Configuring HPE Aruba Networking IoT Operations

The Applications > IoT Operations page allows you to configure the IoT Internet of Things. IoT refers to the internetworking of devices that are embedded with electronics, software, sensors, and network connectivity features allowing data exchange over the Internet. Connectors, IoT transport profiles, install applications and so on.

The IoT Operations application enables the configuration IoT Connectors at the group level. This feature allows the installation and configuration of IoT applications and transport profiles across multiple IoT connectors, eliminating the need to configure each IoT connector individually.

Workflow Changes

The workflow changes in the IoT Operations group support feature, as compared to the workflow when configuring individual IoT connectors, are as follows:

• At the global level, the install button for IoT applications and the Manage button for Transport Profiles will not be available on the individual IoT connector pages. Installation of IoT applications and configuration of transport profiles can only be done at the group level.

• Any IoT connector which is not currently assigned to a group will be assigned to the default group.

Configuring IoT Operations involves:

• Opening Firewall Ports for IoT Connector Communication
• Downloading an IoT Connector
• Deploying an IoT Connector
• Creating a VM-Based IoT Connector
• Deleting an AP-Type IoT Connector
• Viewing IoT Connector
• Updating IoT Connector
• Deleting a Data Collector
• Resetting the CLI Password of a Data Collector
• Open a Remote Console Session
• Creating an IoT Radio Profile
• Enabling an IoT Radio Profile
• Configuring a BLE Beacon Service Profile
• Assigning an AP to an IoT Connector
• Installing a Partner-Developed App
• Updating a Partner-Developed App
• Uninstalling a Partner-Developed App
• Configuring an IoT Transport Profile
• Deleting an IoT Transport Profile
• Using Group Configurations for Existing Connectors
• Assigning a CA Certificate
• Synchronizing a CA Certificate
• VusionGroup App
• Application Developer Portal (ADP)

Pre-requisites

Ensure that the following pre-requisites are met before configuring IoT Operations:

• An x86-based ESXi server for VMs is available.
• HPE Aruba Networking APs run AOS-10.

Opening Firewall Ports for IoT Connector Communication

Most of the communication between the IoT Connector and the HPE Aruba Networking Central server in the cloud is carried out through HTTPS Hypertext Transfer Protocol Secure. HTTPS is a variant of the HTTP that adds a layer of security on the data in transit through a secure socket layer or transport layer security protocol connection. (TCP Transmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. 443). To allow IoT Connector to communicate over a network firewall Firewall is a network security system used for preventing unauthorized access to or from a private network., ensure that the following domain names and ports are open:

Network Requirements for IoT Connector

The network requirements for IoT connector include:

• Static IP address
• Outbound Internet Access on TCP port 443

Network Services (Internal or External) from IoT Connector

The network services (internal or external) requirements from the IoT Connector include:

• TCP/UDP User Datagram Protocol. UDP is a part of the TCP/IP family of protocols used for data transfer. UDP is typically used for streaming media. UDP is a stateless protocol, which means it does not acknowledge that the packets being sent have been received. 53 (DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element.)
• UDP 123 (NTP Network Time Protocol. NTP is a protocol for synchronizing the clocks of computers over a network.)
• Production Core Update Server and Port: coreupdate-prod.central.arubanetworks.com and https tcp port 443
• Container Registry URL Uniform Resource Locator. URL is a global address used for locating web resources on the Internet. and Port: quay.io (allow subdomains also)and https tcp 443
• Aruba Cloud URL Discovery Server and Port: api-csp.central.arubanetworks.com and https tcp 443
• Domain Names for HPE Aruba Networking Central
• Domain Names for Hybrid Endpoints
• Domain Names for RCS

Domain Names for HPE Aruba Networking Central

HPE Aruba Networking Central supports the following domain names:

