The Aruba AP-325 (Model: APIN0325) is an enterprise-grade 802.11ac Wave 2 access point that routinely appears on the secondary market after corporate Wi-Fi refreshes. The hardware is excellent — fast radios, strong range, rock-solid stability — but there’s a catch.

Most surplus AP-325 units are “Campus APs”, meaning they require an Aruba Mobility Controller to function. Without one, they’re effectively useless.

The good news: the AP-325 (and other similar Aruba models) can be converted to Instant (IAP) mode, allowing it to run standalone or form a controller-less cluster with other Instant APs. Once converted, it behaves exactly like a native Instant AP — no licenses, no subscriptions, no controller.

You may not be familiar with Aruba as a brand — it’s a division of Hewlett Packard Enterprise — but they are one of the leading enterprise access point vendors globally (a division of HPE). These AP-325 units were sold new through 2022 and are officially supported by Aruba through at least mid 2027. Even after support ends, the hardware continues to function perfectly; the only limitation is that Aruba will no longer release updates.

This guide walks through the conversion process, step by step.

What You’re Doing (High-Level Overview)

  1. Access the AP’s APBOOT loader
  2. Apply a regulatory domain unlock
  3. Convert the AP from Campus to Instant
  4. Flash Aruba Instant (Hercules) firmware
  5. Boot and configure normally

This process is well-known, repeatable, and safe when done correctly.

Prerequisites & Bill of Materials

Hardware

  • Aruba AP-325
  • PoE+ (802.3at) injector or PoE+ switch

    • Warning: Standard PoE (802.3af) may boot the AP but can disable the 5 GHz radio.

Console Access

  • USB-to-RJ45 serial console cable (Cisco-style works)
  • Terminal emulator:
    • PuTTY
    • Tera Term

Firmware & Tools

  • Tftpd64 (TFTP server for Windows): Download here
  • SHA1 hash generator (used for regulatory unlock)
  • Aruba Instant firmware (Hercules platform)
    • Example: ArubaInstant_Hercules_8.10.0.17_92670
    • This firmware can be found online without too much difficulty (any version in the 8.10.x range is ideal).

Regulatory Unlock: Generating the SHA1 Hash

Campus APs enforce a regulatory domain lock. To enable Instant mode, you must program a country code into flash using a SHA1 hash derived from the AP’s serial number.

  1. Locate the serial number on the AP label (Example: CNCQHN88KX).
  2. Prefix the serial number with the country code (United States example): US-CNCQHN88KX.
  3. Generate a SHA1 hash of that exact string (Example: 48c035616f73449195b096f9f6d45e542f7902d5).
  4. Save the resulting hash — you will use it later in the proginv command.

⚠️ Important: The SHA1 hash must be generated from the country-prefixed serial number, not the raw serial alone.

Workstation & Network Setup

Keep the environment simple — most failures happen here.

Network Configuration (Your PC)

  • IP Address: 192.168.1.100
  • Netmask: 255.255.255.0
  • Connect the AP’s ENET0 port to your PC or the same switch.

TFTP Setup

  1. Launch Tftpd64.
  2. Set Base Directory to the folder containing the firmware file.
  3. Temporarily disable Windows Firewall (sometimes required).
    • Note: TFTP is extremely sensitive to dropped packets. Firewalls, VPNs, and extra network adapters frequently break transfers.

Serial Terminal Settings

  • Baud Rate: 9600
  • Data Bits: 8
  • Stop Bits: 1
  • Parity: None
  • Flow Control: None

Flashing the AP (APBOOT)

1. Interrupt the Boot Process

Connect serial and Ethernet, apply PoE power, and press Enter repeatedly until you see:

apboot>

2. Check Memory Size (Critical)

Watch the boot output for DRAM size. If you have a lower RAM version, you may not be able to run the 8.10.x firmware package.

  • 256 MB → Use AOS 8.6.x or lower
  • 512 MB → Safe to use AOS 8.10.x

⚠️ Warning: Flashing 8.10 on a 256 MB AP may brick it.

3. APBOOT Provisioning Commands

Replace the SHA1 hash below with your own generated hash and the firmware file name with your specific filename.

# Apply regulatory domain (use the hash you generated above)
proginv system ccode CCODE-US-48c035616f73449195b096f9f6d45e542f7902d5

# Convert AP identity to Instant
invent -w

# Configure temporary network settings
setenv ipaddr 192.168.1.50
setenv netmask 255.255.255.0
setenv serverip 192.168.1.100

# Flash Instant firmware to BOTH partitions (use your exact filename)
upgrade os 0 ArubaInstant_Hercules_8.10.0.17_92670
upgrade os 1 ArubaInstant_Hercules_8.10.0.17_92670

# Commit changes
purgeenv
saveenv

# Verify images
osinfo

# Boot
boot

First Boot & Access

  • Initial boot takes 5–10 minutes.
  • Be patient as the AP is creating its Virtual Controller.

Access Methods

Option 1: Setup SSID

  1. Connect via Wi-Fi to the SSID: SetMeUp-xx:xx:xx.
  2. Browse to: https://instant.arubanetworks.com.

Option 2: Wired (More Reliable)

  1. Plug the AP into your network.
  2. Find the DHCP-assigned IP (check your router ARP table).
  3. Browse to: https://<AP-DHCP-IP>:4343.

Default Credentials

  • Username: admin
  • Password: <AP Serial Number> (Some builds accept admin / admin)

Country Selection Note (If US Is Missing)

In some cases, the Instant UI may prompt for a country and “United States” does not appear. This is not a failure. If this happens, select Canada. Canada uses the same Wi-Fi frequency allocations as the US for this hardware, and the AP will operate normally.

Post-Conversion Configuration

Once logged in, the AP behaves exactly like a native Instant AP:

  • Create SSIDs
  • Set WPA2/WPA3 security
  • Adjust radio settings
  • Add additional Instant APs (they auto-join and cluster)

Troubleshooting

  • “Retry count exceeded”
    • AP cannot reach the TFTP server. Confirm PC IP is 192.168.1.100, AP is on ENET0, and firewall is OFF.
  • Garbled serial output
    • Verify 9600 baud. Low-quality USB serial adapters can cause timing issues.
  • Solid amber LED
    • Power issue. Ensure PoE+ (802.3at) is used.

Final Thoughts

Once converted, the Aruba AP-325 becomes an exceptional access point — enterprise stability without enterprise overhead.

  • No controller required
  • No licenses
  • Fully functional Instant AP For anyone comfortable with working over the command line and firmware flashing, this is one of the best surplus-hardware upgrades available.