Configuring AOS-CX Switches using Templates

Templates in HPE Aruba Networking Central On-Premises refer to a set of configuration commands that can be used by the administrators for provisioning devices in a group. Configuration templates enable administrators to apply a set of configuration parameters simultaneously to multiple switches in a group and thus automate switch deployments.

When firmware compliance is set for a template group, then the template configuration push will be blocked on all non-compliant devices. The configurations will be pushed to these devices only when a compliant build firmware is downloaded and when the devices are rebooted.

Creating a Group for Template-Based Configuration

For template-based provisioning, switches must be assigned to a group with template-based configuration method enabled.

For more information, see Groups and Groups.

Creating a Configuration Template

To create a configuration template for switches, complete the following steps:

1. In the WebUI, set the filter to a template group.

   The dashboard context for the group is displayed.

2. Under Manage, click Devices > Switches.
3. Click the AOS-CX or Config icon to view the switch configuration dashboard.

   The tabs to configure switches using templates is displayed.

4. Click the Templates tab.

   The Templates page is displayed.

5. Click + to add a new template.

   The Add Template window is displayed.

6. In the Basic Info tab, enter a name for the template in the Template Name field.
7. In the Device Type drop-down list, select Aruba CX.
8. Select the switch model and software version. You can specify any of the following combinations:
   • ALL for both Model and Version—To apply the template to all switch models and all supported switch software versions.
   • ALL for Model and a software version for Version—To apply the template to all switch models running the selected software version.
   • ALL for Version and a switch model for Model—To apply the template to a switch model and all software versions supported by the selected switch model.
   • A switch model and a software version—To apply the template to a specific switch model and the software version. The template created for a switch model and a software version takes precedence over the template that is created for all platforms and versions.
9. Select the manufacturing part number of the switch in the Part Number drop-down list.
   • The Part Number drop-down list is displayed only if you select a switch model in the Model drop-down list.
   • If you select a specific switch model and part number, you can apply the template to a standalone switch and not to a stack.
   • If you select All in the Model drop-down list, or if you select a switch model and All in the Part Number drop-down list, you can apply a template to both a standalone switch and stack.
10. Click Next.

    The Template tab is displayed.

11. Build a new template by adding the output of the show running-config from the switch CLI in the Template text box.

    Ensure that the template text adheres to the guidelines listed in the Important Points to Note.

    • You must manually create the template for the AOS-CX switch in a group, along with the password in plaintext format. You can use the output of the show running-config command to create the template. You can also add variables to use the same template for onboarding The process of preparing a device for use on an enterprise network, by creating the appropriate access credentials and setting up the network connection parameters. multiple AOS-CX switches. For more information on variables, see Manage Variable Files.
    • All switch templates must include a password command to set a password for the device. The template cannot be saved without adding a password command. If the configuration that is pushed from HPE Aruba Networking Central On-Premises to the device does not contain a password command, the configuration push is aborted for the device and a log is added to the audit trail. For example, if you add the password command in a condition block and the condition evaluates to false, the configuration that is pushed will not contain the password command. For more information, see Managing Password in Configuration Templates.
    • For AOS-CX switches, you must configure the password only in plaintext. Also, the format of password must be user admin group administrators password plaintext <string>.
    • In the AOS-CX template configuration, the pound sign (#) is used for adding comments. When using the banner motd code in the template configuration, use a delimiter such as at (@) symbol or any other special character, than using the pound sign (#). Using the pound sign (#) with the banner motd code will cause the code to be dropped when processing the template.
12. Click Save.

    After you apply the configuration template, switches reboot and reconnect to HPE Aruba Networking Central On-Premises with the new configuration.

