Design Decisions
- Single Group -- One template group ("Greenfield-Global") manages all APs and CX switches across 3 sites for uniform configuration and firmware compliance.
- AOS10 Architecture -- All devices operate in AOS10 mode with cloud-managed APs and CX switches. No local controllers required.
- Template Mode -- CX switches use CLI templates for consistent VLAN, spanning-tree, and PoE configuration. AP SSID/RF profiles are centrally managed through the group.
- VSF Stacking -- Each floor has a primary CX 6300-M VSF stack (3-4 members) for high-density PoE access plus a standalone CX 6200 for overflow/edge coverage.
- Per-Device Variables -- VLAN IPs, helpers, hostnames, and service addresses are defined as %VARIABLE% placeholders in CLI templates and resolved per switch via Central's variable store or bulk CSV upload -- one template stays compliant across all devices.
- Stack-Aware Templates -- %SWITCH_ROLE% and %MEMBER_COUNT% drive template selection. When MEMBER_COUNT > 1, indexed member variables (%MEMBERn_PRIORITY%, %MEMBERn_SERIAL%, VSF links) and multi-member port-group ranges are activated via %if% conditional blocks. Standalone switches skip stack sections entirely.
- AP Role Segmentation -- Four AP roles with purpose-built radio profiles: internal (general office), conference (high-density with 20 MHz channels and airtime limits), external (outdoor with sector antennas, no DFS), and air monitors (WIDS/WIPS full-time scanning). Each role maps to a dedicated AP group in Central with appropriate SSIDs, VLANs, and RF tuning.
- Zero-Touch Provisioning -- All switches are pre-provisioned by serial number in Central before hardware ships. On first boot, devices auto-redirect via Aruba Activate, firmware-upgrade if needed, and receive their resolved CLI template config with no on-site IT.
- Site Collectors -- Each site has a primary + secondary collector (VM-based) for local data aggregation, ensuring telemetry resilience if WAN connectivity is interrupted.
Architecture Design Diagram
Hover over any element to highlight. The hierarchy flows from Aruba Central Cloud through a single template group to 3 sites, each with dual site collectors, a 2-member aggregation VSF HA pair, 4 access-layer switch roles (data, AP, MDT, garage), and per-floor infrastructure with APs and CX stacks.
Group Configuration
Device Types Managed
Assigned Sites
Switch Templates
CX6300-Access-Stack-TemplateCX6200-Access-Standalone-TemplateWLAN Profiles
User Roles
Central Hierarchy
VLAN Design
| VLAN ID | Name | Description | Subnet Template |
|---|---|---|---|
| 10 | Management | Network device management | 10.x.10.0/24 |
| 20 | Employee-Data | Wired employee endpoints | 10.x.20.0/24 |
| 30 | Employee-Voice | VoIP traffic | 10.x.30.0/24 |
| 40 | Wireless-Corp | Corporate SSID clients | 10.x.40.0/24 |
| 50 | Wireless-Guest | Guest SSID clients | 10.x.50.0/24 |
| 60 | IoT | IoT devices and sensors | 10.x.60.0/24 |
| 99 | Native-VLAN | Native/default VLAN | N/A |
Subnet template uses 10.x.Y.0/24 where x = site identifier (1=HQ-East, 2=Branch-Central, 3=Branch-West)
Per-Device Template Variables
Template variables use the %VARIABLE% syntax inside CLI templates. Each switch gets unique values assigned via Central's per-device variable store or bulk CSV upload, keeping a single template compliant across all sites and floors.
| Variable | Description | Scope | VLAN | HQ-F1-STK | BR1-F1-STK | BR2-F1-SA |
|---|---|---|---|---|---|---|
| %HOSTNAME% | Switch hostname | per-device | -- | HQ-East-F1-Access-Stack | Branch-Central-F1-Access-Stack | Branch-West-F1-Standalone |
| %SITE_NAME% | Site identifier for SNMP location | per-site | -- | HQ-East | Branch-Central | Branch-West |
| %FLOOR% | Floor number for labeling | per-device | -- | 1 | 1 | 1 |
| %STACK_ID% | VSF member ID (stack only) | per-device | -- | 1 | 1 | N/A |
| %MGMT_VLAN_IP% | VLAN 99 management SVI IP | per-device | 99 | 10.1.99.1 | 10.2.99.1 | 10.3.99.2 |
| %MGMT_VLAN_MASK% | VLAN 99 subnet mask | per-device | 99 | 255.255.255.0 | 255.255.255.0 | 255.255.255.0 |
| %DATA_VLAN_IP% | VLAN 20 employee data SVI | per-device | 20 | 10.1.20.1 | 10.2.20.1 | 10.3.20.2 |
| %DATA_VLAN_MASK% | VLAN 20 subnet mask | per-device | 20 | 255.255.255.0 | 255.255.255.0 | 255.255.255.0 |
| %DATA_VLAN_HELPER% | VLAN 20 DHCP helper address | per-site | 20 | 10.1.1.10 | 10.2.1.10 | 10.3.1.10 |
| %VOICE_VLAN_IP% | VLAN 30 voice SVI | per-device | 30 | 10.1.30.1 | 10.2.30.1 | 10.3.30.2 |
| %VOICE_VLAN_MASK% | VLAN 30 subnet mask | per-device | 30 | 255.255.255.0 | 255.255.255.0 | 255.255.255.0 |
| %VOICE_VLAN_HELPER% | VLAN 30 DHCP helper address | per-site | 30 | 10.1.1.10 | 10.2.1.10 | 10.3.1.10 |
| %WCORP_VLAN_IP% | VLAN 40 wireless corp SVI | per-device | 40 | 10.1.40.1 | 10.2.40.1 | 10.3.40.2 |
| %WCORP_VLAN_MASK% | VLAN 40 subnet mask | per-device | 40 | 255.255.255.0 | 255.255.255.0 | 255.255.255.0 |
| %WCORP_VLAN_HELPER% | VLAN 40 DHCP helper address | per-site | 40 | 10.1.1.10 | 10.2.1.10 | 10.3.1.10 |
| %GUEST_VLAN_IP% | VLAN 50 guest SVI | per-device | 50 | 10.1.50.1 | 10.2.50.1 | 10.3.50.2 |
| %GUEST_VLAN_MASK% | VLAN 50 subnet mask | per-device | 50 | 255.255.255.0 | 255.255.255.0 | 255.255.255.0 |
| %IOT_VLAN_IP% | VLAN 60 IoT SVI | per-device | 60 | 10.1.60.1 | 10.2.60.1 | 10.3.60.2 |
| %IOT_VLAN_MASK% | VLAN 60 subnet mask | per-device | 60 | 255.255.255.0 | 255.255.255.0 | 255.255.255.0 |
| %NTP_SERVER% | NTP server address | per-site | -- | 10.1.1.5 | 10.2.1.5 | 10.3.1.5 |
| %SYSLOG_SERVER% | Syslog destination | per-site | -- | 10.1.1.15 | 10.2.1.15 | 10.3.1.15 |
Stack-Aware Template Logic
Templates use 5 roles: agg, data, MDT, AP_switch, garage_switch. %MEMBER_COUNT% determines stack vs. standalone (agg is always 2-member HA pair). Universal config (DNS, NTP, SNMP, TACACS, syslog) applies to all roles. Role-specific port profiles define interface behavior per role.
