show running

Building Configuration...
 
version 8.10
hostname "noc-aruba-mm" 
clock timezone America/New_York -05 0 
!
location "Building1.floor1" 
controller config 716
crypto-local pki ServerCert scsd_wc2_full_2026 StarCert-Ex03_26_fullchain.pfx 
crypto-local pki ServerCert scsd_wildcard_2026 StarCert-Ex03_26_fullchain.pfx 
crypto-local pki PublicCert master-ssh-pub-cert master-ssh-pub-cert 
ip nat pool dynamic-srcnat 0.0.0.0 0.0.0.0 
ip nat pool localip 0.0.0.0 0.0.0.0 
ip access-list eth validuserethacl 
    permit any 
!
ip access-list geolocation global-geolocation-acl 
!
netservice svc-snmp-trap udp 162 
netservice svc-netbios-dgm udp 138 
netservice svc-pcoip2-tcp tcp 4172 
netservice svc-facetime-tcp tcp 5223 ALG facetime 
netservice svc-https tcp 443 
netservice svc-dhcp udp 67 68 ALG dhcp 
netservice svc-ike udp 500 
netservice svc-smb-tcp tcp 445 
netservice svc-l2tp udp 1701 
netservice svc-citrix tcp 2598 
netservice svc-syslog udp 514 
netservice svc-ica tcp 1494 
netservice svc-pptp tcp 1723 
netservice svc-telnet tcp 23 
netservice svc-sccp tcp 2000 ALG sccp 
netservice svc-sec-papi udp 8209 
netservice svc-tftp udp 69 ALG tftp 
netservice svc-sip-tcp tcp 5060 ALG sip 
netservice svc-lpd tcp 515 
netservice svc-web tcp list "80 443" 
netservice svc-kerberos udp 88 
netservice svc-netbios-ssn tcp 139 
netservice svc-pcoip-udp udp 50002 
netservice svc-pop3 tcp 110 
netservice svc-pcoip-tcp tcp 50002 
netservice svc-http-proxy3 tcp 8888 
netservice svc-adp udp 8200 
netservice svc-cfgm-tcp tcp 8211 
netservice svc-noe udp 32512 ALG noe 
netservice svc-dns udp 53 ALG dns 
netservice svc-rtsp tcp 554 ALG rtsp 
netservice svc-msrpc-tcp tcp 135 139 
netservice svc-h323-tcp tcp 1720 ALG h323 
netservice svc-vocera udp 5002 ALG vocera 
netservice svc-http tcp 80 
netservice svc-h323-udp udp 1718 1719 ALG h323 
netservice vnc tcp 5900 5905 
netservice svc-nterm tcp 1026 1028 
netservice svc-http-proxy2 tcp 8080 
netservice svc-sip-udp udp 5060 ALG sip 
netservice svc-noe-oxo udp 5000 ALG noe 
netservice svc-papi udp 8211 
netservice svc-natt udp 4500 
netservice svc-ftp tcp 21 ALG ftp 
netservice svc-svp 119 ALG svp 
netservice svc-microsoft-ds tcp 445 
netservice svc-gre 47 
netservice svc-smtp tcp 25 
netservice svc-sips tcp 5061 ALG sips 
netservice svc-netbios-ns udp 137 
netservice svc-smb-udp udp 445 
netservice svc-esp 50 
netservice svc-ipp-tcp tcp 631 
netservice svc-pcoip2-udp udp 4172 
netservice svc-snmp udp 161 
netservice svc-bootp udp 67 69 
netservice svc-v6-dhcp udp 546 547 
netservice svc-icmp 1 
netservice svc-ntp udp 123 
netservice svc-msrpc-udp udp 135 139 
netservice svc-ssh tcp 22 
netservice svc-ipp-udp udp 631 
netservice svc-http-proxy1 tcp 3128 
netservice svc-v6-icmp 58 
netservice svc-vmware-rdp tcp 3389 
netdestination6 ipv6-reserved-range 
    invert 
    network 2000::/3 
!
netdestination wificalling-block 
    name pub.3gppnetwork.org 
    name vowifi.com 
!
netexthdr default 
!
time-range periodic night-hours 
    Weekday 18:01 to 23:59 
    Weekday 00:00 to 07:59 
!
time-range periodic working-hours 
    Weekday 08:00 to 18:00 
!
ip access-list session control 
    user any udp 68 deny 
    any any svc-icmp permit 
    any any svc-dns permit 
    any any svc-papi permit 
    any any svc-sec-papi permit 
    any any svc-cfgm-tcp permit 
    any any svc-adp permit 
    any any svc-tftp permit 
    any any svc-dhcp permit 
    any any svc-natt permit 
    any any tcp 6633 permit 
!
ip access-list session v6-icmp-acl 
    ipv6 any any svc-v6-icmp permit 
!
ip access-list session allow-diskservices 
    any any svc-netbios-dgm permit 
    any any svc-netbios-ssn permit 
    any any svc-microsoft-ds permit 
    any any svc-netbios-ns permit 
!
ip access-list session validuser 
    network 127.0.0.0 255.0.0.0 any any deny 
    network 169.254.0.0 255.255.0.0 any any deny 
    network 224.0.0.0 240.0.0.0 any any deny 
    host 255.255.255.255 any any deny 
    network 240.0.0.0 240.0.0.0 any any deny 
    any any any permit 
    ipv6 host fe80:: any any deny 
    ipv6 network fc00::/7 any any permit 
    ipv6 network fe80::/64 any any permit 
    ipv6 alias ipv6-reserved-range any any deny 
    ipv6 any any any permit 
!
ip access-list session vocera-acl 
    any any svc-vocera permit queue high 
!
ip access-list session v6-https-acl 
    ipv6 any any svc-https permit 
!
ip access-list session voip-applications-acl 
    any any app alg-skype4b-audio permit 
    any any app alg-skype4b-video permit 
    any any app alg-skype4b-desktop-sharing permit 
    any any app alg-skype4b-app-sharing permit 
    any any app alg-sip-audio permit 
    any any app alg-sip-video permit 
    any any app alg-sccp permit 
    any any app alg-vocera permit 
    any any app alg-noe permit 
    any any app alg-h323 permit 
    any any app alg-jabber-audio permit 
    any any app alg-jabber-video permit 
    any any app alg-jabber-desktop-sharing permit 
    any any app alg-facetime permit 
    any any app alg-wifi-calling permit 
    any any app alg-webrtc-audio permit 