Table 1: Domain Names for HPE Aruba Networking Central

Region	Domain Name	Protocol
US-1	app.central.arubanetworks.com	HTTPS TCP port 443
US-2	app-prod2.central.arubanetworks.com	HTTPS TCP port 443
US-WEST-4	app-uswest4.central.arubanetworks.com	HTTPS TCP port 443
EU-1	app2-eu.central.arubanetworks.com	HTTPS TCP port 443
EU-Central	app-eucentral3.central.arubanetworks.com	HTTPS TCP port 443
CA Certificate Authority or Certification Authority. Entity in a public key infrastructure system that issues certificates to clients. A certificate signing request received by the CA is converted into a certificate when the CA adds a signature generated with a private key. See digital certificate.-Central	app-ca.central.arubanetworks.com	HTTPS TCP port 443
CN Common Name. CN is the primary name used to identify a certificate. -North	app.central.arubanetworks.com.cn	HTTPS TCP port 443
AP-South	app2-ap.central.arubanetworks.com	HTTPS TCP port 443
AP-Northeast	app-apaceast.central.arubanetworks.com	HTTPS TCP port 443
AP-Southeast	app-apacsouth.central.arubanetworks.com	HTTPS TCP port 443
UAE-North	app-uaenorth1.central.arubanetworks.com	HTTPS TCP port 443

Domain Names for Hybrid Endpoints

HPE Aruba Networking Central supports the following hybrid endpoints:

Table 2: Domain Names for Hybrid Endpoints

Region	Domain Name	Protocol
US-1	app1-hybrid.central.arubanetworks.com	HTTPS TCP port 443
US-2	hc-prod2.central.arubanetworks.com	HTTPS TCP port 443
US-WEST-4	uswest4-hc.central.arubanetworks.com	HTTPS TCP port 443
EU-1	central-eu-hc.central.arubanetworks.com	HTTPS TCP port 443
EU-3	eucentral3-hc.central.arubanetworks.com	HTTPS TCP port 443
Canada-1	ca-hc.central.arubanetworks.com	HTTPS TCP port 443
APAC-1	apac-hc.central.arubanetworks.com	HTTPS TCP port 443
APAC-EAST1	apaceast-hc.central.arubanetworks.com	HTTPS TCP port 443
APAC-SOUTH1	apacsouth-hc.central.arubanetworks.com	HTTPS TCP port 443
UAENORTH1	uaenorth1-hc.central.arubanetworks.com	HTTPS TCP port 443

Domain Names for RCS

HPE Aruba Networking Central supports the following domain names for RCS:

Table 3: Domain Names for RCS

Region	Domain Name	Protocol
US-1	rcs-ng-prod.central.arubanetworks.com	SSH Secure Shell. SSH is a network protocol that provides secure access to a remote device. port 443
	rcs-ng-xp-prod.central.arubanetworks.com
US-2	rcs-ng-central-prod2.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-central-prod2.central.arubanetworks.com
US-WEST-4	rcs-ng-uswest4.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-uswest4.central.arubanetworks.com
EU-1	rcs-ng-eu.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-eu.central.arubanetworks.com
EU-3	rcs-ng-eucentral3.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-eucentral3.central.arubanetworks.com
Canada-1	rcs-ng-starman.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-starman.central.arubanetworks.com
China-1	rcs-ng-china-prod.central.arubanetworks.com.cn	SSH port 443
APAC-1	rcs-ng-apac.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-apac.central.arubanetworks.com
APAC-EAST1	rcs-ng-apaceast.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-apaceast.central.arubanetworks.com
APAC-SOUTH1	rcs-ng-apacsouth.central.arubanetworks.com	SSH port 443
	rcs-ng-xp-apacsouth.central.arubanetworks.com
UAENORTH1	rcs-ng-uaenorth1.central.arubanetworks.com	SSH port 443

Downloading an IoT Connector

IoT Connectors are available as OVA Open Virtualization Archive. OVA contains a compressed installable version of a virtual machine. files. To download an OVA file, complete the following procedure:

1. In the WebUI, set the filter to global.
2. Under Maintain, click Organization > Platform Integration.
3. If an IoT Connector has not been deployed, the Data Collector card displays the number of deployed IoT connectors as 0. Click 0 and in the Get Started card, click the Virtual Appliance link.
4. If IoT Connectors have been deployed, the Data Collector card displays the number of deployed IoT Connectors. Click the displayed number and in the Configure Appliance card, click the Download Virtual Appliance link.
5. In the Download Virtual Appliance dialog, click Mini, Small, or Medium. For additional information, see Specifications.
6. Click Close.

Deploying an IoT Connector

Before deploying an OVA file, download the OVA file. For additional information, see Downloading an IoT Connector.

