Configuring APs Using Templates

Templates in Aruba Central refer to a set of configuration commands that can be used by the administrators for provisioning devices in a group. Configuration templates enable administrators to apply a set of configuration parameters simultaneously to multiple devices in a group and thus automate AP  deployments.

To minimize configuration errors and troubleshoot device-specific configuration issues, Aruba recommends that the device administrators familiarize themselves with the CLI configuration commands available on Aruba APs.

For template-based provisioning, APs must be assigned to a group with template-based configuration method enabled.

To create a template for the devices in a template group, complete the following steps:

1. In the Network Operations app, use the filter bar to select a template group.

2. Under Templates, click + to add a new template.

The Add Template window is displayed.

3. Add the template name.

4. Set the model and firmware version parameters to ALL.

5. Add the CLI script content. Check the following guidelines before adding content to the template:

Ensure that the command text indentation matches the indentation in the running configuration.

The template allows multiple per-ap-settings blocks. The template must include the per-ap-settings %_sys_lan_mac% variable. The per-ap-settings block uses the variables for each AP. The general VC configuration uses variables for master AP to generate the final configuration from the provided template. Hence, Aruba recommends that you upload all variables for all devices in a cluster and change values as required for individual AP variables.

You can obtain the list of variables for per-ap-settings by using the show amp-audit command. The following example shows the list of variables for per-ap-settings:

(Instant AP)# show amp-audit | begin per-ap per-ap-settings 70:3a:0e:cc:ee:60 hostname EE:60-335-24 rf-zone bj-qa ip-address 10.65.127.24 255.255.255.0 10.65.127.1 10.65.6.15 "" swarm-mode standalone wifi0-mode access wifi1-mode access g-channel 6+ 21 a-channel 140 26 uplink-vlan 0 g-external-antenna 0 a-external-antenna 0 ap1x-peap-user peap22 282eaf1077b8d898b91ec41b5da19895

The commands in the template are case-sensitive.

IF ELSE ENDIF conditions are supported in the template. If the template text includes the if condition, % sign is required at the beginning and the end of the text. For example, %if guest%. The following example shows the template text with the IF ELSE ENDIF condition.

wlan ssid-profile %ssid_name%

%if disable_ssid=true%

disable-ssid

%endif%

%if ssid_security=wpa2%

opmode wpa2-aes

%else%

opmode opensystem

%endif%

Templates also support nesting of the IF ELSE END IF condition blocks. The following example shows how to nest such blocks:

%if condition1=true% routing-profile route 10.10.0.0 255.255.255.0 10.10.0.255 %if condition2=true% routing-profile route 10.20.0.0 255.255.255.0 10.20.0.255 %else% routing-profile route 10.30.0.0 255.255.255.0 10.30.0.255 %endif% %else% routing-profile route 10.40.0.0 255.255.255.0 10.40.0.255 %if condition3=true% routing-profile route 10.50.0.0 255.255.255.0 10.50.0.255 %else% routing-profile route 10.60.0.0 255.255.255.0 10.60.0.255 %endif% %endif%

To comment out a line in the template text, use the pound sign (#). Any template text preceded by # is ignored when processing the template.

To allow or restrict APs from joining the Instant AP cluster, Aruba Central uses the _sys_allowed_ap_ system-defined variable. Use this variable only when allowed APs configuration is enabled. For example, _sys_allowed_ap: "a_mac, b_mac, c_mac". Use this variable only once in the template.

6. Click OK.

The variables configured for the Instant AP devices functioning as the VCs are replaced with the values configured at the template level. If any device in the cluster has any missing variables, the configuration push to those AP devices in the cluster fails. The audit trail for such instances shows the missing variables. You can configure the RFRadio Frequency. RF refers to the electromagnetic wave frequencies within a range of 3 kHz to 300 GHz, including the frequencies used for communications or Radar signals. zone for an AP by adding the rf-zone %rfzone% variable in the template. Similarly, you can add the wifi0-mode %wifi0-mode% variable to configure a Wi-Fi0 interface of an AP to function in the access, monitor, or spectrum monitor mode. For information on managing template variables, see doc title Help Center.

Password Management in Configuration Templates for AP

In Aruba Central, the AP management user passwords are stored and displayed as hash instead of plain text. Password for AP can be set using the following commands:

mgmt-user <user-name> <password>

mgmt-user <user-name> <password> read-only

mgmt-user <user-name> <password> guest-mgmt

The mgmt-user commands are used for APs running below Aruba Instant 4.3 firmware version.

The hash-mgmt-user command is enabled by default on the APs provisioned in the template and UI groups. If a pre-configured AP joins Aruba Central and is moved to a new group, Aruba Central uses the hash-mgmt-user configuration settings and discards mgmt-user configuration settings, if any, on the AP. In other words, Aruba Central hashes management user passwords irrespective of the management user configuration settings running on an AP.

The hash-mgmt commands can only be used for APs running firmware versions equal to or above Aruba Instant 4.3.

Password for AP can be set using the following hash-mgmt-user commands:

hash-mgmt-user <user-name> password hash <hash-password>

hash-mgmt-user <user-name> password cleartext <cleartext-password>

hash-mgmt-user <user-name> password hash <hash-password> usertype read-only

hash-mgmt-user <user-name> password cleartext <cleartext-password> usertype read-only

hash-mgmt-user <user-name> password hash <hash-password> usertype guest-mgmt

hash-mgmt-user <user-name> password cleartext <cleartext-password> usertype guest-mgmt

hash-mgmt-user <user-name> password hash <hash-password> usertype local

hash-mgmt-user <user-name> password cleartext <cleartext-password> usertype local

Aruba Central supports the use of hash commands with clear text, however, Aruba recommends you to use hash passwords instead of clear text passwords to avoid password disclosures.  Aruba Central allows you to re-use the hash from one AP on another AP. All AP templates must include a password command to set a password for the device. The template cannot be saved without adding a password command. If the configuration that is pushed from Aruba Central to the device does not contain a password command, the configuration push is aborted for the device and a log is added to the audit trail. For example, if you add the password command in a condition block and the condition evaluates to false, the configuration that is pushed will not contain the password command.For more information, see Managing Password in Configuration Templates .