ArubaOS WLAN Configuration: SSIDs, Virtual APs, and Profiles
Configuration hierarchy
ArubaOS uses reusable profiles bound into groups. For a WLAN, the SSID profile defines the ESSID and encryption; the virtual AP (VAP) profile binds the SSID profile, AAA profile, VLAN, and forwarding mode; the AP group references the VAP so every AP in that group advertises it. The AAA profile ties together the 802.1X authentication profile, MAC authentication profile, RADIUS server group, initial role, and role derivation. In AOS 8, configuration lives in the MM hierarchy (node > group > device); in Instant, the VC or Central template applies similar profile concepts. Forwarding modes include tunnel (traffic to controller/gateway), bridge (local breakout), and split/decrypt variants depending on platform.
Traps
A VAP profile does not contain the ESSID string directly; it references the SSID profile. Creating an SSID profile alone advertises nothing until a VAP is bound to an AP group. Changing the AAA profile changes authentication and role assignment, not the RF channel. Do not confuse an AP group (configuration container) with an AP name (individual device).
Worked example
To add "CORP" with WPA2-Enterprise: create SSID profile CORP with WPA2-Enterprise/802.1X; create VAP CORP-VAP referencing SSID CORP, AAA-CORP, VLAN 20, and tunnel mode; add CORP-VAP to AP group CAMPUS; verify with show ap database and a client association. If clients associate but fail 802.1X, inspect the AAA profile's server group before touching the VAP.