The AP-server communication begins with a mutual authentication step where the AP and server authenticate each other using a shared secret. If this authentication succeeds, the AP-server communication takes place.
After the authentication succeeds,the server generates a session key and encrypts all communication between the AP and server using the session key.
The AP and server ship with the same default value of the shared secret. Use CLI commands on the server and the AP to change the shared secret.
Note: After changing the shared secret on the server, all APs connected to the server automatically use the new communication key. You must manually configure the new communication key on an AP if not connected to the server when the key changes on the server.
Note: Arista Networks does not recommend installing older versions of APs on newer versions of servers.
The table below lists some of the troubleshooting guidelines for the access point (AP).
Problem
Solution
The AP did not receive a valid IP address via the DHCP.
Be sure you have an available DHCP server on the VLAN/subnet to the connected AP. If the AP still fails to get a valid IP address, you can reboot it to see if the problem is resolved.
Unable to connect to the server.
Be sure you have an active server and reachable from the network tothe connected AP. If a firewall or a router has Access Control Lists (ACLs) enabled between the AP and the server, be sure to allow traffic on UDP port 3851.
Use the IP-based server discovery method and ensure that you have correctly entered the DNS name, wifi-security-server , on the DNS server.
Ensure that the DNS server IP addresses are either correctly configured, or are provided by the DHCP server.
The AP might fail to authenticate with the server. In this case, an 'Authentication failed ' event is raised on the server. Refer to the event for recommended action.
The AP has encountered a problem.
If you are using Arista Cloud Services, then open the TCP port 443 (SSL). If you have an on-premises installation, then open UDP port 3851 and port 80.
If you are using a Proxy, Web Accelerator, or URL Content Filter between the AP and the Internet, ensure that the settings allow communication between the AP and Arista Cloud Services.
If your configuration requires you to specify an exact IP address or IP range for Arista Cloud Services, please contact This email address is being protected from spambots. You need JavaScript enabled to view it..
To connect the AP to the network, perform the following steps:
Be sure you have an available DHCP server on the network to enable network configuration of the AP.
Add the DNS entry wifi-security-server on all DNS servers. This entry must point to the IP address of the server.
Be sure you have DHCP running on the subnet to the connected AP.
Check the LEDs on the AP to ensure that it has a server connection.
Log on to the server using SSH and run the get sensor list command.
The command returns a list of all Arista devices recognized by the server. Single Sign-On users can go to the Monitor tab in CloudVision Cognitive Unified Edge and check if the access point appears on the Monitor tab.
Note:If zero configuration fails, the AP must be configured manually.
Important:If you do not have DHCP enabled on a subnet, the AP cannot connect to that subnet with zero-configuration. If the DNS entry does not exist on the DNS servers, or if you do not have the DHCP server running on the subnet, you must manually configure the AP. For details on configuring an AP manually, see the Access Point Configuration guide on our website at Arista Product Documentation .
Connecting the Access Point using PoE
If you are using a PoE injector, make sure you plug the data connection into a suitable switch port with proper network connectivity.
Figure 1. LAN Port
The figure shows the LAN cable inserted to the LAN1 Port. Label l points to the relative position of the grounding screw on the AP.
For PoE port details, see the Bottom Panel section.
Plug one end of the Ethernet cable into the PoE++ switch or compatible PoE injector (a Single-port High Power Midspan, 802.3bt compliant, up to 5Gigabit PoE with PD54V in power output) and the other end into the LAN1 (PoE++) on the AP. Make sure the PoE++ source you are using is turned ON. Use an active wrench with 27 mm opening to open the LAN (PoE++) port cap.
Figure 1. Use Active Wrench
Table 1. Labels: Measurements
Label
Description
1
The width of the LAN port cap is 27mm.
2
Use an active wrenchto open the LAN port cap.
3
LAN cable of 6 ~ 8mm width
Earthing or Grounding: The AP must be properly grounded using a copper grounding wire (12 ~ 10 AWG) and a tin-plated lug as shown in the following image. The wire and the lug must be tightened at the grounding screw on the AP.
