How to configure PortFast & BPDU Guard on an Aruba controller.

Question

Requirement:
An Aruba controller running 6.4.3.x and above.
Solution:
PortFast:
PortFast feature basically causes a switch port or a trunk port to directly enter the forwarding state instead of going through listening and learning state of the STP.
PortFast is usually configured on an edge port, which means this port should not receive any STP BPDUs.
If this port receives any STP BPDU, this port moves back to normal/regular mode and will end up participating in listening and learning states.
BPDU Guard:
The BPDU Guard feature basically guards the port against receiving any BPDUs.
If it detects any incoming BPDUs on the port, it would put the port into ErrDis (Error-Disable).
This port remains in the ErrDis state unless until this port is manually changed by using a configuration command “shut” followed by a “no-shut” applied on this interface.
Configuration:
Below screen shot show the configuration of Portfast for both Trunk and Access ports.
Below screen shot shows the configuration of BPDU Guard for switch ports.
Verification
We can verify if the Portfast is enabled using the commands shown in below screen shot.
We can verify if the BPDU Guard is enabled using commands shown in below screen shot.

Answer 1

I was having troubles with this as well when a customer had an older Aruba Controller and 2 Access Points. We went with a couple IAP-205s and needed LDAP integration. Using the above configuration there were some additional items needed. I found that I needed the DISPLAY NAME of the admin for the Admin-DN. I had created a user with the first name Aruba and the last name LDAP. This made the DISPLAY NAME "Aruba LDAP". This is what needs to be in the CN= for the Admin-DN.I also found there is a difference in using the CN= and OU=Currently our admin account is in the Users group which is a “Container”. Our actual user accounts are stored in an Orginizational Unit with sub OUs as well. So the Admin-DN needed the CN=Users and the Base-DN needed the OU=MyUserOU.For the windows machines I had to download and install the Aruba GTC Shim because the customer was previously using GTC and they were not going to a RADIUS server at the moment. My Android phone and IPHONE did not need any additional addins for the authentication.  The windows laptop I am using I needed to manually create a wireless profile with… Security Tab >“Choose a network authentication method:”Microsoft: Protected EAP (PEAP)Settings >Select “Trusted Root Certification Authorities”GeoTrust Global CASelect Authentication Method:EAP-Token (This is the Aruba GTC Shim) This allowed me to use my domain login credentialsUsernamePasswordDomain (This is blank because the Base-DN already has this, if anything is put in here the authentication fails)