To deploy an IoT connector on a VMWare server, complete the following procedure:

1. Log in to the VMware server.
2. Click File > Deploy OVF Template.
3. Click Browse and select the OVA file.
4. Click Next.
5. After the OVA file is deployed, click Console.
6. Log in to the console with the following credentials:
   • Username as aruba
   • Password as aruba
7. Change the password. For additional information, see Performing Advanced Options.
8. Configure the hostname. For additional information, see Configuring Hostname.
9. Configure the network with static IP address, mask, gateway, and DNS server. For additional information, see Using Command Line Interface Options.
10. Test the network connectivity. For additional information, see Using Command Line Interface Options.
11. Configure the timezone. For additional information, see Using Command Line Interface Options.
12. Register the IoT Connector to HPE Aruba Networking Central by using a registration token. For additional information, see Creating Registration Tokens.

Creating a VM-Based IoT Connector

Before creating a VM-based IoT Connector, you should download and deploy an IoT Connector. For additional information, see Downloading an IoT Connector and Deploying an IoT Connector.

To create a VM-based IoT Connector, complete the following procedure:

1. In the WebUI, set the filter to the group where connectors need to be added.
2. Under Manage, click Applications > IoT Operations.
3. The Connectors card displays a donut-chart of the configured IoT connectors. Click View.

   If an IoT Connector is not configured, the Connectors card displays Add Connector. Click Add Connector to create an IoT Connector.

• To add data collectors, complete the following steps:

  1. In the Manage Connector pop-up, select the Data Collector radio button and click Confirm.
  2. In the Data Collectors page, click the graph in the Managed Collectors card.
  3. In the Managed Collectors page, click Create Collector.

     Ensure that an IoT Connector is deployed and registered in HPE Aruba Networking Central. For additional information, see Deploying an IoT Connector in Configuring HPE Aruba Networking IoT Operations.

  4. Under the Give collector a name heading, enter an IoT connector name.
  5. In the Select an application to install on collector section, select IoT Connector.
  6. Click Next.
  7. Select the collector and click Create.

     It takes at least 30 minutes for a new IoT Connector to come online.

• To add AP-type connectors, complete the following steps:
  1. In the Manage Connector pop-up, select the Access Point radio button.
  2. Click the checkbox below Access Point to enable the configuration.
  3. Click Confirm. All eligible APs are converted to AP-type connectors. The eligibility criteria are as follows:
     • APs running AOS10.5 or higher.
     • APs are not assigned to any existing data collector.

Deleting an AP-Type IoT Connector

To delete an AP-type Connector, complete the following steps:

1. In the WebUI, set the filter to the group where connectors need to be deleted.
2. Under Manage, click Applications > IoT Operations.
3. The Connectors card displays a graph donut-chart of configured IoT connectors. Click Manage Connectors.
4. In the Manage Connector pop-up, select the AccessPoint radio button.
5. Click the checkbox below Access Point to disable the configuration.
6. Click Confirm.
   All APs that were converted to IoT Connectors are deleted.

For more information on deleting a data collector, see Deleting a Data Collector.

Creating an IoT Radio Profile

An IoT radio profile allows an AP to collect IoT data from IoT devices. An IoT radio profile can be created for an AP group with APs running AOS-10.

To create an IoT radio profile, complete the following procedure:

1. In the WebUI, set the filter to an AOS-10 group.
2. Under Manage, click Devices.
3. Click the Config icon.
4. Click Show Advanced.
5. Click IoT tab.
6. In the IoT Radio Profiles table, click the Add icon.
7. Configure the following parameters and click Save Settings.