    any any app alg-webrtc-video permit 
    any any app alg-teams-audio permit 
    any any app alg-teams-video permit 
    any any app alg-rtp permit 
!
ip access-list session vmware-acl 
    any any svc-vmware-rdp permit tos 46 dot1p-priority 6 
    any any svc-pcoip-tcp permit tos 46 dot1p-priority 6 
    any any svc-pcoip-udp permit tos 46 dot1p-priority 6 
    any any svc-pcoip2-tcp permit tos 46 dot1p-priority 6 
    any any svc-pcoip2-udp permit tos 46 dot1p-priority 6 
!
ip access-list session icmp-acl 
    any any svc-icmp permit 
!
ip access-list session apprf-default-vpn-role-sacl 
!
ip access-list session apprf-logon-sacl 
!
ip access-list session v6-control 
    ipv6 user any udp 546 deny 
    ipv6 any any svc-v6-icmp permit 
    ipv6 any any svc-dns permit 
    ipv6 any any svc-papi permit 
    ipv6 any any svc-sec-papi permit 
    ipv6 any any svc-cfgm-tcp permit 
    ipv6 any any svc-adp permit 
    ipv6 any any svc-tftp permit 
    ipv6 any any svc-v6-dhcp permit 
    ipv6 any any svc-natt permit 
    ipv6 any any svc-dhcp permit 
!
ip access-list session jabber-acl 
    any any tcp 5222 permit 
    any any tcp 8443 permit 
!
ip access-list session apprf-authenticated-sacl 
!
ip access-list session apprf-switch-logon-sacl 
!
ip access-list session apprf-stateful-dot1x-sacl 
!
ip access-list session v6-dhcp-acl 
    ipv6 any any svc-v6-dhcp permit 
!
ip access-list session captiveportal 
    user alias controller svc-https dst-nat 8081 
    user any svc-http dst-nat 8080 
    user any svc-https dst-nat 8081 
    user any svc-http-proxy1 dst-nat 8088 
    user any svc-http-proxy2 dst-nat 8088 
    user any svc-http-proxy3 dst-nat 8088 
!
ip access-list session wificalling-acl 
    any any tcp 443 permit 
!
ip access-list session allowall 
    any any any permit 
    ipv6 any any any permit 
!
ip access-list session v6-dns-acl 
    ipv6 any any svc-dns permit 
!
ip access-list session facetime-acl 
    any any svc-facetime-tcp permit queue high 
    any any udp 3478 3497 permit 
    any any udp 16384 16387 permit 
    any any udp 16393 16402 permit 
!
ip access-list session apprf-voice-sacl 
!
ip access-list session skype4b-acl 
    any any svc-sips permit 
    any any svc-https permit 
!
ip access-list session apprf-default-iap-user-role-sacl 
!
ip access-list session captiveportalbridge 
    user alias localip svc-https dual-nat pool localip 8081 
    user any svc-http dual-nat pool localip 8080 
    user any svc-https dual-nat pool localip 8081 
    user any svc-http-proxy1 dual-nat pool localip 8088 
    user any svc-http-proxy2 dual-nat pool localip 8088 
    user any svc-http-proxy3 dual-nat pool localip 8088 
!
ip access-list session wan-uplink-protect-acl 
    any any sys-svc-dhcp permit 
    ipv6 any any sys-svc-v6-dhcp permit 
    any any sys-svc-esp permit 
    any any sys-svc-natt permit 
    any any sys-svc-ike permit 
    any any sys-svc-icmp permit 
    ipv6 any any sys-svc-icmp6 permit 
!
ip access-list session sip-acl 
    any any svc-sip-udp permit queue high 
    any any svc-sip-tcp permit queue high 
!
ip access-list session https-acl 
    any any svc-https permit 
!
ip access-list session citrix-acl 
    any any svc-citrix permit tos 46 dot1p-priority 6 
    any any svc-ica permit tos 46 dot1p-priority 6 
!
ip access-list session ra-guard 
    ipv6 user any icmpv6 rtr-adv deny 
!
ip access-list session dns-acl 
    any any svc-dns permit 
!
ip access-list session allow-printservices 
    any any svc-lpd permit 
    any any svc-ipp-tcp permit 
    any any svc-ipp-udp permit 
!
ip access-list session skinny-acl 
    any any svc-sccp permit queue high 
!
ip access-list session logon-control 
    user any udp 68 deny 
    any any svc-icmp permit 
    any any svc-dns permit 
    any any svc-dhcp permit 
    any any svc-natt permit 
    any network 169.254.0.0 255.255.0.0 any deny 
    any network 240.0.0.0 240.0.0.0 any deny 
!
ip access-list session v6-allowall 
    ipv6 any any any permit 
!
ip access-list session tftp-acl 
    any any svc-tftp permit 
!
ip access-list session vpnlogon 
    user any svc-ike permit 
    user any svc-esp permit 
    any any svc-l2tp permit 
    any any svc-pptp permit 
    any any svc-gre permit 
!
ip access-list session srcnat 
    user any any src-nat 
!
ip access-list session wificalling-block 
    any alias wificalling-block any deny 
!
ip access-list session cplogout 
    user alias controller svc-https dst-nat 8081 
!
ip access-list session captiveportal6 
    ipv6 user alias controller6 svc-https captive 
    ipv6 user any svc-http captive 
    ipv6 user any svc-https captive 
    ipv6 user any svc-http-proxy1 captive 
    ipv6 user any svc-http-proxy2 captive 
    ipv6 user any svc-http-proxy3 captive 
!
ip access-list session http-acl 
    any any svc-http permit 
!
ip access-list session apprf-default-via-role-sacl 
!
ip access-list session dhcp-acl 
    any any svc-dhcp permit 
!
ip access-list session v6-http-acl 
    ipv6 any any svc-http permit 
!
ip access-list session stateful-dot1x 
