop_demo" } ] }

Configuring Policies using APIs

To configure policies and attach a policy group to them, use the following sequence of APIs .

  1. Create a policy:

    URI (POST): https://<IP address>/network-config/v1alpha1/policies

    Input payload:

    { "policy": [ { "name": "“!oto_cop_demo", "type": "POLICY_TYPE_SECURITY", "association": "ASSOCIATION_ROLE" "security-policy": { "type": "SECURITY_POLICY_TYPE_DEFAULT", "policy-rule": [ { "position": 1, "condition": { "rule-type": "RULE_ANY", "source": { "type": "ADDRESS_ROLE", "role": "“!oto_cop_demo" }, "destination": { "type": "ADDRESS_ANY" } }, "action": { "type": "ACTION_ALLOW" } } ] } } ] }

  2. Add the new policy to a policy group:

    URI (POST): https://<IP address>/v1alpha1/policy-groups/policy-group-list/!oto_cop_demo

    Input payload:

    { "name": “!oto_cop_demo”, "position": 100 }

  3. Assign a scope to the policy:

    URI (POST): https://<IP address>/network-config/v1alpha1/scope-maps

    Input payload:

    { "scope-map":[ { "scope-name": "609337757", "persona": "MOBILITY_GW", "resource": "policies/!oto_cop_demo" } ] }
    or
    { "scope-map":[ { "scope-name": "609337757", "persona": “CAMPUS_AP", "resource": "policies/!oto_cop_demo" } ] }

Creating a WLAN SSID

To configure a WLAN SSID, use the following sequence of APIs.

  1. Create a WLAN SSID:

    URI (POST): https://<IP address>/v1alpha1/wlan-ssids/!oto_cop_demo

    Input payload:

    { "ssid": "!oto_cop_demo", "enable": true, "forward-mode": "FORWARD_MODE_L2", "dmo": { "channel-utilization-threshold": 90 }, "broadcast-filter-ipv4": "BCAST_FILTER_NONE", "ssid-utf8": true, "essid": { "use-alias": false, "name": "!oto_cop_demo" }, "dot11k": true, "dtim-period": 1, "local-probe-req-thresh": 0, "max-clients-threshold": 1024, "rf-band": "24GHZ_5GHZ", "rrm-quiet-ie": true, "opmode": "WPA2_PERSONAL", "personal-security": { "wpa-passphrase": "Aruba@123" }, "default-role": "!oto_cop_demo", "denylist": true, "vlan-selector": "VLAN_RANGES", "vlan-id-range": [ "1487" ] }

  2. Assign the WLAN SSID a scope:

    URI (POST): https://<IP address>/network-config/v1alpha1/scope-maps

    Input payload:

    { "scope-map":[ { "scope-name": "3999730805", "persona": "CAMPUS_AP", "resource": "wlan-ssids/!oto_cop_demo" } ] }

  3. Create an overlay-wlan:

    URI (POST): https://<IP address>/network-config/v1alpha1/overlay-wlans

    Input payload:

    { "ssid-cluster": [ { "profile": "!oto_cop_demo", "overlay-profile-type": "WIRELESS_PROFILE", "gw-cluster-list": [ { "cluster-redundancy-type": "PRIMARY", "cluster": "auto_cluster_mgw", "cluster-scope-id": "3999730805", "cluster-type": "CLUSTER_ID", "tunnel-type": "GRE“ }, { "cluster-redundancy-type": “BACKUP", "cluster": "auto_cluster_mgw", "cluster-scope-id": "3999730806", "cluster-type": "CLUSTER_ID", "tunnel-type": "GRE“ } ] } ] }

  4. Assign scope to the overlay WLAN.

    URI (POST): https://<IP address>/network-config/v1alpha1/scope-maps

    Input payload:

    { "scope-map":[ { "scope-name": "3999730805", "persona": "SERVICE_PERSONA", "resource": "overlay-wlan/!oto_cop_demo" } ] }

Verifying Your Changes

To verify the creation of OTO-LAN tunnels, use the following commands on your target devices.

Access Points

Use the following commands on your access points to verify the creation of OTO-LAN tunnels.