Note: Connect the power cord of the power adapter (if used) to a socket outlet with an earthing connection.
The following two images show the position of the grounding screw on the AP (shown as serial number 1 in the image) and the dimension of the lug that attaches to the grounding screw.
Figure 2. Position of Earthing Screw on APFigure 3. Lug Nut Dimensions
Note: The O-435 APs are intended to be supplied with UL-listed PoE+ power source suitable for use at 65 degree Celsius, and whose output meets LPS requirements or PS2, with a rating of 54V DC (0.8A or 800mA minimum).
The following table shows the dimension of the earthing screw and lug.
Item
1
2
3
4
5
6
7
8
Tolerance
W: ± 0.5
d2: ± 0.2
L: ± 0.5
F: ± 0.5
E: ± 0.5
d1: ± 0.2
D: ± 0.2
T: ± 0.5
Size
7.20
4.30
21.50
5.90
13.00
3.40
6.70
1.00
Using the Access Point with Power Adapter
Use a compatible power adapter (Arista SKU: PWR-AP-W5) to power the AP.
Warning: Use the O-435 AP with a UL-listed PoE power source suitable for use at 45ºC. The power output should meet LPS requirements or PS2, with a rating of 48V DC (1A minimum). The current supplied by PoE++ should be 850mA. If not using PoE++, be sure to use only an AC power adapter supported by the AP. The power adapter should be suitable for use at 45ºC. Use this product with a Listed Direct Plug-In Power Unit marked as Class 2, Listed Power Adapter, or DC power source marked L.P.S. (or Limited Power Source) and rated from 12 V DC, 4A minimum.
The maximum altitude of operation for the power adapter is 5000m.
To power up the device with power adapter, perform the following steps:
Plug the power cable into the DC power receptacle on the back of the AP.
Plug the other end of the power cable into an 110V~240V 50/60 Hz AC power source.
Wait until the AP LEDs light up. Refer to the LED status table.
This chapter contains the stepwise procedure to install the access point (AP).
Zero-Configuration of the Access Point
The AP supports zero-configuration under the following conditions:
The device must be in AP mode with background scanning on and without an SSID configured.
Set up a DNS entry for wifi-security-serveron all the DNS servers. This entry should point to the IP address of the server. By default, the AP looks for the DNS entry wifi-security-server.
Place the AP on a subnet with DHCP-enabled.
Refer to these articles to understand how APs communicate with the server, and the ports that you need to open to enable the communication:
Important: If placing the device on a network segment separated from the server by a firewall, you must first open port 3851 for User Datagram Protocol (UDP) and Transport Control Protocol (TCP) bidirectional traffic on the firewall. This port number is assigned to Arista Networks. Zero-configuration does not support setting up multiple devices to connect to multiple servers. In this case, you must manually configure the APs. See the Access Point Configuration Guide on the Arista website at Arista Product Documentation.
Assign a static IP to the AP or change the settings to DHCP. Make a note of the MAC address and the IP address of the AP in a safe place before installing it in a hard-to-reach location. Locate the MAC address of the AP on a label at the bottom of the product.
Use the following steps to install the device:
The steps to install the AP with no configuration (zero-configuration) are as follows:
Use the mounting bracket and metal clamps to install the AP on a pole. Standard accessories include the mounting bracket and two metal clamps.
To mount the AP:
Insert the two metal clamps into the bracket. You can insert the clamps either in the horizontal or vertical slots depending on the position the pole-mount bracket for use on a vertical or horizontal pole.
Fix the bracket to a pole. You can position the pole-mount bracket for use on a vertical or horizontal pole.
Fasten the two metal clamps into the slotted driver.
Mount the AP to the bracket.
Tighten the thumb screw using Philips# 2 screwdriver.
The front panel of the AP has 6 LEDs that indicate the status of various AP functions.
Figure 1. Front Panel LED
Table 1. Labels: Front Panel LEDs
Label
Description
1
Power
2
2.4 GHz Radio
3
5 GHz Radio
4
6 GHz Radio
5
LAN1 PoE PD
6
LAN2 PoE PSE (802.3af)
Power LED: The following table describes the Power LED states.