Table 4: IoT Radio Profile

Parameter	Description
Name	Name of the radio profile.
Radio	Type of radio. Select a radio type from the drop-down list:  Internal—Use internal radio. External—Use external radio.
Radio mode	Mode of radio. Select a radio mode from the drop-down list:  None—Do not use radio. BLE—Use BLE Bluetooth Low Energy. The BLE functionality is offered by Bluetooth® to enable devices to run for long durations with low power consumption. radio. Zigbee—Use Zigbee radio. BLE & Zigbee—Use BLE and Zigbee radio. SD-Radio—Use software defined radio. NOTE: When the radio mode is set to BLE & Zigbee, BLE-Tx and Zigbee work together, but BLE-Rx and Zigbee do not work together.
BLE operation mode	Operation mode of BLE. Select a BLE operation mode from the drop-down list: Beaconing—Use beaconing mode. Scanning—Use scanning mode. Both—Use both beaconing and scanning modes. This parameter is available only when radio mode is BLE or BLE & Zigbee. NOTE: When the radio mode is set to BLE & Zigbee, the BLE operation mode can only be set to Beaconing.
Console	Mode of BLE console. Select a BLE console from the drop-down list: Auto—Use automatic BLE console. On—Use BLE console. Off—Do not use BLE console. This parameter is available only when the radio mode is BLE or BLE & Zigbee.
Tx power	Transmission power. Enter a value from the range: -40, -20, -16, -12, -8, -4, 0, 2, 3, 4, 5, 6, 7, 8, 20. APs with Gen-2 BLE/IoT radios adjust the calibrated RSSI Received Signal Strength Indicator. RSSI is a mechanism by which RF energy is measured by the circuitry on a wireless NIC (0-255). The RSSI is not standard across vendors. Each vendor determines its own RSSI scale/values. values for iBeacon advertisements when the BLE transmission power level is modified. The calibrated values can be verified using the show ap debug ble-advertisement-info command. NOTE: This parameter is available only when the radio mode is BLE or BLE & Zigbee.
Zigbee operation mode	Operation mode of Zigbee coordinator. This parameter is available only when the radio mode is Zigbee or BLE & Zigbee.
Channel	Zigbee channel assignment. Select one of the following Zigbee channel assignments from the drop-down list: Automatic—Automatically assign Zigbee channel. Manual—Manually assign Zigbee channel. This parameter is available only when the radio mode is Zigbee or BLE & Zigbee.

By default, a new IoT radio mode is in disabled state. To enable a new IoT radio profile, see Enabling an IoT Radio Profile.

Enabling an IoT Radio Profile

To enable an IoT radio profile, complete the following procedure:

1. In the WebUI, set the filter to an AOS-10 group.
2. Under Manage, click Devices.
3. Click the Config icon.
4. Click Show Advanced.
5. Click IoT tab.
6. In the IoT Radio Profiles table, hover over an IoT radio profile.
7. Click the WiFi icon.

Configuring a BLE Beacon Service Profile

The BLE Beacon Service (BBS) profile manages the BLE beacons as iBeacons or custom beacons. These beacons may be configured on HPE Aruba Networking Central or HPE Aruba Networking Central API Application Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software.. The BBS profile automatically assigns the beacons to the APs and allows HPE Aruba Networking Central to monitor them.

To create a BBS profile, complete the following procedure:

1. In the WebUI, set the filter to an AOS-10 group.
2. Under Manage, click Devices.
3. Click the Config icon.
4. Click Show Advanced.
5. Click IoT tab.
6. In the BLE Beacon Service Profile table, click the Add icon.
7. Configure the following parameters and click Save Settings.

Table 5: BBS Profile

Parameter	Description
Name	Name of the BLE beacon service profile.
Radio	Type of radio. Select a radio type from the drop-down list:  Internal—Use internal radio. External—Use external radio. All—Use both internal and external radios.
Beacon Configuration Method	Method for beacon configuration. Select a method from the drop-down list: Auto Generated—Use an automatically generated beacon configuration method. Aruba Central API—Use a beacon configuration method generated by HPE Aruba Networking Central API. IoT Operations App—Use a beacon configuration method generated by HPE Aruba Networking Central.
Profile Identifier	Identifier of the beacon profile.
Advertising Format	Format to use while advertising the BLE beacon. Select a BLE beacon advertising format from the drop-down list: iBeacon—Use iBeacon advertising format. Custom—Use custom advertising format. If Beacon Configuration Method is set to Auto Generated, select iBeacon as the BLE beacon advertising format. If Beacon Configuration Method is set to Aruba Central API or IoT Operations App, configure the API gateway.
Advertising Interval	Time interval in milliseconds to advertise the beacon. This parameter has a fixed value of 500 ms. If Beacon Configuration Method is set to Auto Generated, select iBeacon as the BLE beacon advertising format. If Beacon Configuration Method is set to Aruba Central API or IoT Operations App, configure the API gateway.
UUID	Ibeacon UUID in xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx format. This parameter is available only when the Advertising Format is set to iBeacon.
Major Range	Ibeacon major range as either a single number or range from 0 to 65535. This parameter is available only when the Advertising Format is set to iBeacon.
Minor Range	Ibeacon minor range as either a single number or range from 0 to 65535. This parameter is available only when the Advertising Format is set to iBeacon.
Custom Value	Custom value with 3 to 31 bytes hexadecimal string and may include BTMAC or BTMACR macro. This parameter is available only when the Advertising Format is set to Custom.

