Central Configuration Example

This chapter explores using Central’s configuration model to configure a WLAN for APs and a Layer-2 access switch. It does not provide a complete reference configuration, but is intended to illustrate the power and functionality of element profiles.

Table of contents

• Central Configuration Example
  • Element Profile Configuration Process
    • Apply Element Profiles
  • Configure Global Profiles
  • Configure Access Switch
    • General Switch Configuration
    • Uplink Port Configuration
    • Port Standardization
  • Configure Bridged WLAN

Element Profile Configuration Process

All profiles are created using the same general process. The following steps create an AAA Authentication profile, and assign it a Device Function and Scope. This example can be used to create additional profiles to establish a fully functioning solution.

Step 1 Click the Gear icon in the upper right hand corner of the window to enter configuration mode.

Step 2 Click Library in the left-hand navigation pane to display the configuration context path.

Step 3 Click Manage in the Security tile to view all profile types this category.

Note: Element Profiles are grouped into category tiles. The AAA Authentication profile type is located in the Security tile. Clicking Manage in a tile category displays all the profiles available in that category. Use the buttons at the bottom of a tile to move through the tile’s pages. In this example, the AAA Authentication profile type appears on the first page. When the desired profile type is displayed in the tile, click the profile type to select it.

Step 4 Click Manage on the AAA Authentication profile type.

Step 5 On the AAA Authentication profile page, click Create Profile.

Step 6 In the Create Profile window, assign the following settings and click Create.

• Name: New-AAA-Profile
• Authentication Protocol: 802.1X
• 802.1X Authentication Server Group: Global Radius
• Accounting Server Group: Global Radius

Note: Profiles often reference other profiles in their configuration. In this example, the Global Radius Authentication Server Group and its member servers must be created before the current profile.

After creating the profile, it is added as a shared profile to the Library, but its configuration is not applied to devices until a Device Function and Scope are applied.

Apply Element Profiles

Assigning a Device Function applies the profile to devices based on their role in the network, such as campus access points or aggregation switches. Assigning the scope allows administrators to select which devices are assigned the profile based on organizational structure or device groups. These two two attributes are evaluated together using Central’s inheritance logic to apply the profile to devices.

Step 1 Select the desired element profile in the library, hover the cursor over the profile entry, and click the triple dots (•••).

Step 2 On the popup menu, click Assign.

Step 3 Select the Device Function(s) for the profile, then click the plus sign (+) beside Scopes.

Step 4 In the Add Scope window, select the Scope Level, then click Add.

Note: When selecting Site Collections, Sites, Device Groups, or Devices as a scope, an additional assignment of a specific instance within the scope is presented in a context-based dropdown menu. For example, when choosing Site as a scope, another dropdown enables selection of one or more sites.

Step 5 Click Assign to assign the Device Function(s) and Scope(s) to the profile.

After completing the assignment, the profile’s configuration is pushed to appropriate devices based on the rules of inheritance.

Configure Global Profiles

Element profiles applied to all or most of an organization are typically assigned at the Global scope. A small number of exceptions can be managed by using profile overrides or by assigning additional profiles at different scopes, which use inheritance to replace the Global profiles with customized settings.

It is common to apply the profiles in the following table globally, since they can often be used across an entire organization and on all device functions.

Each profile is populated with an operating-system agnostic set of parameters. When Central applies the configuration to specific devices, it uses the syntax appropriate for each platform.

The profile list is suggested to establish a base set of configurations for network services. This includes configuring AAA Authentication to define how users and devices are authenticated to the network, and Authentication Server and Authentication Server Group profiles to define a centralized authentication source such as ClearPass. Additionally, System profiles such as NTP Server, DNS Server, and System Administration are set to ensure that all devices have synchronized time, can resolve hostnames, and are configured for secure management access.

Configure Access Switch

Access switches inherit the profiles defined above because they were assigned to the Global scope and all Device Functions. The element profiles in the subsections below complete the access switch configuration.

General Switch Configuration

The following element profiles establish the general configuration settings for access switches. Key element profiles to include are VLANs for user traffic and for switch management, Spanning Tree Protocol (STP) to prevent loops in the network, VSF for switch stacking, and a Device Profile to ensure that connected access points are automatically provisioned. Additional profiles are noted with a description of their purpose.

Uplink Port Configuration

An element profile at the device level creates a Link Aggregation Group (LAG) as an 802.1Q trunk. This provides link redundancy to the aggregation layer and allows the uplinks to carry all host VLANs. Also, enable LACP for active-mode port bundling and enable DHCP snooping trust.

Port Standardization

The following profiles enable the administrator to create and apply a standardized configuration for access switch edge ports. A comprehensive Port Profile is created to define common settings for administrative state, speed, PoE, and VLAN assignment. This profile also incorporates essential security measures such as Loop-Protect and BPDU Guard to protect the network from loops. The Port Profile is then applied to physical switch interfaces, ensuring that all access ports have a consistent and secure configuration.

Configure Bridged WLAN

In this example of element profiles, a WLAN in bridged mode is configured. The profiles below combined with the Global profiles above support a WLAN configured for WPA3 personal as an authentication method. A full WPA3 Enterprise implementation requires additional profiles (Authentication Server, Authentication Group, and AAA Authentication profiles).

Note: If Mobility Gateway tunneling is implemented, the scope of the element profiles must change from Global or Site to Device Group to support the current implementation of Gateway Clusters.

The switch port connected to an AP used for bridged WLANs requires a trunk port setting, where the native VLAN is typically set to a management VLAN, and WLAN traffic is bridged to a tagged VLAN.

---