Concept Guide

287| cluster-root-ip Dell Networking W-Series ArubaOS 6.5.x| Reference Guide
Usage Guidelines
If your network includes multiple master controllers each with their own hierarchy of APs and local controllers,
you can allow APs from one hierarchy to failover to any other hierarchy by defining a cluster of master
controllers. Each cluster will have one master controller as its cluster root, and all other master controllers as
cluster members.
The master controller operating as the cluster root will use the control plane security feature to create a self-
signed certificate, then certify it’s own local controllers and APs. Next, the cluster root will send the certificate to
each cluster member, which in turn certifies their own local controllers and APs. Since all controllers and APs in
the cluster get their certificates from the cluster root, they will all have the same trust anchor, and the APs can
switch to any other controller in the cluster and still remain connected to the secure network. Issue the cluster-
member-ip command on the controller you want to define as the cluster root to select the certificate or define
the IPsec key for secure communication between the cluster root and each cluster member.
Once the cluster root has defined an IPsec key or certificate for all cluster members, you must access each of
the member controllers and issue the command cluster-root-ip to define the IPsec key or certificate for
communication to the cluster root.
For information on installing certificates on your controller, refer to the Management Utilities chapter of the Dell
Networking W-Series ArubaOS User Guide.
Example
The following command defines the IPsec key for communication between the cluster member and the root
controller172.21.45.22:
(host) (config) #cluster-root-ip 172.21.45.22 ipsec ipseckey1
Related Commands
Parameter Description Mode
control-plane-security
Configure the control plane security profile. Config mode
show cluster-config
Show the multi-master cluster configuration for the
control plane security feature.
Enable mode
show cluster-switches
Issue this command on a master controller using
control plane security in a multi-master environment
to show other the other controllers to which it is
connected.
Enable mode
Command History
Release Modification
ArubaOS 5.0 Command introduced.
ArubaOS 6.1 The ipsec-factory-cert and ipsec-custom-cert parameters were
introduced to allow certificate-based authentication of cluster members.