Template Resolution Pipeline
| Role | Members | Template File | Description | Active Sections |
|---|---|---|---|---|
| agg | = 2 (always) | CX-Agg-Stack.tmpl | VSF 2-member HA pair with L3 SVIs, trunk ports to all downstream access roles, VRRP, OSPF, STP root priority. MEMBER_COUNT is always 2 for agg. | universal_configvsf_member_configvsf_link_configtrunk_port_groupsrouting_ospfvrrp_configstp_root |
| data | > 1 (stack) | CX-Data-Stack.tmpl | VSF stack with access ports, per-member port groups, loop protect, uplink LAG | universal_configvsf_member_configvsf_link_configaccess_port_configuplink_lagloop_protect |
| data | = 1 (standalone) | CX-Data-Standalone.tmpl | Single data switch with access ports, loop protect | universal_configaccess_port_configuplink_lagloop_protect |
| MDT | > 1 (stack) | CX-MDT-Stack.tmpl | VSF stack with trunk ports for building systems | universal_configvsf_member_configvsf_link_configtrunk_port_groupsuplink_lag |
| MDT | = 1 (standalone) | CX-MDT-Standalone.tmpl | Single MDT switch with trunk ports for BMS/BAS | universal_configtrunk_port_groupsuplink_lag |
| AP_switch | > 1 (stack) | CX-APSwitch-Stack.tmpl | VSF stack with PoE budget, AP port profiles (trunk allowed VLANs), LLDP-MED for AP discovery | universal_configvsf_member_configvsf_link_configap_port_profilepoe_configuplink_lag |
| AP_switch | = 1 (standalone) | CX-APSwitch-Standalone.tmpl | Single AP switch with PoE, AP trunk profiles, LLDP-MED | universal_configap_port_profilepoe_configuplink_lag |
| garage_switch | > 1 (stack) | CX-Garage-Stack.tmpl | VSF stack with hardened access ports, limited VLANs, extended PoE for outdoor cameras | universal_configvsf_member_configvsf_link_configaccess_port_configpoe_configuplink_lagloop_protect |
| garage_switch | = 1 (standalone) | CX-Garage-Standalone.tmpl | Single garage switch with hardened ports, extended PoE, limited VLANs | universal_configaccess_port_configpoe_configuplink_lagloop_protect |
AP Roles & Radio Profiles
Four AP roles with purpose-built radio profiles: Internal / General Office, Conference Room / High-Density, External / Outdoor, Air Monitor (WIDS/WIPS). Each role gets a dedicated AP group in Central with appropriate SSIDs, VLAN assignments, and RF tuning for its deployment scenario.
Central Configuration Path
In Aruba Central: Manage > Devices > Access Points > Configuration. Each AP role maps to a dedicated AP group with its own RF profile, SSID assignment, and VLAN trunk list. APs are assigned to groups either manually by serial or via labels/naming convention. The group determines which SSIDs the AP broadcasts and the radio tuning parameters it uses.
Pre-provision by serial, auto-deploy config on first connection
Sequence Overview
Pre-Provision Inventory
adminUpload serial numbers via CSV or API before hardware arrives
Each serial is assigned to group (Greenfield-Global), site (HQ-East / Branch-Central / Branch-West), and all per-device variables (%HOSTNAME%, %SWITCH_ROLE%, %MEMBER_COUNT%, VLAN IPs, port-groups). Stack commander serial is used -- secondary members are listed in %MEMBERn_SERIAL% variables.
Switch Powers On
switchCX switch boots with factory default, obtains IP via DHCP
Switch runs ZTP agent on first boot. DHCP server provides IP address, default gateway, and DNS. No console access or manual config required.
Aruba Activate Redirect
activateSwitch contacts activate.arubanetworks.com with serial + MAC
Aruba Activate cloud service receives the device identity (serial number, MAC address, model), looks up the Central tenant mapped to that serial via your Activate account, and returns the Central instance URL for redirection.
Central Serial Match
centralCentral identifies the serial in pre-provisioned inventory
Central matches the incoming serial against the pre-provisioned device list. It resolves: (1) Target group = Greenfield-Global, (2) Target site = assigned site, (3) Target firmware version, (4) All per-device template variables from the variable store.
Firmware Upgrade
centralCentral pushes target firmware if device version doesn't match
If the factory firmware differs from the group's compliance firmware version, Central auto-upgrades the switch first. The switch reboots on the target version before config push. This ensures template compatibility.
Template Resolution & Push
centralCLI template resolved with device variables, pushed to switch
Central selects the correct template based on %SWITCH_ROLE% and %MEMBER_COUNT%, resolves all %VARIABLE% placeholders with device-specific values (VLAN IPs, hostnames, port-groups, VSF config), and pushes the full running configuration to the switch.
Switch Operational
switchSwitch applies config, joins site, reports compliant to Central
Switch applies the pushed configuration, brings up all interfaces, VLANs, and services. It registers in Central under its assigned site and shows as 'Config Compliant' in the monitoring dashboard. For VSF stacks, secondary members auto-join via the commander's VSF config.
Site Details
-- 3 sites, 5 floors eachHQ-East
Site Collectors
HQ-East - Main Building
Branch-Central
Site Collectors
Branch-Central - Main Building
Branch-West
Site Collectors
Branch-West - Main Building