    any any svc-dns permit 
    any any svc-dhcp permit 
!
ip access-list session apprf-ap-role-sacl 
!
ip access-list session apprf-guest-sacl 
!
ip access-list session ap-uplink-acl 
    any any udp 68 permit 
    any any svc-icmp permit 
    any host 224.0.0.251 udp 5353 permit 
    ipv6 any any udp 546 permit 
    ipv6 any any svc-v6-icmp permit 
    ipv6 any host ff02::fb udp 5353 permit 
!
ip access-list session apprf-guest-logon-sacl 
!
ip access-list session noe-acl 
    any any svc-noe permit queue high 
!
ip access-list session ap-acl 
    any any svc-gre permit 
    any any svc-syslog permit 
    any user svc-snmp permit 
    user any svc-snmp-trap permit 
    user any svc-ntp permit 
    user any svc-ftp permit 
    user any svc-telnet deny 
!
ip access-list session logon-control-bridge 
    user any udp 68 deny 
    any any svc-icmp src-nat 
    any any svc-dns src-nat 
    any any svc-dhcp permit 
    any network 169.254.0.0 255.255.0.0 any deny 
    any network 240.0.0.0 240.0.0.0 any deny 
!
ip access-list session svp-acl 
    any any svc-svp permit queue high 
    user host 224.0.1.116 any permit 
!
ip access-list session global-sacl 
!
ip access-list session v6-ap-acl 
    ipv6 any any svc-gre permit 
    ipv6 any any svc-syslog permit 
    ipv6 any user svc-snmp permit 
    ipv6 user any svc-snmp-trap permit 
    ipv6 user any svc-ntp permit 
    ipv6 user any svc-ftp permit 
!
ip access-list session apprf-sys-switch-role-sacl 
!
ip access-list session h323-acl 
    any any svc-h323-tcp permit queue high 
    any any svc-h323-udp permit queue high 
!
ip access-list session v6-logon-control 
    ipv6 user any udp 546 deny 
    ipv6 any any svc-v6-icmp permit 
    ipv6 any any svc-v6-dhcp permit 
    ipv6 any any svc-dns permit 
    ipv6 any network fc00::/7 any permit 
    ipv6 any network fe80::/64 any permit 
    ipv6 any alias ipv6-reserved-range any deny 
!
ip access-list session apprf-sys-ap-role-sacl 
!
ip access-list route uplink-lb-cfg-racl 
!
ip access-list route master-boc-traffic 
!
vpn-dialer default-dialer 
    ike authentication pre-share ****** 
!
user-role ap-role 
    no openflow-enable 
    access-list session ra-guard 
    access-list session control 
    access-list session ap-acl 
    access-list session v6-control 
    access-list session v6-ap-acl 
!
user-role denyall 
!
user-role default-vpn-role 
    access-list session global-sacl 
    access-list session apprf-default-vpn-role-sacl 
    access-list session ra-guard 
    access-list session allowall 
    access-list session v6-allowall 
!
user-role sys-switch-role 
!
user-role sys-ap-role 
    no openflow-enable 
!
user-role voice 
    access-list session global-sacl 
    access-list session apprf-voice-sacl 
    access-list session ra-guard 
    access-list session sip-acl 
    access-list session noe-acl 
    access-list session svp-acl 
    access-list session vocera-acl 
    access-list session skinny-acl 
    access-list session h323-acl 
    access-list session dhcp-acl 
    access-list session tftp-acl 
    access-list session dns-acl 
    access-list session icmp-acl 
    access-list session http-acl 
    access-list session https-acl 
    access-list session skype4b-acl 
    access-list session facetime-acl 
    access-list session jabber-acl 
    access-list session wificalling-acl 
    access-list session voip-applications-acl 
!
user-role default-via-role 
    access-list session global-sacl 
    access-list session apprf-default-via-role-sacl 
    access-list session allowall 
    access-list session v6-allowall 
!
user-role switch-logon 
!
user-role guest-logon 
    captive-portal "default" 
    access-list session ra-guard 
    access-list session logon-control 
    access-list session captiveportal 
    access-list session v6-logon-control 
    access-list session captiveportal6 
!
user-role guest 
    access-list session global-sacl 
    access-list session apprf-guest-sacl 
    access-list session ra-guard 
    access-list session http-acl 
    access-list session https-acl 
    access-list session dhcp-acl 
    access-list session icmp-acl 
    access-list session dns-acl 
    access-list session v6-http-acl 
    access-list session v6-https-acl 
    access-list session v6-dhcp-acl 
    access-list session v6-icmp-acl 
    access-list session v6-dns-acl 
!
user-role stateful-dot1x 
    access-list session global-sacl 
    access-list session apprf-stateful-dot1x-sacl 
!
user-role authenticated 
    access-list session global-sacl 
    access-list session apprf-authenticated-sacl 
    access-list session ra-guard 
    access-list session allowall 
    access-list session v6-allowall 
!
user-role default-iap-user-role 
    access-list session allowall 
!
user-role logon 
    access-list session ra-guard 
    access-list session logon-control 
    access-list session captiveportal 
    access-list session vpnlogon 
    access-list session v6-logon-control 
    access-list session captiveportal6 
!
ip tacacs source-interface vlan 35 
!
aaa tacacs-accounting 


controller-ip vlan 35 
datapath energy-efficiency 
kernel coredump 
no kernel printk 
interface mgmt 
    shutdown 
!

vlan 1 
!
vlan 35 
    description "Wireless" 
!
vlan 304 
!
vlan 404 
!

vlan-name Secure-04-Nottingham 
vlan Secure-04-Nottingham 304 
vlan-name Vendor-04-Nottingham 
vlan Vendor-04-Nottingham 404 


interface gigabitethernet 0/0/0 
    trusted 
    trusted vlan 1-4094 
    no poe 
    switchport mode access 
    switchport access vlan 35 
    switchport trunk allowed vlan 1-4094 
    no spanning-tree 
!

interface gigabitethernet 0/0/1 
    shutdown 
    trusted 
    trusted vlan 1-4094 
    no poe 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
    no spanning-tree 
!

interface port-channel 0 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 1 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 2 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 3 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 4 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 5 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 6 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface port-channel 7 
    switchport mode access 
    switchport access vlan 1 
    switchport trunk allowed vlan 1-4094 
!

interface vlan 35 
    ip address 10.1.35.13 255.255.255.0 
!

interface vlan 1 
!

!
!
ip default-gateway 10.1.35.1 
ip route 10.1.35.33 255.255.255.255 ipsec default-psk-redundant-conductor-ipsecmap 
ip nexthop-list load-balance-gateways 
!
ip nexthop-list load-balance-ipsecs 
!
ip nexthop-list traditional-ipsecs 
!

crypto isakmp policy 20 
    encryption AES256 
    authentication pre-share 
!

crypto isakmp policy 10001 
    authentication pre-share 
!

crypto isakmp policy 10002 
    encryption AES256 
    authentication rsa-sig 
!

crypto isakmp policy 10003 
    encryption AES256 
    authentication pre-share 
!

crypto isakmp policy 10004 
    version v2 
    encryption AES256 
    authentication rsa-sig 
!

crypto isakmp policy 10005 
    encryption AES256 
    authentication pre-share 
!

crypto isakmp policy 10006 
    version v2 
    encryption AES128 
    authentication rsa-sig 
!

crypto isakmp policy 10007 
    version v2 
    encryption AES128 
    authentication pre-share 
!

crypto isakmp policy 10008 
    version v2 
    encryption AES128 
    hash sha2-256-128 
    group 19 
    authentication ecdsa-256 
    prf PRF-HMAC-SHA256 
!

crypto isakmp policy 10009 
    version v2 
    encryption AES256 
    hash sha2-384-192 
    group 20 
    authentication ecdsa-384 
    prf PRF-HMAC-SHA384 
!

crypto isakmp policy 10012 
    version v2 
    encryption AES256 
    authentication rsa-sig 
!

crypto isakmp policy 10013 
    encryption AES256 
    authentication pre-share 
!

crypto isakmp policy 10014 
    version v2 
    encryption AES256 
    hash sha2-256-128 
    group 14 
    authentication pre-share 
    prf PRF-HMAC-SHA256 
!

crypto isakmp policy 10015 
    version v2 
    encryption AES128 
    hash sha2-256-128 
    group 14 
    authentication rsa-sig 
    prf PRF-HMAC-SHA256 
!

crypto ipsec transform-set default-ha-transform esp-3des esp-sha-hmac 
crypto ipsec transform-set default-boc-bm-transform esp-aes256 esp-sha-hmac 
crypto ipsec transform-set default-1st-ikev2-transform esp-aes256 esp-sha-hmac 
crypto ipsec transform-set default-3rd-ikev2-transform esp-aes128 esp-sha-hmac 
crypto ipsec transform-set default-rap-transform esp-aes256 esp-sha-hmac 
crypto ipsec transform-set default-aes esp-aes256 esp-sha-hmac 
crypto dynamic-map default-rap-ipsecmap 10001 
    version v2 
    set transform-set "default-gcm256" "default-gcm128" "default-rap-transform" 
!

crypto dynamic-map default-rap-ipsecmap-gcm 10001 
    version v2 
    set transform-set "default-gcm256" "default-gcm128" 
!

crypto dynamic-map default-rap-ipsecmap-aes 10001 
    version v2 
    set transform-set "default-rap-transform" 
!

crypto dynamic-map default-dynamicmap 10000 
    set transform-set "default-transform" "default-aes" 
!

crypto map GLOBAL-IKEV2-MAP 10000 ipsec-isakmp dynamic default-rap-ipsecmap 
crypto map GLOBAL-MAP 10000 ipsec-isakmp dynamic default-dynamicmap 
localip 10.1.35.14  ipsec *redacted*
localip 10.1.35.11  ipsec *redacted*
localip 10.1.35.12  ipsec *redacted*
crypto isakmp eap-passthrough eap-tls 
crypto isakmp eap-passthrough eap-peap 
crypto isakmp eap-passthrough eap-mschapv2 

vpdn group l2tp 
!

ip dynamic-dns interval 900 
  
  
  
  



snmp-server community "mickey03" 
vpdn group pptp 
!

tunneled-node-address 0.0.0.0 

adp discovery disable
adp igmp-join disable
adp igmp-vlan-id 0

ap flush-r1-on-new-r0 disable
amon msg-buffer-size 1264 
amon udp 0
mgmt-server primary-server 10.1.35.10 profile default-amp transport udp 



ssh mgmt-auth public-key 
ssh mgmt-auth username/password 
mgmt-user admin root ******************** 
mgmt-user guestadmin guest-provisioning ******************** node / 
mgmt-user ssh-pubkey client-cert master-ssh-pub-cert seamless-logon read-only 
mgmt-user ssh-pubkey client-cert master-ssh-pub-cert seamless-logon-w standard 

ntp 



database synchronize period 60 
ip mobile domain default 
!
ip mobile domain default 
!

ip igmp 
!

ipv6 mld 
!

firewall 
    prohibit-ip-spoofing 
    attack-rate grat-arp 50 drop 
    session-idle-timeout 16 
    cp-bandwidth-contract untrusted-ucast 9765 
    cp-bandwidth-contract untrusted-mcast 1953 
    cp-bandwidth-contract trusted-ucast 98304 
    cp-bandwidth-contract trusted-mcast 1953 
    cp-bandwidth-contract route 976 
    cp-bandwidth-contract sessmirr 976 
    cp-bandwidth-contract vrrp 512 
    cp-bandwidth-contract arp-traffic 976 
    cp-bandwidth-contract l2-other 976 
    cp-bandwidth-contract auth 976 
    cp-bandwidth-contract ike 1953 
    cp-bandwidth-contract udp-traffic 204800 
    cp-bandwidth-contract ippkt-err 128 
    amsdu 
wireless-bridge-aging 
    session-tunnel-fib
    optimize-dad-frames
    deny-needfrag-df-ipsec  
!
ipv6 firewall 
    ext-hdr-parse-len 100 
    dpi-classif-cache  0
!
!

!

!
firewall cp 
    ipv4 permit any proto 6 ports 9190 9190 
    ipv6 permit any proto 6 ports 9190 9190 
    ipv6 permit any proto 6 ports 15260 15260 
    ipv6 deny any proto 0 ports 0 65535 
!
ip domain lookup 
!
country US 
change-config-node /
aaa authentication mac "default" 
!
aaa authentication dot1x "default" 
!
aaa authentication dot1x "default-psk" 
!
aaa authentication-server tacacs "ClearPass A" 
    host "10.1.40.116" 
     key *redacted*
    session-authorization 
!
aaa authentication-server tacacs "ClearPass B" 
    host "10.1.40.117" 
     key *redacted*
    session-authorization 
!
aaa authentication via global-config 
!
scheduler-profile "default" 
    queue-weights q0 0 q1 0 q2 0 q3 0 
    priority-map q0 "6 7" q1 "4 5" q2 "2 3" q3 "0 1" 
!
aaa server-group "default" 
    allow-fail-through 
    auth-server "ClearPass A" position 1 
    auth-server "ClearPass B" position 2 
!
aaa server-group "internal" 
    auth-server Internal position 1 
    set role condition Role value-of 
!
aaa profile "default" 
!
aaa profile "default-dot1x" 
    authentication-dot1x "default" 
    dot1x-default-role "authenticated" 
!
aaa profile "default-dot1x-psk" 
    authentication-dot1x "default-psk" 
!
aaa profile "default-iap-aaa-profile" 
    initial-role "default-iap-user-role" 
    no wired-to-wireless-roam 
    no devtype-classification 
!
aaa profile "default-mac-auth" 
    authentication-mac "default" 
    mac-default-role "authenticated" 
!
aaa profile "default-open" 
!
aaa profile "default-tunneled-user" 
    initial-role "guest" 
    no wired-to-wireless-roam 
!
aaa profile "default-xml-api" 
!
aaa profile "NoAuthAAAProfile" 
!
aaa authentication captive-portal "default" 
!
aaa authentication wispr "default" 
!
aaa authentication vpn "default" 
!
aaa authentication vpn "default-cap" 
    default-role "sys-ap-role" 
    server-group "internal" 
!
aaa authentication vpn "default-hp-switch" 
!
aaa authentication vpn "default-iap" 
!
aaa authentication vpn "default-rap" 
!
aaa authentication mgmt 
    enable 
!
aaa authentication stateful-ntlm "default" 
!
aaa authentication stateful-kerberos "default" 
!
aaa authentication stateful-dot1x 
!
aaa authentication via auth-profile "default" 
!
aaa authentication wired 
!
aaa authentication via connection-profile "default" 
!
aaa authentication via web-auth "default" 
!
web-server profile 
    cipher-suite ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-SHA384 ECDHE-ECDSA-AES128-SHA256 ECDHE-ECDSA-AES256-SHA ECDHE-ECDSA-AES128-SHA ECDHE-RSA-AES256-SHA ECDHE-RSA-AES128-SHA 
    switch-cert "scsd_wc2_full_2026" 
!
guest-access-email 
!
aaa password-policy mgmt 
!
control-plane-security 
!
ids management-profile 
!
ids wms-general-profile 
!
ids wms-local-system-profile 
!
ids ap-rule-matching 
!
valid-network-oui-profile 
!
traceoptions
!
activate 
!
file syncing profile 
!
ucc skype4b 
!
ucc teams 
!
ucc webrtc 
!
ucc custom-sip 
!
ucc rtpa-config 
!
ucc jabber 
!
ucc sip 
!
ucc h323 
!
ucc vocera 
!
ucc sccp 
!
ucc noe 
!
ucc facetime 
!
ucc ich 
!
ucc session-idle-timeout 
!
ucc wificalling 
!
license-pool-profile-root 
    pefng-licenses-enable 
    rfp-license-enable 
!
papi-security 
!
est profile "default" 
!
aruba-central 
!
wlan sae-profile 
!
ifmap cppm 
!
pan profile "default" 
!
pan-options 
!
websocket clearpass 
!
pan active-profile 
!
openflow-profile 
!
openflow-controller 
!
sdwan-profile 
!
dump-auto-uploading-profile "default" 
!
ap regulatory-domain-profile "default" 
    country-code US 
    valid-11g-channel 1 
    valid-11g-channel 6 
    valid-11g-channel 11 
    valid-11a-channel 36 
    valid-11a-channel 40 
    valid-11a-channel 44 
    valid-11a-channel 48 
    valid-11a-channel 149 
    valid-11a-channel 153 
    valid-11a-channel 157 
    valid-11a-channel 161 
    valid-11a-channel 165 
    valid-11g-40mhz-channel-pair 1-5 
    valid-11g-40mhz-channel-pair 7-11 
    valid-11a-40mhz-channel-pair 36-40 
    valid-11a-40mhz-channel-pair 44-48 
    valid-11a-40mhz-channel-pair 149-153 
    valid-11a-40mhz-channel-pair 157-161 
    valid-11a-80mhz-channel-group 36-48 
    valid-11a-80mhz-channel-group 149-161 
    valid-11a-160mhz-channel-group 36-64 
!
ap wired-ap-profile "default" 
!
ap wired-ap-profile "NoAuthWiredAp" 
    wired-ap-enable 
!
ap enet-link-profile "default" 
!
ap mesh-ht-ssid-profile "default" 
!
ap lldp med-network-policy-profile "default" 
!
ap mesh-cluster-profile "default" 
!
ap mesh-accesslist-profile "default" 
!
ap wifi-uplink-profile "default" 
!
ap multizone-profile "default" 
!
ap usb-acl-prof "default" 
!
dump-collection-profile "default" 
!
ap lldp profile "default" 
!
ap mesh-radio-profile "default" 
!
ap usb-profile "default" 
!
ap system-profile "default" 
    ap-console- password *redacted*
!
ap system-profile "NoAuthApSystem" 
    ap-console- password *redacted*
!
ap wired-port-profile "default" 
!
ap wired-port-profile "NoAuthWiredPort" 
