MSP Solutions Guide. Version 1.0

Transcription

1 MSP Solutions Guide Version 1.0

2 Copyright Information Copyright 2018 Hewlett Packard Enterprise Development LP. Open Source Code This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise Company. To obtain such source code, send a check or money order in the amount of US $10.00 to: Hewlett Packard Enterprise Company Attn: General Counsel 3000 Hanover Street Palo Alto, CA USA Scott Blvd Santa Clara, CA Phone: WIFI-LAN ( ) Fax

3 Contents Revision History... 5 About This Guide... 6 Overview... 6 Intended Audience and Scope... 6 Related Documents... 6 Aruba Central Managed Service Provider Mode... 7 MSP mode Management Options... 9 Device and Subscription Ownership Customer Owned Device and Subscription Management Supported Device Types and Deployment Architectures Users and Roles in MSP mode Types of Users Types of Roles Groups What are groups? Groups in Standard Enterprise Mode Default group User-defined group UI-group Template groups MSP UI-Groups Tenant Default Group Overrides Setting up a Central MSP Account Create a Central Account Enable MSP Mode MSP UI Elements Adding devices to your MSP account Add device by MAC/SN Add devices by Cloud Activation Key MSP Solutions Guide Revision History 3

4 Link MSP to Activate (Recommended) Add subscription Keys Create MSP Users and Roles Create a new custom role Create a new MSP User and map MSP/Tenant Roles Resend Invite Enable 2 Factor Authentication Customize the customer facing portal with MSP branding Create an MSP UI Group Manage Tenants Create a New tenant Create a new tenant and map to an MSP group Create a tenant user Create a Tenant Template Group Delete Tenant Assign Devices to Tenants Unassign devices from a tenant Assign/Unassign Device subscriptions to tenant devices Assign Network Service subscriptions to tenant devices Manage Tenant Configurations Scenario Using Default UI Groups Using User Defined UI-Groups Using Template Groups Scenario Deployment Using User-Defined UI Groups Deployment Using Template Groups Managing the Tenant Network Navigating to the Tenant view Monitoring tools Troubleshooting Tools MSP Solutions Guide Revision History 4

5 Firmware Management Revision History Revision History The following table lists the revisions of this document: Revision Revision 1 Change Description Initial Publication MSP Solutions Guide 5

6 About This Guide About This Guide Overview The Aruba Central Managed Service Provider Solutions Guide provides an overview of the various aspects of Aruba Central s multi-tenant management mode. The guide hopes to describe many of the conceptual ideas regarding MSP mode, the steps to setup your MSP account and provides best practices for configuring and managing the end customer environment. Intended Audience and Scope This guide is intended for customers who configure and use MSP mode. Related Documents In addition to this document, the Central product documentation includes the following documents: Aruba Central Getting Started Guide Aruba Central Help Center Aruba Central User Guide Aruba Central SD Branch Solution Guide MSP Solutions Guide Revision History 6

7 Aruba Central Managed Service Provider Mode Aruba Central s Managed Service Provider (MSP) mode is a multi-tenant operational mode that Standard Enterprise Aruba Central accounts can be converted into. Enabling MSP mode exposes additional options to manage multiple independent Central customer accounts. With the MSP mode, administrators can provision tenant (end-customer) accounts, allocate devices, assign subscriptions and monitor tenant accounts. The MSP administrators can drill down to a specific tenant account and perform additional administration and configuration tasks. To clarify the different terminologies used, below are a few brief descriptions: Aruba Central Standard Enterprise Mode: This is a regular Aruba Central account, also called Standard Enterprise mode. It refers to the Central deployment mode in which customers manage their respective accounts end-to-end. The Standard Enterprise mode is a single-tenant environment for a single end-customer. Aruba Central MSP Mode: Refers to the Central deployment mode in which service providers centrally manage and monitor multiple tenant accounts from a single management interface. Tenant Accounts: End customer accounts created in Aruba Central MSP mode are called tenants. Each tenant is an independent instance of Aruba Central. MSP User: Refers to users created in the MSP account. These users have administrator privileges to provision, manage, and monitor tenant accounts. Tenant User: Refers to the users created in an individual tenant account provisioned in the Managed Service Provider mode. MSP Solutions Guide 7

