Small Campus Bring Up Process
The procedures below on-board switches and access points for a small campus environment into HPE Aruba Networking Central. This bring-up process prepares equipment in a factory-default state for cloud-based management.
Note: While WAN gateways are critical to the stack by providing DHCP leases and Internet connectivity to downstream devices, this guide focuses on the switching and wireless infrastructure components.
Table of contents
Service Assignment & Licensing
Before devices can be managed by Central, they must be added to the HPE GreenLake inventory, licensed, and assigned to the Central service. This can be done prior to physical installation.
Perform the following on-boarding prerequisites for both switches and access points, which are detailed in the GreenLake Platform chapter:
Assign Devices to GreenLake Inventory: This can be done individually or for all devices at once using a CSV file.
Assign Devices to Central Service: This assigns devices to Central’s cloud-based management service.
Add Device Subscription Keys: This can be done manually or automatically using GreenLake’s auto-subscribe feature.
Note: Switches that are members of a VSF stack must be assigned subscription keys at the same subscription level.
Prepare Central for Device Management
Central’s current configuration model uses a hierarchical structure (Global, Site Collection, Site, and Device Group) compared to the flat structure of previous versions. In this model, all devices must be assigned to a Site and a Device Group to be managed by Central.
Detailed steps for creating sites and groups are in the Central Configuration Readiness chapter. A summary of the creation process and device assignment is below.
Note: Names used for Central sites, groups, and profiles in this guide are selected for readability and do not reflect naming best practices. Each customer should develop a naming convention that best suits their needs.
Define Central Structure
Step 1 Create Site: Create a new Site in Central to represent the campus. This guide uses a site named SMALL-CAMPUS-SITE, where most configuration is applied.
Step 2 Create Device Groups: Device groups typically represent a subset devices that have similar configuration requirements, and they provide a method to assign configuration overrides for inherited configuration. Create a group for each major device role in the network and ensure the slider Allow New Central to overwrite all configurations for this group is green for each group.
In this guide, device groups are configured only for the purpose of on-boarding devices. A more complicated deployment can utilize device groups to apply configuration to subsets of APs or switches.
The following groups are used in this guide:
- CAMPUS-SW: All switches are members of this device group.
- CAMPUS-AP: All access points are members of this device group.
Note: Device Groups can span multiple sites to apply configuration that is consistent for a set of devices performing a similar function in the organization. For example, the CAMPUS-AP group can assign configuration consistent for standard campus APs across multiple sites. Typically, device groups are defined based on the functional roles of network devices, but that is not required—all devices in this example campus could be assigned to a single group.
Physical Bring-Up
The physical bring-up follows a top-down approach, starting with the WAN edge.
The following diagram summarizes the components in the topology and highlights the devices that are provisioned in Central.
WAN Gateways
Detailed configuration of WAN gateways is out of scope for this guide. A number of different devices could be deployed, ranging from firewalls to SD-WAN gateways. Although they are out of scope, they provide critical services to the small campus.
WAN gateway devices provide Internet connectivity and DHCP services for the management VLAN. Each switch and access point is assigned an IP address, IP gateway, and DNS servers to enable communication with Central. DHCP reservations are recommended when a known IP address must be associated with a specific device.
Note: When administrators prefer static IP assignments, two methods can be used to assign IP addresses. First, administrators can use DHCP addresses during the initial bring-up process and then assign static IP addresses in Central. Second, IP addresses can be assigned using the console port for a switch or AP. Auto-VSF stacking requires that switches be at factory defaults, so a static IP assignment should be made after stack creation.
Specific configuration steps for WAN devices vary based on the make and model. The following general steps are typical for any WAN device.
Step 1 Cable Uplinks: Connect the WAN uplinks (INET/MPLS) to the devices.
Step 2 Power On: The gateways receive an IP assignment via DHCP from the ISP.
Step 3 Orchestration: The gateways receive their configuration and bring up the LAN-side DHCP services for the Management VLAN (VLAN 1).
Aggregation Switches (VSF Stack)
Aggregation switches provide redundant L2 connectivity between the access layer and the WAN gateways.
A small campus typically uses in-band management, where both production and management traffic use the same communication path. This method is well suited for CX 6000-series switches, where all ports are enabled by default.