Assigning an AP to an IoT Connector

Assigning an AP to an IoT Connector allows an AP to send the collected data to an IoT Connector. One or more unassigned APs can be assigned to an IoT Connector. An unassigned AP is an AP that is not assigned to any IoT Connector.

To assign an AP to an IoT Connector, complete the following procedure:

1. In the WebUI, set the filter to global.
2. Under Manage, click Applications > IoT Operations.
3. In the Connectors graph, click Show Connectors.
4. In the Connectors page, click the AP Collector Association icon.
5. Click the Expand icon on the left side of the required Connector ID.
6. In the Assigned Access Points table, click the Assign to Connector icon.
7. In the <Connector-name> Assigned AP's (Unassigned) table, select one or more APs, and ensure that the firmware version of the APs is 10.

   Only unassigned APs can be assigned to an IoT Connector. The Connector > Assigned AP's table lists the AOS version running on the AP in the Firmware Version column.

8. Click Confirm.

Installing a Partner-Developed App

To install a partner-developed app from the App Store, complete the following procedure:

1. In the WebUI, set the filter to the group where the application needs to be installed.
2. Under Manage, click Applications > IoT Operations.
3. Click Manage in the IoT Applications card.
   The IoT Applications page opens and displays all the available apps (recommended, installed, and not installed) for the selected group.
4. In the Available Apps card, click an available app that needs to be installed.

   The Available Apps list displays all available IoT applications.

5. In the App Details page, click Install.

To edit the installation of a partner-developed app from the App Store, complete the following steps:

1. Navigate to the IoT Applications page as instructed in the previous procedure.
2. In the Available Apps section, click an installed app that needs to be edited.
3. In the App Details page, click Edit.
4. Make the necessary changes in the popup that opens and click Submit.

Updating a Partner-Developed App

To update a partner-developed app from the App Store, complete the following steps:

1. In the WebUI, set the filter to the group where app needs to be updated.

2. Under Manage, click Applications > IoT Operations.

3. Click Manage in the IoT Applications card.
   The IoT Applications page opens and displays all available apps (recommended, installed, and not installed) for the selected group.

4. In the Available Apps section, click an available app that needs to be updated.

5. In the App Details page, click Update.

Uninstalling a Partner-Developed App

To uninstall a partner-developed app, complete the following procedure:

1. In the WebUI, set the filter to the group where app needs to be uninstalled.
2. Under Manage, click Applications > IoT Operations.
3. Click Manage in the IoT Applications card.
   The IoT Applications page opens and displays all available apps (recommended, installed, and not installed) for the selected group.
4. In the Available Apps section, click an available app that needs to be uninstalled.
5. In the App Details page, click Uninstall.

Configuring an IoT Transport Profile

HPE Aruba Networking recommends to use partner-developed apps from the App Store. If you do not want to use a partner-developed app, configure an IoT transport profile. Configuring an IoT transport profile allows an IoT Connector to send the collected data to a partner server.

To create an IoT transport profile, complete the following procedure:

1. In the WebUI, set the filter to the group where the transport profile needs to be added.
2. Under Manage, click Applications > IoT Operations.
3. In Transports card, click Manage.
4. In the Transport Profiles for <group-name> table, click the add transport profile icon.
5. Configure the following IoT transport profile parameters and click Create.

   If an IoT transport profile is not configured, the Transport Profile for <group-name> table displays Add. Click Add to configure an IoT transport profile.