Configuring AOS-CX VSX Using Templates

When configuring VSX using templates, assign a variable—for example, vsx_role—and configure it as primary for the primary VSX switch. Using the vsx_role variable in an if check, ensure all vsx-sync related configuration lines are applied only to the primary VSX switch. An example vsx-sync configuration in a template is as follows:

Example variables for a VSX switch pair:

• On the primary VSX switch:

vsx_ka_dst_ip = 10.0.1.2 vsx_ka_src_ip = 10.0.1.1 vsx_role = primary

• On the secondary VSX switch:

  vsx_ka_dst_ip = 10.0.1.1 vsx_ka_src_ip = 10.0.1.2 vsx_role = secondary

Example of template configuration on HPE Aruba Networking Central On-Premisesfor VSX switches:

Example of uploaded configuration from HPE Aruba Networking Central On-Premises to VSX switches:

• For the primary VSX switch:

vsx inter-switch-link lag 256 keepalive peer 10.0.1.2 source 10.0.1.1 vrf default role primary vsx-sync aaa acl-log-timer bfd-global bgp copp-policy dhcp-relay dhcp-server dhcp-snooping dns icmp-tcp lldp loop-protect-global mac-lockout mclag-interfaces neighbor ospf qos-global route-map sflow-global snmp ssh stp-global time vsx-global

• For the secondary VSX switch:

  vsx inter-switch-link lag 256 keepalive peer 10.0.1.1 source 10.0.1.2 vrf default role secondary

Example of running configuration for the VSX switch pair:

• On the primary VSX switch:

  vsx inter-switch-link lag 256 keepalive peer 10.0.1.2 source 10.0.1.1 vrf default role primary vsx-sync aaa acl-log-timer bfd-global bgp copp-policy dhcp-relay dhcp-server dhcp-snooping dns icmp-tcp lldp loop-protect-global mac-lockout mclag-interfaces neighbor ospf qos-global route-map sflow-global snmp ssh stp-global time vsx-global

• On the secondary VSX switch:

  vsx inter-switch-link lag 256 keepalive peer 10.0.1.1 source 10.0.1.2 vrf default role secondary vsx-sync aaa acl-log-timer bfd-global bgp copp-policy dhcp-relay dhcp-server dhcp-snooping dns icmp-tcp lldp loop-protect-global mac-lockout mclag-interfaces neighbor ospf qos-global route-map sflow-global snmp ssh stp-global time vsx-global

  The VSX primary switch pushes the vsx-sync related configuration commands to the VSX secondary switch. With this method, HPE Aruba Networking Central On-Premises and the native vsx-sync mechanism are complementary and work hand in hand.

Password Requirements for Template-Based Configuration

The following table provides information on password requirements for the template-based configuration in HPE Aruba Networking Central On-Premises.

Table 1: Password Requirements for AOS-CX Switches when using Templates

Software Versions	Status of Switch in HPE Aruba Networking Central	Default Switch Password	Password Requirement in HPE Aruba Networking Central
AOS-CX switches running 10.05 or earlier versions	Online or Offline	admin or no password	The password configured on the switch must match with the password configured in the template in HPE Aruba Networking Central On-Premises. If the password do not match, then HPE Aruba Networking Central On-Premises will be unable to push the template configuration to the switch.
AOS-CX switches running 10.06 or later versions	Offline	admin or no password	The password configured on the switch need not match with the password configured in the template in HPE Aruba Networking Central On-Premises. The password configured in the template in the plaintext format will be used by the switch after the configuration is successfully pushed by HPE Aruba Networking Central On-Premises.
	Online	admin or <SERIAL>_central (For Example: CN406THG_central)

Important Points to Note

Note the following points when adding configuration text to a template:

• The CLI syntax in the switch template must be accurate. HPE Aruba Networking recommends that you validate the configuration syntax on the switch before adding it to the template text.
• Ensure that the command text indentation matches the indentation in the running configuration.
• The commands in the template are case-sensitive and cannot contain the % character. In the template-based configuration, the % character is reserved and is used to denote variables.
• The following example illustrates the case discrepancies that the users must avoid in the template text.

  ssh server vrf default ssh server vrf mGmt vsf member 1 type jl660ab vlan 1 spanning-tree interface Mgmt no shutdown ip dhcp interface 1/1/1 no shutdown no routing vlan access 1 interface 1/1/2 no shutdown no routing vlan access 1 interface 1/1/3 no shutdown no routing vlan access 1 interface 1/1/4 no shutdown no routing vlan access 1 interface 1/1/5 no shutdown no routing vlan access 1 interface 1/1/6 no shutdown no routing vlan access 1 interface 1/1/7 no shutdown no routing vlan access 1 interface 1/1/8 no shutdown no routing vlan access 1 interface 1/1/9 no shutdown no routing vlan access 1 interface vlan 1 ip dhcp ! ! ! ! ! https-server vrf default https-server vrf MGMT