When using CX 8000/9000/10000-series switches, ports are disabled by default. A dedicated out-of-band (OOB) management interface can be connected to the Internet for Central connectivity. When OOB management port connectivity is not an option for these models, an administrator must enable ports via the HPE Aruba Networking Installer app or the switch console.
Aggregation switches can use either VSX or VSF to support multi-chassis redundancy. VSX provides a more robust redundancy model using independent control and management planes on a set of two switches, while VSF provides fast failover using a single control and management plane across multiple members of a stack. VSX is supported on the 6300M and 6400/8000/9000/10000-series switches, while VSF is supported on 6300/6200-series switches (supporting up to 10 switches or 8 switches in a stack, respectively). This small campus example uses VSF at the aggregation layer, which provides sufficient resiliency and redundancy for most small campus applications.
Use the following procedure to prepare an aggregation VSF stack for configuration in Central:
Step 1 Cable aggregation switches in a ring topology for auto-VSF stacking. The first two high speed ports on each switch are used for auto-stacking (ports 25 and 26 on switch models with 24 access ports, ports 37 and 38 on switch models with 36 access ports, or ports 49 and 50 on switch models with 48 access ports). The example below illustrates cabling a two member stack in a ring topology using 24 access port switches.
Step 2 Press the LED Mode button on the conductor until the Stk LED lights up to initiate auto-stacking. Each member is configured for the VSF stack and automatically rebooted to logically join the stack.
Note: HPE Aruba Networking recommends VSF auto-stacking prior to connecting switches to Central. This streamlines the configuration process and reduce errors. VSF stack members must be at factory defaults to support auto-stacking. After a device is added to Central, pre-existing global or site configuration may be applied, which prevents auto-stacking.
Step 3 Cable uplink ports to WAN gateways. Connect an uplink port from each aggregation switch to each WAN gateway. The VSF conductor automatically connects to Central, after it receives a DHCP lease.
Note: Two network loops are introduced in this step, because all links to each WAN gateway are in the same VLAN (default VLAN 1). Loops are also created when adding VSF access stacks in the next procedure. All 6000-series switches enable spanning-tree (STP) loop protection by default, which automatically disables interfaces to prevent network loops. Configuration in a future step will eliminate loops in the physical topology using logical LAGs.
Access Layer (VSF Stacks)
Use the following procedure to prepare VSF access stacks for configuration in Central:
Step 1 Cable access switches in a ring topology for auto-VSF stacking.
Step 2 Press the LED/mode button on the conductor for each stack until the Stk LED lights up to initiate auto-stacking.
Step 3 Cable uplink ports to aggregation switches. Connect one uplink port from two different access stack members to different aggregation switches. This design allows uninterrupted connectivity from an individual uplink failure, aggregation switch failure, or access switch failure. Each VSF conductor automatically connects to Central, after receiving a DHCP lease.
Wireless Access Points
Cable access points to access switches. After receiving a DHCP lease, APs connect to Central.
Assign Device Group and Site
Assign switches and access points to the appropriate site and device group in Central.
Caution: VSF stacks are managed as a single logical device. Assign only the conductor for each stack to a Central site and group. Do not assign other VSF member switches to Central sites or groups.
Step 1 Enable Classic Central.
Step 2 Assign Devices to Groups: In the Organization settings, assign aggregation and access switches to the CAMPUS-SW group, and assign APs to the CAMPUS-AP group. Devices can be selected using serial number or MAC address.
Step 3 Assign Devices to a Site: In the Organization settings, assign switches and access points to the SMALL-CAMPUS-SITE.
Step 4 Exit Classic Central.
Step 5 Set the Device Function for aggregation and access switches. The device function of access points is assigned to Campus Access Point by default.
Verify Devices in Central
Step 1 In Central’s global Network Overview, connect to the small campus site using the Sites card. Click the Network planet and verify the switch stacks and access points appear in the list.
Note: Campus access points should be identified as Online, though they will display a red diamond until the configuration process is fully completed, at which point they will transition to green. Switch stacks should appear with a green circle.
Step 2 To verify an individual VSF stack’s status, click on the default name (6300 in the screenshot above). The device page provides a quick summary of VSF status in the Stack card. Click the expansion arrows in the Stack card to view additional cabling and stack details.