8 Figure 1: Standard Enterprise Mode Figure 2: Managed Service Provider Mode MSP Solutions Guide 8

9 MSP mode Management Options In Central MSP mode, MSP users have a superset of administration options compared to tenant users. An MSP admin can perform the following administrative tasks: Tenant management Device and subscription management across all tenants Monitoring and event management across all tenants Configuration management across all tenants User management across all tenants API management for MSP and across all tenants A tenant admin can perform the following administrative tasks: Monitoring and event management per tenant Configuration management per tenant User management across per tenant API management per tenant MSP Solutions Guide 9

10 Device and Subscription Ownership In Managed Service Provider mode, both the hardware and subscriptions are owned by the MSP. The MSP temporarily assigns devices, and their corresponding subscriptions, to tenants for the duration of the managed service contract. When the contract ends, the devices and the subscriptions are returned back to the MSP s common pool of resources and can be reassigned to another tenant. Customer Owned Device and Subscription Management As mentioned above, Central MSP mode cannot be use to manage devices purchased by an end customer directly. If an MSP wishes to manage customer owned devices, this can be achieved outside of Central s MSP mode. In this scenario, an MSP would not create a Central account of their own, but would instead add their (MSP) administrator to each end customer Central account. The MSP admin will only have access to each end customer account and can use the Switch Customer option under User Settings to switch between end customer accounts. If you have been added to more than one Central account, on logon you are presented with a screen with the option to choose which account you want to access. MSP Solutions Guide 10

11 This way, each end customer would own their own equipment and subscriptions, and the MSP admin can login to each and manage it for them. Please note that since there is not Central MSP account there is no single pane of glass across all customers and all workflows for configuration management, device and subscription inventory, etc would be independent for each account Supported Device Types and Deployment Architectures Central MSP supports all devices and architectures supported by Central. Refer here for a list of supported access points, switches and gateways Central supports wireless, wired and SD-WAN deployments either independently or in combination. So, as an MSP, you can manage customer A who only has a wireless deployment, while also managing customer B, who has both a wired and a wireless deployment and customer C who only has an SD-WAN deployment. Any combination of these three platforms is supported. Users and Roles in MSP mode Users and Roles are critical pieces to enforce Role Based Access Control in Central. Roles are created to identify various personas and consequently map permission/rights to access various applications/pages across Central. Users are tagged with roles and helps identify individuals who get access to Central. MSP Solutions Guide 11

12 Types of Users In MSP mode, there are two types of users: 1. MSP users have access to the MSP account and every tenant account created within that MSP. MSP users are created within the MSP account. 2. Tenant users only have access to the tenant account they were created within and no access to the MSP account or other tenant accounts. Tenant users are created within each tenant account. Types of Roles Aruba Central s Standard Enterprise mode supports RBAC or Role Based Access Control, where access privileges can be customized per role and these roles can be mapped to one or more users, who inherit the access privileges of that role. Roles can either be system defined or custom built. Figure 3: RBAC in Standard Enterprise Mode Aruba Central MSP extends this concept of role-based access control to the MSP mode as well. Similar to RBAC in the Standard Enterprise mode, roles can either be system defined or custom built. MSP Solutions Guide 12

13 Each Tenant user is mapped to a single Tenant role which defines the user s privileges within that tenant account Each MSP user is mapped to two roles MSP role and Tenant role o MSP role defines the user s privileges within the MSP account o Tenant role defines the user s privileges within every tenant account. NOTE: This is a single role mapping that applies to all tenants and cannot be customized per tenant. Figure 4: RBAC in MSP mode From Figure 4: MSP User A is mapped to two roles MSP role admin that gives it admin access to all MSP applications and Tenant role readonly that gives it read only access to every tenant account. MSP User B also has an MSP role of admin but its Tenant role of admin also gives it admin access to every tenant account. Tenant A User has a single role admin giving it admin access to all Tenant A applications. Tenant B User has a single readonly role giving it read only access to Tenant B applications. Note that neither Tenant A User nor Tenant B User have an MSP role, which means they have no access to the MSP account itself. Additionally, they also do not have access to each other s accounts, their access is restricted to their account only. Groups What are groups? Central supports allocating devices to a group for the ease of configuration and maintenance. A group in Central is a primary configuration element that acts like a container. In other words, groups are a subset of one or several devices that share some common configuration settings. MSP Solutions Guide 13

14 Device groups in Central are mutually exclusive (independent) and do not follow a hierarchical model. Groups in Standard Enterprise Mode Central supports allocating devices to a group for the ease of configuration and maintenance. A group in Central is a primary configuration element that acts like a container. In other words, groups are a subset of one or several devices that share some common configuration settings. The device groups feature in Central offers the following functions and benefits: Combine different types of devices under a group. For example, a group can have Instant APs, Switches and Gateways or any combination of each. Central allows you to manage configuration of these devices in separate containers (wireless, wired and gateway) within the same group. Assign multiple devices to a single group. For example, a group can consist of multiple Instant AP virtual controllers. These virtual controllers share common configuration settings and push these changes to slave Instant AP in their respective clusters. You can create a device group with virtual controllers deployed at different geographical locations. Manage configuration settings of devices at the group level. For example, you can apply a common security policy for the devices deployed in a specific location. Default group Figure 5: Groups in Standard Enterprise Mode System-defined group that consists of devices with factory default configuration. Every Central account has a default group, this group is created at account creation and has factory default configuration for each device type. The default configuration can be modified, if required. User-defined group MSP Solutions Guide 14

15 Custom groups created by the administrators of a customer account. The administrators can use the custom groups to apply configuration changes unique to a cluster or a group. UI-group Figure 6: Standard Enterprise Mode - Default and User defined Groups Groups that allow you to customize and manage device configuration through the UI workflows. For example, the APs in a group can be configured using the menu options under the Wireless Management. Similarly, Aruba switches can be configured using Wired Management app. Devices mapped to a UI group inherit the configuration as per the setting on the UI. Template groups Groups that allow you to manage device configuration through CLI configuration templates. A template is nothing more than a IAP or switch configuration that utilizes variables. It will always have system variables and may or may not contain user defined variables but likely will. The lines in a template file are nothing more than CLI commands. And the user defined variables are provided from the variables file. MSP Solutions Guide 15

16 Figure 7: Template Group AP Example From Figure 8: A template configuration is built from a template file and a variable file The template file contains: o common configuration that does not change between devices like wlan ssid-profile Template- SSID and essid Template SSID o system defined variables like "_sys_serial" and "_sys_lan_mac o and user defined variables like %vlan_id The variable file contains variable values that match the variable defined in the template file The final config of each device is a combination of the common configuration and variables replaced by their corresponding variable values for that device. MSP UI-Groups NOTE: Template Groups are not supported on MSP In MSP mode, we extend the concept of groups to include MSP Groups, which are UI-groups that can be mapped to tenant default UI-groups. This allows for a configuration defined at the MSP level to be pushed down tenants and since more than one tenant can be mapped to a single MSP group, the configuration can be pushed at scale. If a tenant account is associated to a specific group in the Managed Service Portal, the MSP Group configuration is pushed down to the default group in the tenant account. The MSP/tenant administrator can create additional groups for that specific tenant (user defined groups) by drilling down to the tenant account, these groups do not inherit the MSP groups configuration. MSP Solutions Guide 16

