Configuring APs Using Templates

Templates in Aruba Central refer to a set of configuration commands that can be used by the administrators for provisioning devices in a group. Configuration templates enable administrators to apply a set of configuration parameters simultaneously to multiple devices in a group and thus automate AP  deployments.

For template-based provisioning, APs must be assigned to a group with template-based configuration method enabled.

To create a template for the devices in a template group, complete the following steps:

1. In the Network Operations app, use the filter bar to select a template group.
2. Under Manage, click Devices > Access Point.
3. Click the configuration icon.
4. Under Templates, click + to add a new template.

   The Add Template window is displayed.

5. Add the template name.
6. Set the model and firmware version parameters to ALL.
7. Add the CLI script content. Check the following guidelines before adding content to the template:
   • Ensure that the command text indentation matches the indentation in the running configuration.
   • The template allows multiple per-ap-settings blocks. The template must include the per-ap-settings %_sys_lan_mac% variable. The per-ap-settings block uses the variables for each AP. The general VC configuration uses variables for conductor AP to generate the final configuration from the provided template. Hence, Aruba recommends that you upload all variables for all devices in a cluster and change values as required for individual AP variables.

   You can obtain the list of variables for per-ap-settings by using the show amp-audit command. The following example shows the list of variables for per-ap-settings:

   (Instant AP)# show amp-audit | begin per-ap per-ap-settings 70:3a:0e:cc:ee:60 hostname EE:60-335-24 rf-zone bj-qa ip-address 10.65.127.24 255.255.255.0 10.65.127.1 10.65.6.15 "" swarm-mode standalone wifi0-mode access wifi1-mode access g-channel 6+ 21 a-channel 140 26 uplink-vlan 0 g-external-antenna 0 a-external-antenna 0 ap1x-peap-user peap22 282eaf1077b8d898b91ec41b5da19895

   The commands in the template are case-sensitive.

   IF ELSE ENDIF conditions are supported in the template. If the template text includes the if condition, % sign is required at the beginning and the end of the text. For example, %if guest%. The following example shows the template text with the IF ELSE ENDIF condition.

   wlan ssid-profile %ssid_name% %if disable_ssid=true% disable-ssid %endif% %if ssid_security=wpa2% opmode wpa2-aes %else% opmode opensystem %endif%

   Templates also support nesting of the IF ELSE END IF condition blocks. The following example shows how to nest such blocks:

   %if condition1=true% routing-profile route 10.10.0.0 255.255.255.0 10.10.0.255 %if condition2=true% routing-profile route 10.20.0.0 255.255.255.0 10.20.0.255 %else% routing-profile route 10.30.0.0 255.255.255.0 10.30.0.255 %endif% %else% routing-profile route 10.40.0.0 255.255.255.0 10.40.0.255 %if condition3=true% routing-profile route 10.50.0.0 255.255.255.0 10.50.0.255 %else% routing-profile route 10.60.0.0 255.255.255.0 10.60.0.255 %endif% %endif%

   For profile configuration CLI text, for example, vlanVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN., interface, access-list, ssidService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network. and so on, the first command must start with no whitespace. The subsequent local commands in given profile must start with at least one initial space (' ') or indented as shown in the following examples:

   • Example 1

   To comment out a line in the template text, use the pound sign (#). Any template text preceded by # is ignored when processing the template.

   To allow or restrict APs from joining the Instant AP cluster, Aruba Central uses the _sys_allowed_ap_ system-defined variable. Use this variable only when allowed APs configuration is enabled. For example, _sys_allowed_ap: "a_mac, b_mac, c_mac". Use this variable only once in the template.

8. Click OK.

   The variables configured for the devices functioning as the VCs are replaced with the values configured at the template level.

   If any device in the cluster has any missing variables, the configuration push to those AP devices in the cluster fails. The audit trail for such instances shows the missing variables.

   You can configure the RFRadio Frequency. RF refers to the electromagnetic wave frequencies within a range of 3 kHz to 300 GHz, including the frequencies used for communications or Radar signals. zone for an AP by adding the rf-zone %rfzone% variable in the template. Similarly, you can add the wifi0-mode %wifi0-mode% variable to configure a Wi-Fi0 interface of an AP to function in the access, monitor, or spectrum monitor mode. For information on managing template variables, see Managing Variable Files.

Sample Template

The following example shows the typical contents allowed in a template file for APs:

Password Management in Configuration Templates for AP

In Aruba Central, the AP management user passwords are stored and displayed as hash instead of plain text. Password for AP can be set using the following commands:

The hash-mgmt-user command is enabled by default on the APs provisioned in the template and UI groups. If a pre-configured AP joins Aruba Central and is moved to a new group, Aruba Central uses the hash-mgmt-user configuration settings and discards mgmt-user configuration settings, if any, on the AP. In other words, Aruba Central hashes management user passwords irrespective of the management user configuration settings running on an AP.

Password for AP can be set using the following hash-mgmt-user commands: