Aruba AP-225

Aruba · 802.11ac access point, two 3×3 radios, internal antennas · AP-225

what it is

A first-generation 802.11ac (Wave 1) access point with two 3×3 radios and internal antennas; each radio broadcasts up to 16 networks. Inside: a dual-core 800 MHz processor, 512 MB of memory and 32 MB of flash (reading from the device). Powered by PoE 802.3at. Two gigabit ports and a USB port.

The AP-224 is the same enclosure with external antennas. The bootloader presents both as AP-22x, and the factory record mfginfo does not state the model at all. Only the operating system gives the exact model: MODEL: 225 in show version and Antenna Type:Internal in show ap-env.

The same hardware comes with two firmware variants:

• Campus AP — requires an Aruba controller. Without one it reboots roughly every 2.5 minutes and never comes up as an access point.
• Instant — runs standalone, with its own virtual controller and web interface, without a license. Several units on one network form a cluster.

The change is performed by the bootloader with upgrade os 0 and an Instant image of the Centaurus class — the device itself confirms the class in show upgrade. The bootloader checks the signature and device type before writing, so a file from another family is rejected rather than written. The second partition holds the factory image and stays untouched.

Lifecycle: the 220 series was dropped from the supported list as of Instant 8.7. The 8.6.0.x branch is the last one for this hardware (vendor release notes).

port layout

The enclosure is a 203 × 203 × 54 mm square with strongly rounded corners, 750 g (vendor datasheet). On top, near the edge, there are five LEDs: PWR, ENET0, ENET1, 5GHz and 2.4GHz. There are no connectors on the sides.

All connectors are on the bottom: RJ-45 console, two network ports, USB, a 12 V power jack, the reset hole and a security cable anchor.

Watch the order: on the enclosure ENET1 is on the left and ENET0 on the right, i.e. the reverse of the numbering in the system (port 1 is ENET0). Both network ports accept PoE power.

what we read from it

In the Instant variant the access point exposes data via REST over HTTPS. The interface is disabled by default; it is enabled with allow-rest-api and commit apply.

• The entire command line via REST. The vendor lists 14 supported show commands. Measured: of 175 commands checked, 123 returned content, including 116 outside the vendor's list. Monitoring therefore does not need to hold an SSH session.
• Cluster and configuration state — which unit is the controller, whether the configuration is saved and synchronized.
• Radios: channel, power, utilization, networks and clients.
• Foreign networks on the air — for each BSSID: network name, channel, encryption, number of clients, SNR, RSSI and classification (own or interfering).
• MAC addresses from the wired network seen from the access point's port, together with IP addresses — the basis for detecting a rogue access point plugged into the cable.
• Probing devices that never connected. This is data about people's phones, so it requires masking before being shown anywhere.
• Intrusion detection events (41 rules) — only in the syslog stream, see below.

Air monitoring runs in parallel with serving clients. Instant has no separate monitor mode: both radios scan and broadcast networks at the same time. The dwell time per channel is given by show ap debug am-config in milliseconds — 500 on the active channel, 100 on a rare one.

measured pitfalls

• Reboot about every 17 minutes. An unconfigured Instant reboots with the reason UAP discovery reboot, which looks like a failed firmware change. A country code is not enough — the loop ends only after the first WLAN is defined. Then show swarm state changes Factory default status from yes to no.
• The factory password is the serial number, not admin — as of ArubaOS 8.5, also after a reset of a device upgraded from an older version. A wrong password gives no message: the device silently returns to the User: prompt.
• The command line comes up about 4 minutes after the system. Before that it answers CLI is not ready yet, and then Internal error 8-0 — it sounds like a hardware failure, but means the same thing.
• Password mid-session. Right after startup the command line runs in restricted mode. After about 2 minutes it leaves that mode by itself and immediately asks Input new mgmt password: — a command sent by a script at that moment becomes the password.
• After switching to Instant, only port 0 is the uplink. The factory Campus AP bridges both ports and works with the cable in either. Instant treats port 1 as an output to downstream devices, so the same plug suddenly stops working — without any message.
• The address from the bootloader stays permanently. The address set with setenv ipaddr to load the image becomes a static address: the boot log says Skipping DHCP.
• commit apply reports success for a change it did not make. After a command rejected with % Parse error, the next commit answers configuration committed. The content change is shown only by Config Csum in show aps; Config Id increases from the commit alone.
• Some commands are rejected only at commit, not when entered — the error mixes with the commit confirmation message.
• The device name is name, not hostname, and multiple time servers are given in a single ntp-server separated by commas — each subsequent call overwrites the previous one.
• A manually set channel does not go into the configuration. a-channel works in exec mode, immediately and without a commit, but show running-config does not show it, and a reboot reverts it.
• The network password hash changes on every reading of show running-config, even though the password has not changed. Comparing two configuration dumps will always show a difference here.
• Missing allow-new-aps in the configuration blocks controller election: the device rejects every change with the message CLI is not supported on slave., even though it is the only access point on the network.

access and events

• SSH does not accept commands sent as a one-shot — such an attempt ends with code 134 and empty output. Only an interactive session with prompt detection works.
• REST is sometimes disabled despite a correct configuration. The service can reject requests with code 503 even though allow-rest-api is in the configuration; syslog then says Reject REST API req. Disabling and re-enabling restores operation.
• Every REST login goes to syslog with level err. Polling every few minutes floods the log, and it cannot be cut off with a threshold on the device.
• show alert does not show attack detections. Intrusion detection events go only to syslog — with four confirmed detections, show alert was empty.
• The TLS endpoint requires legacy renegotiation — some libraries refuse a connection that curl establishes without problems.

what we cannot read

• The model from the bootloader — only AP-22x.
• Spectrum analysis via controller commands — show spectrum monitors and related ones are Aruba controller commands; Instant answers % Parse error.
• The Disable Scanning field as the truth — it is set to yes, and the access point still collects networks from channels it does not transmit on.
• SNMP without configuration — by default there is no community or user.

full parameter list

A full parameter list for this model is not here yet — the ones described above are those we have read and verified. A missing list does not mean the device exposes nothing more.