  • Verify an increase in the Update Spec Received stats.

    show ata counters
    ATA Stats Counters ------------------ Event Name Last Stats After 2026-02-18 00:31:28 Total Stats ---------- ------------------------------------ ----------- Resync Requests Sent 978 978 Resync ALL Requests Sent 2 2 Tunnel Event Sent 2994 2994 Tunnel Update Sent 2 2 Batch Spec Received 2925 2925 Create Spec Received 63 63 Create Spec Decode Error 0 0 Update Spec Received 2814 2814 Update Spec Decode Error 0 0 Delete Spec Received 48 48 Delete Spec Decode Error 0 0 Zscaler Create Spec Received 0 0 Zscaler Update Spec Received 0 0 Zscaler Delete Spec Received 0 0 CCS Create Spec Received 0 0 CCS Update Spec Received 0 0 CCS Delete Spec Received 0 0 MAP ID Allocation Failures 0 0 MAP Peer FQDN Resolve Failures 0 0 Allocated MAP ID Count N/A 1

  • Check for the name of the newly created tunnel under the ess field.

    show ap bss-table

    Aruba AP BSS Table ------------------ bss ess port ip band/ht-mode/bandwidth ch/EIRP/max-EIRP type cur-cl ap name in-t(s) tot-t flags mu-mimo mld-mac/link-id MBSSID Group --- --- ---- -- ---------------------- ---------------- ---- ------ ------- ------- ----- ----- ------- --------------- ------------ xx:xx:xx:xx:xx:xx CN-SSID-SIte-1 ?/? xx.x.xxx.xxx 5GHz/HE/80MHz 153E/21.0/26.5 ap 0 xx:xx:xx:xx:xx:xx 0 3d:7h:29m:36s KMTW3 0 - - xx:xx:xx:xx:xx:xx CN-SSID-Site-2 ?/? xx.x.xxx.xxx 5GHz/HE/80MHz 153E/21.0/26.5 ap 0 xx:xx:xx:xx:xx:xx 0 3d:6h:22m:42s KMTW3 0 - - xx:xx:xx:xx:xx:xx CN-SSID-SIte-1 ?/? xx.x.xxx.xxx 2.4GHz/HE/20MHz 1/12.0/22.7 ap 0 xx:xx:xx:xx:xx:xx 0 3d:7h:29m:36s KMTW3 0 - - xx:xx:xx:xx:xx:xx CN-SSID-Site-2 ?/? xx.x.xxx.xxx 2.4GHz/HE/20MHz 1/12.0/22.7 ap 0 xx:xx:xx:xx:xx:xx 0 3d:6h:22m:42s KMTW3 0 - - Channel followed by "*" indicates channel selected due to unsupported configured channel. "Spectrum" followed by "^" indicates Local Spectrum Override in effect. Num APs:4 Num Associations:0 Flags: B = Beacon Protection; c = MBO Cellular Data Capable BSS; d = Deferred Delete Pending; D = VLAN Discovered; E = Enhanced-open BSS without transition mode; I = Imminent VAP Down; K = 802.11K Enabled; m = Agile Multiband (MBO) BSS; M = WPA3-SAE mixed mode BSS; o = Enhanced-open transition mode open BSS; O = Enhanced-open BSS with transition mode; Q = DFS CAC timer running; r = 802.11r Enabled; t = Broadcast TWT Enabled; T = Individual TWT Enabled; W = 802.11W Enabled; x = MBSSID Tx BSS; z = WPA3-AES-CCM128 BSS; Z = WPA3-AES-CCM128 BSS with transition mode; 3 = WPA3 BSS; xx:xx:xx:xx:xx:de#

  • Check the endpoints of the newly created tunnel.

    show ata endpoint

    ATA Endpoint Status ------------------- UUID IP ADDR STATE TUN DEV TUN SPI(OUT/IN) LINK TAG VALID TIME(s) TUNNEL TYPE GRE VLANs HBT(Jiff/Missed/Sent/Rcv) INNER IP UP TIME(s) ---- ------- ----- ------- --------------- -------- ------------- ----------- --------- ------------------------- -------- ---------- 52db025d-1e70-4795-b151-411fe662d1c4 xx.x.xx.xx SM_STATE_CONNECTED tun0 4d012600/dc0ca600 inet 43393 GRE 1,198 890146/0/285303/279447 xx.x.xxx.xxx 2026-04-17 20:45:30 Total Endpoints Count: 1