    wired-ap-profile "NoAuthWiredAp" 
    aaa-profile "NoAuthAAAProfile" 
!
ap wired-port-profile "shutdown" 
    shutdown 
!
gps service-profile "default" 
!
ids general-profile "default" 
!
ids rate-thresholds-profile "default" 
!
ids rate-thresholds-profile "probe-request-response-thresholds" 
    channel-inc-time 30 
    channel-threshold 350 
    node-time-interval 10 
    node-threshold 250 
!
ids signature-profile "AirJack" 
    frame-type beacon ssid AirJack 
!
ids signature-profile "ASLEAP" 
    frame-type beacon ssid asleap 
!
ids signature-profile "Deauth-Broadcast-From-Valid-AP" 
    frame-type deauth 
    dst-mac ff:ff:ff:ff:ff:ff 
    src-mac valid-ap 
    bssid valid-ap 
!
ids signature-profile "default" 
!
ids signature-profile "Disassoc-Broadcast" 
    frame-type disassoc 
    dst-mac ff:ff:ff:ff:ff:ff 
!
ids signature-profile "Disassoc-Broadcast-From-Valid-AP" 
    frame-type disassoc 
    dst-mac ff:ff:ff:ff:ff:ff 
    src-mac valid-ap 
    bssid valid-ap 
!
ids signature-profile "Netstumbler Generic" 
    payload 0x00601d 3 
    payload 0x0001 6 
!
ids signature-profile "Netstumbler Version 3.3.0x" 
    payload 0x00601d 3 
    payload 0x000102 12 
!
ids signature-profile "Null-Probe-Response" 
    frame-type probe-response ssid-length 0 
!
ids signature-profile "Wellenreiter" 
    frame-type probe-request ssid this_is_used_for_wellenreiter 
!
ids impersonation-profile "default" 
!
ids unauthorized-device-profile "default" 
!
ids signature-matching-profile "default" 
    signature "Disassoc-Broadcast" 
!
ids dos-profile "default" 
!
ids profile "default" 
!
rf dot11-60GHz-radio-profile "default" 
!
wlan 6ghz-rrm-ie-profile "default" 
!
rf arm-profile "arm-maintain" 
    no scanning 
!
rf arm-profile "arm-scan" 
!
rf arm-profile "default-6ghz" 
!
rf arm-profile "default-a" 
!
rf arm-profile "default-g" 
!
rf ht-radio-profile "default-6ghz" 
!
rf ht-radio-profile "default-a" 
!
rf ht-radio-profile "default-g" 
!
rf spectrum-profile "default-6ghz" 
!
rf spectrum-profile "default-a" 
!
rf spectrum-profile "default-g" 
!
rf optimization-profile "default" 
!
rf event-thresholds-profile "default" 
!
rf am-scan-profile "default" 
!
rf dot11a-radio-profile "default" 
    max-channel-bandwidth 40MHz 
!
rf dot11a-radio-profile "rp-maintain-a" 
    arm-profile "arm-maintain" 
!
rf dot11a-radio-profile "rp-monitor-a" 
    mode am-mode 
!
rf dot11a-radio-profile "rp-scan-a" 
    arm-profile "arm-scan" 
!
rf dot11g-radio-profile "default" 
!
rf dot11g-radio-profile "rp-maintain-g" 
    arm-profile "arm-maintain" 
!
rf dot11g-radio-profile "rp-monitor-g" 
    mode am-mode 
!
rf dot11g-radio-profile "rp-scan-g" 
    arm-profile "arm-scan" 
!
rf dot11-6GHz-radio-profile "default" 
!
wlan rrm-ie-profile "default" 
!
wlan bcn-rpt-req-profile "default" 
!
wlan dot11r-profile "default" 
!
wlan tsm-req-profile "default" 
!
wlan ht-ssid-profile "default" 
!
wlan he-ssid-profile "default" 
!
wlan hotspot anqp-venue-name-profile "default" 
!
wlan hotspot anqp-nwk-auth-profile "default" 
!
wlan hotspot anqp-roam-cons-profile "default" 
!
wlan hotspot anqp-nai-realm-profile "default" 
!
wlan hotspot anqp-3gpp-nwk-profile "default" 
!
wlan hotspot h2qp-operator-friendly-name-profile "default" 
!
wlan hotspot h2qp-wan-metrics-profile "default" 
!
wlan hotspot h2qp-conn-capability-profile "default" 
!
wlan hotspot h2qp-op-cl-profile "default" 
!
wlan hotspot h2qp-osu-prov-list-profile "default" 
!
wlan hotspot anqp-ip-addr-avail-profile "default" 
!
wlan hotspot anqp-domain-name-profile "default" 
!
wlan edca-parameters-profile station "default" 
!
wlan edca-parameters-profile ap "default" 
!
wlan mu-edca-parameters-profile "default" 
!
wlan dot11k-profile "default" 
!
wlan ssid-profile "default" 
!
wlan hotspot advertisement-profile "default" 
!
wlan hotspot hs2-profile "default" 
!
wlan virtual-ap "APG44-SCSD_Secure-Outdoor" 
    vlan 344 
!
wlan virtual-ap "default" 
!
mgmt-server profile "default-acp" 
    stats-enable 
    tag-enable 
    sessions-enable 
    monitored-info-enable 
    monitored-info-del-enable 
    monitored-info-snapshot-enable 
    wids-event-info-enable 
    misc-enable 
    location-enable 
    uccmonitoring-enable 
    airgroupinfo-enable 
    wan-state 
!
mgmt-server profile "default-ale" 
    stats-enable 
    tag-enable 
    sessions-enable 
    misc-enable 
    location-enable 
    uccmonitoring-enable 
!
mgmt-server profile "default-amp" 
    stats-enable 
    tag-enable 
    sessions-enable 
    monitored-info-enable 
    user-visibility-enable 
    misc-enable 
    location-enable 
!
mgmt-server profile "default-controller" 
    stats-enable 
    tag-enable 
    sessions-enable 
    user-visibility-enable 
    misc-enable 
    location-enable 
    uccmonitoring-enable 
    airgroupinfo-enable 
    wan-state 
    ap-stats 
!
mgmt-server profile "default-niara" 
    no generic-amon-enable 
    sessions-enable 