Table 6: IoT Transport Profile

Parameter	Description
Profile
Name	Name of the IoT transport profile.
Description	Description of the IoT transport profile.
Stream Type	Type of the data stream. Available options are: Periodic Telemetry—Send the data stream periodically. Data Frames—Send each data frame when the data is available.
Aggregation
Reporting Interval (seconds)	Period to aggregate the data stream. This parameter is available when Stream Type is set to Periodic telemetry. This parameter does not have a default value and takes any value in the range of 30 seconds to 3600 seconds.
RSSI Aggregation Type	Type of RSSI aggregation. This parameter is available when Stream Type is set to Periodic telemetry. Available options are: Average—Use average value when aggregating the data stream. Latest—Use the latest value when aggregating the data stream. Max—Use the maximum value when aggregating the data stream.
Subscriptions
Type	Type of subscription. A subscription consists of a type and value. Device class is the supported type. Multiple subscriptions are allowed with an OR operator between subscriptions. Use the Add icon to add subscriptions.
Value	Available device classes. Multiple subscriptions are allowed with an OR operator between subscriptions. Use the Add icon to add subscriptions.
Filters
Filters	Type of filter. A filter consists of type and value. The supported type is Ibeacon UUID and the value is a UUID. Multiple filters are allowed with an OR operator between filters. Use the Add icon to add filters.
Destination
Protocol Type	WSS protocol is used when sending data. Custom CA certificates can be uploaded and synchronized when using WSS protocol. For more information on uploading CA certificate, see Certificates. For more information on synchronizing CA certificates, see Synchronizing a CA Certificate.
URL	URL of the destination server.
Format Type	Format of the data. Available options are: JSON—Format the data in JSON JavaScript Object Notation. JSON is an open-standard, language-independent, lightweight data-interchange format used to transmit data objects consisting of attribute–value pairs. JSON uses a "self-describing" text format that is easy for humans to read and write, and that can be used as a data format by any programming language. format. PROTOBUF—Format the data in PROTOBUF.
Authentication
Use Credentials	Use the configured credentials as authentication method. Credentials include: Authentication URL—URL of the authentication server. Client ID—Identify of the client. Username—Username for authentication. Password—Password for authentication.
Use Token	Use the configured token as the authentication method.

Deleting an IoT Transport Profile

To delete an IoT transport profile, complete the following procedure:

1. In the WebUI, set the filter to the group where the transport profile needs to be deleted.
2. Under Manage, click Applications > IoT Operations.
3. In the Transports card, click Manage.
4. In the Transport Profiles group, hover over an IoT transport profile that needs to be deleted.
5. Click the deleteicon.
6. In the Delete Transport Profile on <group-name> pop-up, click Delete.

Using Group Configurations for Existing Connectors

If a group has one connector, then all the IoT configurations (application and transport profile configurations) on that connector are assigned to the group level during migration (automatic during a service update). Further configurations must be done at the group-level.

Figure 1  IoT Dashboard At Group Support

Groups that have multiple connectors are marked as read-only. In read-only groups, each connector retains its individual IoT application and transport profile configurations, and no new configurations are possible either the group-level or individual connector levels. In these cases, a UI banner is displayed, indicating that the group is read-only.

Figure 2  UI Banner for Read-Only Groups

To recover and enable group level configurations for read-only groups, complete the following procedures:

• For groups with multiple AP Type connectors, complete one of the two following procedures:

  • Click the second click here link in the UI banner as seen in figure 2, to reset the individual connector configurations for read-only groups.
    This option will clear the IoT configurations on the AP-type connectors and data collectors in that group and allows you to redefine the configurations as required, without the creation of a new group.

  • Creating a new group:

    1. Create a new group with desired configurations (IoT and non IoT).
       For more information on creating a group, see Adding a Group.
       For more information on IoT configurations, see Creating a VM-Based IoT Connector.
       For more information on non-IoT configurations, see Configuring AOS-10 APs in HPE Aruba Networking Central.

    2. Move the APS to the new group.
       Group-level configurations are enabled for the new group.
       

       When APs are moved to new group, all the existing IoT configurations on the AP will be removed.

• For groups with multiple data collectors, create a new group and move the data collectors to the new group.
  All the existing application and transport profile configurations will be removed from the data collectors.

The use cases detailed below cover scenarios where:

• A group has multiple connectors (either AP-type connectors or data collectors).
• All the IoT configurations have been moved to the group-level after the group-support migration.
• A UI banner on the IoT dashboard is displayed indicating that the group is read-only.