Table 2. Power LED States Description
Green
Red
Solid
Running at full capability
Running at reduced capability
Blinking
Received IP address, but not connected to the server
Did not receive an IP address
Reduced capability indicates that the AP is getting lower than the required maximum power from the PoE++ switch. It means the AP is getting 802.3at instead of 802.3bt.
LAN1 LED -ON when the corresponding interface is up.
LAN2 LED - ON when the corresponding interface is up, and either wired guest or link aggregation is configured.
Radio LEDs - ON when the corresponding radio is operational.
Side Panel - Left
The side panel of the AP has a reset pinhole and console port.
Figure 2. Side Panel
Table 3. Labels: Side Panel
Label
Description
1
Reset
2
Console
Port
Description
Connector Type
Speed/Protocol
Console
Establish ‘config shell’ terminal session via serial connection
RJ-45
RS 232 Serial (115200 bits per second)
Data bits:8; Stop bits: 1
Parity: None
Flow Control: None
Reset
Reset to factory default settings port. Hold down and power cycle the device to reset.
Pinhole push button
N/A
When you reset the AP, the following settings reset:
Resets the Config shell password config.
Erases the server discovery value and changes it to the default, redirector.online.spectraguard.net (primary) and wifi-security-server (secondary).
Lose all the VLAN configurations.
If the AP has a static IP, reset function erases the IP address and sets the AP to DHCP mode. The factory default IP address of the AP uses 169.254.11.74.
Bottom Panel
The bottom panel of the AP has two ports LAN1 and LAN2. Connect a wired LAN from a Switch or a hub to the LAN1/PoE++ port of the AP to power-on the AP. The LAN1 port supports the 802.3bt power standard. Use an active wrench to open the LAN cap. Width of the LAN cap is 27 mm. LAN2 acts as a PoE Power Sourcing Equipment (PSE) that provides power to any devices connected through LAN2. Note that LAN2 cannot be used to provide power to the AP.
Figure 3. Rear Panel
Table 4. Labels: Ports
Label
Description
1
Kensington lock
2
LAN2 (PoE PSE)
3
LAN1 (PoE+ PD)
Table 5. Port Details
Port
Description
Connector Type
Speed/Protocol
LAN 1
5Gbps Ethernet with 802.3bt compliant PoE PD. LAN 1 powers the AP.
RJ-45
10M/100M/1000Mbps/2.5G/5Gbps Ethernet
LAN 2
5Gbps Ethernet with 802.3af compliant PoE PSE. LAN 2 is used to power other connected devices. LAN 2 cannot be used to power the AP.
Note: The AP needs to be installed by a Certified Professional Installer.
The access point (AP) package contains the components shown in the following figure:
Figure 1. Package Components
Table 1. Labels: Package Components
Label
Description
1
O-435 Access Point
2
2 metal clamps for fixing the mounting bracket to the pole
3
Mounting bracket
4
4 steel bosses for fixing AP in the bracket
5
Philips screw driver to secure the AP to the bracket
6
Grounding screw fitted at the back of AP with dimension 6.8 ±0.2 mm
7
Use Philips #2 screwdriver to tighten the screw
8
Grounding screw - 2.6 ±0.2 mm
9
Grounding screw - 5.8 ±0.2 mm
10
Grounding screw thread - M4 × 0.5 mm
Important: Locate the MAC address of the AP on a label at the bottom of the product and the packaging box. Note down the MAC address before mounting the AP on the ceiling or at a location difficult to access.
If the package is not complete, please contact the Arista Networks Technical Support Team at This email address is being protected from spambots. You need JavaScript enabled to view it. or return the package to the vendor or dealer where you purchased the product.
Note:All instances of the term 'server' in this document refer to the Wireless Manager, unless otherwise explicitly stated.
Product and Documentation Updates
To receive important news on product updates, please visit our website at Arista Product Documentation. We continuously enhance our product documentation based on customer feedback
FCC Advisory
The FCC prohibits the use of the O-435 for control of or communications with unmanned aircraft systems, including drones.
