Converting an Aruba AP-325 WAP from Campus to Instant Mode (No Controller Required)

The Aruba AP-325 (Model: APIN0325) is an enterprise-grade 802.11ac Wave 2 access point that routinely appears on the secondary market after corporate Wi-Fi refreshes. The hardware is excellent — fast radios, strong range, rock-solid stability — but there’s a catch.

Most surplus AP-325 units are "Campus APs", meaning they require an Aruba Mobility Controller to function. Without one, they’re effectively useless.

The good news: the AP-325 (and other similar Aruba models) can be converted to Instant (IAP) mode, allowing it to run standalone or form a controller-less cluster with other Instant APs. Once converted, it behaves exactly like a native Instant AP — no licenses, no subscriptions, no controller.

You may not be familiar with Aruba as a brand — it's a division of Hewlett Packard Enterprise — but they are the #2 player globally in enterprise access points, second only to Cisco. These AP-325 units were sold new through 2022 and are officially supported by Aruba through at least mid 2027. Even after support ends, the hardware continues to function perfectly; the only limitation is that Aruba will no longer release updates.

This guide walks through the conversion process, step by step.

What You’re Doing (High-Level Overview)

• Access the AP’s APBOOT loader
• Apply a regulatory domain unlock
• Convert the AP from Campus to Instant
• Flash Aruba Instant (Hercules) firmware
• Boot and configure normally

This process is well-known, repeatable, and safe when done correctly.

Prerequisites & Bill of Materials

Hardware

• Aruba AP-325
• PoE+ (802.3at) injector or PoE+ switch

⚠️ Standard PoE (802.3af) may boot the AP but can disable the 5 GHz radio

Console Access

• USB-to-RJ45 serial console cable (Cisco-style works)
• Terminal emulator:
  • PuTTY
  • Tera Term

Firmware & Tools

• Tftpd64 (TFTP server for Windows)
  https://github.com/PJO2/tftpd64/releases/
• SHA1 hash generator (used for regulatory unlock)

Aruba Instant firmware (Hercules platform)
Example: ArubaInstant_Hercules_8.10.0.17_92670

This firmware can be found online without too much difficulty (any version in the 8.10.x range is ideal).

Regulatory Unlock: Generating the SHA1 Hash

Campus APs enforce a regulatory domain lock. To enable Instant mode, you must program a country code into flash using a SHA1 hash derived from the AP’s serial number.

1. Locate the serial number on the AP label
   Example: CNCQHN88KX
2. Prefix the serial number with the country code
   (United States example): US-CNCQHN88KX
3. Generate a SHA1 hash of that exact string
   Example: 48c035616f73449195b096f9f6d45e542f7902d5
4. Save the resulting hash — you will use it later in the proginv command to apply the regulatory domain.

⚠️ The SHA1 hash must be generated from the country-prefixed serial number, not the raw serial alone. Generating the hash in the wrong order will cause the regulatory unlock to fail.

Workstation & Network Setup

Keep the environment simple — most failures happen here.

Network Configuration (Your PC)

IP Address: 192.168.1.100
Netmask:    255.255.255.0

• Connect the AP’s ENET0 port to your PC or the same switch

TFTP Setup

• Launch Tftpd64
• Set Base Directory to the folder containing the firmware file
• Temporarily disable Windows Firewall (sometimes required)

TFTP is extremely sensitive to dropped packets. Firewalls, VPNs, and extra network adapters frequently break transfers.

Serial Terminal Settings

Baud Rate:    9600
Data Bits:    8
Stop Bits:    1
Parity:       None
Flow Control: None

Flashing the AP (APBOOT)

Interrupt the Boot Process

1. Connect serial and Ethernet
2. Apply PoE power

Press Enter repeatedly until you see:

apboot>

Check Memory Size (Critical)

If you have a lower RAM version you may not be able to run the 8.10.x firmware package. Watch the boot output for DRAM size:

• 256 MB → Use AOS 8.6.x or lower
• 512 MB → Safe to use AOS 8.10.x

⚠️ Flashing 8.10 on a 256 MB AP may brick it.

APBOOT Provisioning Commands

Replace the SHA1 hash below with your own generated hash and the firmware file name with the specific firmware file name that you will be using.

# Apply regulatory domain (use the hash you generated above)
proginv system ccode CCODE-US-48c035616f73449195b096f9f6d45e542f7902d5

# Convert AP identity to Instant
invent -w

# Configure temporary network settings
setenv ipaddr 192.168.1.50
setenv netmask 255.255.255.0
set serverip 192.168.1.100

# Flash Instant firmware to BOTH partitions (use your exact filename)
upgrade os 0 ArubaInstant_Hercules_8.10.0.17_92670
upgrade os 1 ArubaInstant_Hercules_8.10.0.17_92670

# Commit changes
purgeenv
saveenv

# Verify images
osinfo

# Boot
boot

First Boot & Access

• Initial boot takes 5–10 minutes
  • Be patient as the AP is creating its Virtual Controller

Access Methods

Option 1: Setup SSID

• Connect via Wi-Fi

Look for: SetMeUp-xx:xx:xx
Once connected, browse to: https://instant.arubanetworks.com

If you cannot get that URL to load, move on to Option 2.

Option 2: Wired (More Reliable)

1. Plug the AP into your network (router or switch)
2. Find the DHCP-assigned IP (check your router ARP table if needed)

Browse to: https://<AP-DHCP-IP>:4343

Default Credentials

Username: admin
Password: <AP Serial Number>

(Some builds accept admin / admin)

Country Selection Note (If US Is Missing)

In some cases, after flashing, the Instant UI may prompt for a country and “United States” does not appear.

This is not a failure. If this happens, select Canada

Canada uses the same Wi-Fi frequency allocations as the United States for this hardware, and the AP will operate normally with full radio functionality. This is a common and safe workaround.

Post-Conversion Configuration

Once logged in, the AP behaves exactly like a native Instant AP:

• Create SSIDs
• Set WPA2/WPA3 security
• Adjust radio settings
• Add additional Instant APs (they auto-join and cluster)

If you’ve used Aruba Instant or APs from other brands before, nothing here will be too unfamiliar.

Troubleshooting

“Retry count exceeded”

• AP cannot reach the TFTP server
• Confirm:
  • PC IP is 192.168.1.100
  • AP is connected via ENET0
  • Firewall is disabled

Garbled serial output

• Verify 9600 baud
• Low-quality USB serial adapters can cause timing issues

Solid amber LED

• Power issue
• Ensure PoE+ (802.3at) is used

Final Thoughts

Once converted, the Aruba AP-325 becomes an exceptional access point — enterprise stability without enterprise overhead.

• No controller required
• No licenses
• Fully functional Instant AP

For anyone comfortable with working over the command line and firmware flashing, this is one of the best surplus-hardware upgrades available.