Use Case 1 – Read-Only Group with AP-Type Connectors

To enable group configurations for existing AP-type connectors in a read-only group, complete the following steps:

1. Make a note of the IoT configurations (application and transport profile configurations) on the APs.

2. Click on the link in the UI banner to reset the connector configurations and enable group configurations.

3. Confirm the connector configuration reset in the pop-up that appears.
   The connector count becomes 0 as application and transport profile configurations are removed from the AP-type connectors and group configurations are enabled.
   To enable AP-type connector configurations create a new AP-type connector. For more information, see Creating a VM-Based IoT Connector.

Now all IoT configurations can be configured at the group-level (configurations before migration can be replicated here), which will be automatically configured for all AP-type connectors in the group.

Use Case 2 – Read-Only Group with Data Collectors

To enable group configurations for existing data collectors in a read-only group, complete the following steps:

1. Create a new group.
   For more information, click the first link in the UI banner, or see Using Group Configurations for Existing Connectors.

2. Set the filter to Global and navigate to the new group.

3. In the Manage > Applications > IoT Operations page, setup the required IoT configurations on the new group. For more information, see Configuring HPE Aruba Networking IoT Operations.

4. In the Maintain > Organization > Platform Integration > Data Collectors page, under the Managed Collectors table, select the data collector to be moved to the new group.

5. Hover over the applicable data collector row and click the edit icon.
   

   Figure 3  Managed Collectors Table

   

6. Select the new group that has the required IoT configuration.
   The data collector will now get all the configurations of the new group.

Assigning a CA Certificate

HPE Aruba Networking Central includes a default certificate that is not signed by a root Certificate Authority (CA). For devices to validate and authorize HPE Aruba Networking Central, upload a valid certificate that is signed by a root CA. For additional information, see Certificates.

To assign a certificate, complete the following procedure:

1. In the WebUI, set the filter to an AOS-10 group.
2. Under Manage, click Devices.
3. Click the Config icon.
4. Click Show Advanced.
5. Click Security.
6. Click Certificate Usage.
7. Select a CA certificate from the WebCC CA Cert drop-down list. A CA certificate is automatically selected in the IOT CA Cert table.
8. Click Save Settings.

Synchronizing a CA Certificate

CA certificates are synchronized to collectors automatically when they are uploaded in HPE Aruba Networking Central.

VusionGroup App

Using IoT Operations and the VusionGroup app is the supported method for using the VusionGroup ESL integration on AOS-10. VusionGroup was previously known as SES Imagotag.

Prerequisite

The VusionGroup app requires APs to run AOS 10.7.0.1. To upgrade the APs to AOS 10.7.0.1, see AOS-10 Online Help.

Before configuring the VusionGroup app, ensure that an IoT Connector is present. If an IoT Connector is not present, create one. To create an IoT Connector, complete the following steps:

1. In the WebUI, navigate to Applications > IoT Operations.

2. Configure a VM-based or AP-based IoT Connector. For additional information, see Creating a VM-Based IoT Connector.

3. Install the VusionGroup app For additional information, see Installing a Partner-Developed App.

Configuring VusionGroup App

To configure the VusionGroup app, complete the following steps:

1. In the WebUI, set the filter to an AOS-10 group.

2. Under Manage, click Devices.

3. Click the Config icon.

4. Click Show Advanced.

5. Click IoT tab.

6. Expand VusionGroup.

7. Configure the following parameters and click Save Settings.

Table 7: VusionGroup Parameters

Parameter	Description
Server name or IP	Name or IP address of VusionGroup server. NOTE: Name can have up to 127 characters.
Channel	Channel to use when communicating with ESL.
Authentication	Enable authentication with server.
FQDN verify	Enable FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. check of server.

Verifying VusionGroup App

Verifying the VusionGroup app installation is an optional procedure. To verify the VusionGroup app installation, complete the following steps:

1. Establish an SSH session to the AP.

2. Issue the show ESL command.

3. Verify that the output of the command lists the parameters configured in Configuring VusionGroup App.

Editing VusionGroup App

To edit the VusionGroup app, see Updating a Partner-Developed App.

Uninstalling VusionGroup App

To uninstall the VusionGroup app, see Uninstalling a Partner-Developed App.