    no inline-dhcp-stats 
    no inline-ap-stats 
    no inline-auth-stats 
    no inline-dns-stats 
!
ap authorization-profile "default" 
    ap-authorization-group "NoAuthApGroup" 
!
ap provisioning-profile "default" 
!
rf arm-rf-domain-profile 
!
ap am-filter-profile "default" 
!
ap spectrum local-override 
!
airmatch profile 
!
ap-lacp-striping-ip 
!
ap general-profile 
!
ap deploy-profile 
!
ap provisioning-rule "PSLA" 
    condition network 10.3.35.0 24 
    action ap-group "APG03Fowler" 
!
airslice-profile "default" 
!
ap provisioning-rules 
    provision-rule "PSLA" priority 1 
!
ap-group "APG06Henninger-Outdoors" 
!
ap-group "APG33Lemoyne" 
!
ap-group "default" 
!
ap-group "NoAuthApGroup" 
    enet1-port-profile "NoAuthWiredPort" 
    enet2-port-profile "NoAuthWiredPort" 
    enet3-port-profile "NoAuthWiredPort" 
    enet4-port-profile "NoAuthWiredPort" 
    ap-system-profile "NoAuthApSystem" 
!
airgroupprofile service "default-airplay" 
    id "_airplay._tcp" 
    id "_appletv-v2._tcp" 
    id "_raop._tcp" 
    description "AirPlay" 
!
airgroupprofile service "default-airprint" 
    id "_canon-bjnp1._tcp" 
    id "_fax-ipp._tcp" 
    id "_http-alt._tcp" 
    id "_http._tcp" 
    id "_ica-networking._tcp" 
    id "_ica-networking2._tcp" 
    id "_ipp-tls._tcp" 
    id "_ipp._tcp" 
    id "_ipps._tcp" 
    id "_pdl-datastream._tcp" 
    id "_printer._tcp" 
    id "_ptp._tcp" 
    id "_riousbprint._tcp" 
    id "_universal._sub._ipp._tcp" 
    id "_universal._sub._ipps._tcp" 
    description "AirPrint" 
!
airgroupprofile service "default-allowall" 
    description "Remaining-Services" 
!
airgroupprofile service "default-amazontv" 
    id "_amzn-wplay._tcp" 
    description "Amazon fire tv" 
!
airgroupprofile service "default-dial" 
    id "urn:dial-multiscreen-org:device:dial:1" 
    id "urn:dial-multiscreen-org:service:dial:1" 
    description "DIAL supported by Chromecast, FireTV, Roku etc" 
!
airgroupprofile service "default-dlna-media" 
    id "urn:schemas-upnp-org:device:MediaPlayer:1" 
    id "urn:schemas-upnp-org:device:MediaRenderer:1" 
    id "urn:schemas-upnp-org:device:MediaRenderer:2" 
    id "urn:schemas-upnp-org:device:MediaRenderer:3" 
    id "urn:schemas-upnp-org:device:MediaServer:1" 
    id "urn:schemas-upnp-org:device:MediaServer:2" 
    id "urn:schemas-upnp-org:device:MediaServer:3" 
    id "urn:schemas-upnp-org:device:MediaServer:4" 
    id "urn:schemas-upnp-org:device:ZonePlayer:1" 
    id "urn:schemas-upnp-org:service:AVTransport:1" 
    id "urn:schemas-upnp-org:service:AlarmClock:1" 
    id "urn:schemas-upnp-org:service:ConnectionManager:1" 
    id "urn:schemas-upnp-org:service:ContentDirectory:1" 
    id "urn:schemas-upnp-org:service:DeviceProperties:1" 
    id "urn:schemas-upnp-org:service:GroupManagement:1" 
    id "urn:schemas-upnp-org:service:GroupRenderingControl:1" 
    id "urn:schemas-upnp-org:service:MusicServices:1" 
    id "urn:schemas-upnp-org:service:RenderingControl:1" 
    id "urn:schemas-upnp-org:service:SystemProperties:1" 
    id "urn:schemas-upnp-org:service:ZoneGroupTopology:1" 
    description "Media" 
!
airgroupprofile service "default-dlna-print" 
    id "urn:schemas-upnp-org:device:Printer:1" 
    id "urn:schemas-upnp-org:service:PrintBasic:1" 
    id "urn:schemas-upnp-org:service:PrintEnhanced:1" 
    description "Print" 
!
airgroupprofile service "default-googlecast" 
    id "_0F5096E8._sub._googlecast._tcp" 
    id "_17608BC8._sub._googlecast._tcp" 
    id "_233637DE._sub._googlecast._tcp" 
    id "_42B56469._sub._googlecast._tcp" 
    id "_668E5548._sub._googlecast._tcp" 
    id "_674A0243._sub._googlecast._tcp" 
    id "_85CDB22F._sub._googlecast._tcp" 
    id "_8DA7527D._sub._googlecast._tcp" 
    id "_8E6C866D._sub._googlecast._tcp" 
    id "_96084372._sub._googlecast._tcp" 
    id "_CA5E8412._sub._googlecast._tcp" 
    id "_CC1AD845._sub._googlecast._tcp" 
    id "_googlecast._tcp" 
    id "_googlezone._tcp" 
    description "GoogleCast supported by Chromecast etc" 
!
airgroupprofile service "default-itunes" 
    id "_apple-mobdev._tcp" 
    id "_daap._tcp" 
    id "_dacp._tcp" 
    id "_home-sharing._tcp" 
    description "iTunes" 
!
airgroupprofile service "default-remotemgmt" 
    id "_ftp._tcp" 
    id "_net-assistant._tcp" 
    id "_rfb._tcp" 
    id "_sftp-ssh._tcp" 
    id "_ssh._tcp" 
    id "_telnet._tcp" 
    description "Remote management" 
!
airgroupprofile service "default-sharing" 
    id "_afpovertcp._tcp" 
    id "_odisk._tcp" 
    id "_xgrid._tcp" 
    description "Sharing" 
!
airgroupprofile ipv6 "default" 
!
airgroupprofile network "default" 
!
airgroupprofile "default" 
    service "default-airplay" 
    service "default-airprint" 
    service "default-dial" 
    disallow-vlan  type servers service ""
    disallow-role "" type servers service ""
!
logging security subcat ids level warnings 
logging security subcat ids-ap level warnings 
logging level debugging ap-debug Test918c 