  • Validate the current configuration:

    show ata current-cfg

    Current Central is Up Microbranch AP is Disabled Microbranch System IP is 0.0.0.0/:: [Current Configuration For cluster(auto_group_104)] <Tunnel list> -----pub_ip=xx.x.xx.187, local_ip=xx.x.xx.187, pub_v6_ip=0.0.0.0, local_v6_ip=0.0.0.0, prefer_v6=0 vlan=1,109,1016, mcast=0, Tun_Type=GRE, peer_device_type=Gateway, key_exp=129600,dstNatt=4500, HBT_interval=3, HBT_Threshold=10 -----pub_ip=xx.x.xx.186, local_ip=xx.x.xx.186, pub_v6_ip=0.0.0.0, local_v6_ip=0.0.0.0, prefer_v6=0 vlan=1,109,1016, mcast=0, Tun_Type=GRE, peer_device_type=Gateway, key_exp=129600,dstNatt=4500, HBT_interval=3, HBT_Threshold=10 <SSID list for primary> -----ssid=9012-CN-AP-SSID, type=0 [Current Configuration For cluster(manual_cluster_9114)] <Tunnel list> -----pub_ip=xx.x.xx.99, local_ip=xx.x.xx.99, pub_v6_ip=0.0.0.0, local_v6_ip=0.0.0.0, prefer_v6=0 vlan=1,198, mcast=0, Tun_Type=GRE, peer_device_type=Gateway, key_exp=43400,dstNatt=4500, HBT_interval=3, HBT_Threshold=10 <SSID list for primary> -----ssid=CN-SSID-Site-2, type=0 -----ssid=CN-SSID-SIte-1, type=0 8c:79:09:c3:ce:de#

Gateways

Use the following commands to verify changes on your target gateway devices.

  • List active IPSec security associations

    show crypto ipsec sa

    Tunnel Service SA Information ----------------------------------- Initiator IP Responder IP SPI(IN/OUT) Flags Start Time Tunnel Type Inner IP ------------ ------------ ---------------- ------ --------------- ------------ ---------- xx.x.xxx.xx xx.x.xx.xxx ea303400/4af5b400 UTlt Apr 19 23:49:50 AP xx.x.xxx.xx IPSEC SA (V2) Active Session Information ----------------------------------- Initiator IP Responder IP SPI(IN/OUT) Flags Start Time Tunnel Type Inner IP ------------ ------------ ---------------- ------ --------------- ------------ ---------- xx.x.xx.xxx xx.x.xx.xxx 33e42500/3b330200 T2 Apr 19 23:12:33 N/A - Flags: T = Tunnel Mode; E = Transport Mode; U = UDP Encap L = L2TP Tunnel; N = Nortel Client; C = Client; 2 = IKEv2 l = uplink load-balance; t = Tunnel Service; P = Reverse-Pinning Enabled Total IPSEC SAs: 2

  • Display information about a specific IPSec security association

    show crypto ipsec sa peer <ap ip>

    show crypto ipsec sa peer xx.x.xxx.xx Initiator: No Initiator IP: xx.x.xxx.xx Responder IP: xx.x.xxx.xx Peer-Local IP: xx.x.xxx.xx UDP Natt Port: 4500 UDP Natt Src-Port: 4500 Peer-Ip: xx.x.xxx.xx SA Creation Date: Sun Apr 19 00:36:42 2026 SA Rekey Number: 348 SA Rekey Date: Sun Apr 19 23:49:50 2026 Life secs: 43400 Encapsulation Mode Tunnel IP Compression Disabled Encryption Alg: AES 256 Authentication Alg: SHA256 IN SPI: EA303400, OUT SPI: 4AF5B400 Ipsec-map name: ap-ipsecmap-d0:d3:e0:cb:da:8a UUID: 41d6a957-a086-48c5-9b0f-eeb77d4ec650 Pair UUID: 11159479-5596-40a1-a1a6-4cfa0246c499 Tunnel Type: AP Sos Program: Ingress: Yes Egress: Yes

  • List all tunnels

    show tunnelmgr tunnel-list

    Tunnelmgr Table Dump -------------------- Tunnel ID Map ID Peer IP Peer MAC Device-Type Secure-Mode Status GRE ID Mtu --------- ------ ------- -------- ----------- ----------- ------ ------ --- 41d6a957-a086-48c5-9b0f-eeb77d4ec650 0x70001 xx.x.xxx.xx 00:00:00:00:00:00 AP No UP 10 1500

HPE Aruba Networking Central UI

To list all available OTO-LAN tunnels, use the gateway device page.

For more information, see LAN Tunnels.

Figure 1: LAN Tunnels