snmp-server enable trap 
snmp-server host 10.1.35.10 version 2c mickey03 udp-port 162 
snmp-server trap source 0.0.0.0 
snmp-server trap disable wlsxAPBROADCASTSTORM
snmp-server trap disable wlsxAPIPConflict
snmp-server trap disable wlsxAPLoopDetected
snmp-server trap disable wlsxAPPortDown
snmp-server trap disable wlsxAPPortUp
snmp-server trap disable wlsxAPUSBPLUGALARM
snmp-server trap disable wlsxAceUsageThreshold
snmp-server trap disable wlsxAdhocNetwork
snmp-server trap disable wlsxAdhocNetworkBridgeDetectedAP
snmp-server trap disable wlsxAdhocNetworkBridgeDetectedSta
snmp-server trap disable wlsxAdhocUsingValidSSID
snmp-server trap disable wlsxAuthMaxAclEntries
snmp-server trap disable wlsxAuthMaxBWContracts
snmp-server trap disable wlsxAuthMaxUserEntries
snmp-server trap disable wlsxAuthServerIsUp
snmp-server trap disable wlsxAuthServerReqTimedOut
snmp-server trap disable wlsxAuthServerTimedOut
snmp-server trap disable wlsxCLEARPASSSERVERINVALID
snmp-server trap disable wlsxChannelChanged
snmp-server trap disable wlsxClientPskAuthenticationFailed
snmp-server trap disable wlsxClientRejectedByMaxClientCount
snmp-server trap disable wlsxClusterVlanProbeStatus
snmp-server trap disable wlsxCoverageHoleDetected
snmp-server trap disable wlsxDBCommunicationFailure
snmp-server trap disable wlsxDisconnectStationAttack
snmp-server trap disable wlsxDot1xThresholdLimitHit
snmp-server trap disable wlsxDot1xTotalLimitHit
snmp-server trap disable wlsxESIServerDown
snmp-server trap disable wlsxESIServerUp
snmp-server trap disable wlsxFanAbsent
snmp-server trap disable wlsxFanFailure
snmp-server trap disable wlsxFanTrayInserted
snmp-server trap disable wlsxFanTrayRemoved
snmp-server trap disable wlsxFlash1SpaceOK
snmp-server trap disable wlsxGBICInserted
snmp-server trap disable wlsxGhostTunnelclientAttack
snmp-server trap disable wlsxGhostTunnelserverAttack
snmp-server trap disable wlsxHaFailoverRequestFromAp
snmp-server trap disable wlsxHaFailoverTrigger
snmp-server trap disable wlsxHaIntercontrollerHbtMiss
snmp-server trap disable wlsxHaStandbyConnectivityState
snmp-server trap disable wlsxHaStandbyIpSentFailed
snmp-server trap disable wlsxHaState
snmp-server trap disable wlsxIpSpoofingDetected
snmp-server trap disable wlsxLCInserted
snmp-server trap disable wlsxLCRemoved
snmp-server trap disable wlsxLicenseExpiry
snmp-server trap disable wlsxLowMemory
snmp-server trap disable wlsxLowOnFlash1Space
snmp-server trap disable wlsxLowOnFlashSpace
snmp-server trap disable wlsxNAceUsageThreshold
snmp-server trap disable wlsxNDot1xThresholdLimitHit
snmp-server trap disable wlsxNDot1xTotalLimitHit
snmp-server trap disable wlsxNFanAbsent
snmp-server trap disable wlsxNLowOnFlash1Space
snmp-server trap disable wlsxNSwitchIPv6Changed
snmp-server trap disable wlsxNWebCCLicenseEnforcement
snmp-server trap disable wlsxOutOfRangeTemperature
snmp-server trap disable wlsxOutOfRangeVoltage
snmp-server trap disable wlsxPhonyBSSIDDetected
snmp-server trap disable wlsxPowerSupplyFailure
snmp-server trap disable wlsxPowerSupplyMissing
snmp-server trap disable wlsxProcessDied
snmp-server trap disable wlsxProcessExceedsMemoryLimits
snmp-server trap disable wlsxSCInserted
snmp-server trap disable wlsxSignatureMatch
snmp-server trap disable wlsxStaUnAssociatedFromUnsecureAP
snmp-server trap disable wlsxSwitchIPChanged
snmp-server trap disable wlsxSwitchIPv6Changed
snmp-server trap disable wlsxSwitchRoleChange
snmp-server trap disable wlsxTHERMALSHUTDOWN
snmp-server trap disable wlsxUserAuthenticationFailed
snmp-server trap disable wlsxUserEntryAuthenticated
snmp-server trap disable wlsxUserEntryChanged
snmp-server trap disable wlsxUserEntryCreated
snmp-server trap disable wlsxUserEntryDeAuthenticated
snmp-server trap disable wlsxUserEntryDeleted
snmp-server trap disable wlsxVrrpStateChange
snmp-server trap disable wlsxWebCCLicenseEnforcement

process monitor log 

process monitor log 
ale-configuration 
!
conductor-redundancy 
    conductor-vrrp 35 
    peer-ip-address 10.1.35.23  ipsec *redacted*
!
vrrp 35 
    priority 200 
    authentication ******** 
    ip address 10.1.35.33 
    description "Primary" 
    vlan 35 
    preempt delay 60 
    no shutdown 
!

end