17 Note, only UI-Groups are supported in MSP mode. However, Template groups can still be defined and managed at each tenant individually. Figure 8: MSP Mode - MSP Groups From figure 8: Tenants A and B are mapped to MSP Group 1. The default group configuration for these tenants is inherited from MSP Group 1 s configuration. Tenant A has two additional user defined groups that are independent of the MSP Group 1 configuration. Tenant B has one additional user defined group that is independent of the MSP Group 1 configuration. Tenant C is mapped is mapped to MSP Group 2. Its default group config is inherited from MSP Group 2. It also has one additional user defined group that is independent of the MSP Group 2 configuration. Tenant D only has a default group and its configuration is inherited from MSP Group 3. Tenant E is not mapped to any MSP Group. Its default group config is independent of any MSP group configuration. It can have additional user defined groups as well, if required (though not shown here). Tenant Default Group Overrides MSP Solutions Guide 17

18 As stated above, when a tenant is mapped to an MSP group the configuration of its default group is inherited from the MSP Group it is mapped to. Once mapped, except for the few configuration options (see below), no changes can be made on the tenant default group. The following configuration options are allowed on a tenant default group that is mapped to an MSP group: Create a new WLAN SSID Override the WLAN PSK for a WLAN inherited from an MSP group MSP Solutions Guide 18

19 Setting up a Central MSP Account Central MSP is an operational mode of Central, the first step to creating an MSP account is to create an Aruba Central account and then enable Managed Service Mode Note, MSP end customers (tenants) do not need to create a Central account for themselves. The MSP admin manages the creation and deletion of end customer Central accounts within the MSP s Central account itself. Once a tenant account is created, the MSP admin can add tenant users to the account. Tenant users will only have access to their individual tenant account and will not have access to other tenant accounts managed by the MSP. Create a Central Account If you have and existing Central account, you can skip this step. If you don t already have a Central account, sign up for a free Aruba Central evaluation here Enable MSP Mode 1. Login to your Aruba Central account 2. Post login, you will be redirected to the Aruba Central Standard View MSP Solutions Guide 19

20 3. In the WebUI on the Left Navigation Pace > User Icon > Managed Service Mode 4. Click enable for the following message. MSP UI Elements MSP Solutions Guide 20

21 Left Navigation Pane MSP User Interface App Selector: Easy access to the different applications you would use as you manage your MSP environment. Bubble Icon: Links to the MSP online user guide, Aruba support portal and Airheads community. Help Icon: Gives a brief definition of the selected terms and fields in the data pane. User Icon: A menu with options for managing the MSP account and MSP user account. Data Pane: Displays detailed information of the tabs and data for the selected menu commands. Group Selection Filter: Used to filter the data pane with data relevant to a particular group. Feedback bubble: Provide feedback on Aruba MSP. Need Help bubble: Walks you through the steps required for a selection for workflows. New walkthroughs are added constantly. MSP Solutions Guide 21

22 Adding devices to your MSP account After you enabled your MSP account, the next step is to populate your MSP account with your purchased devices. There a few ways you can do this: 1. Add devices by their MAC address or Serial Number 2. Add device using the cloud activation key or 3. Link your MSP account to your Aruba Activate account Add device by MAC/SN If you don t yet have and activate account or if your device is not in your activate account, you can add the device manually using its mac and serial number. We don t recommend this method for a production environment since it can be time consuming, instead link your MSP account to activate, follow the steps in section Device Inventory Link MSP to Activate (Recommended) 1. In the WebUI, navigate to: App Selector > Global Settings > Device Inventory > Click on ADD BY MAC/SN 2. A maximum of 32 devices can be added using this option 3. In the pop up window that shows, enter your device mac and serial numbers MSP Solutions Guide 22

23 4. Confirm devices have been added to in the Device Inventory table Add devices by Cloud Activation Key You add multiple devices from a single purchase order by providing the cloud activation key. This is a unique key for each device, available when device contacts Activate & is visible in Activate or device CLI. It s valid for 10 days and changes upon next contact with Activate. We don t recommend this method for a production environment since it can be time consuming, instead link your MSP account to activate, follow the steps in section Device Inventory Link MSP to Activate (Recommended) 5. Obtain your devices Cloud Activation key: a. For Instant APs, execute the show about command at the Instant AP CLI or click Maintenance > About in the Instant AP UI. b. For Aruba Mobility Access Switches, execute the show inventory include HW and the show version command on the Mobility Access Switch CLI console. You can also view the cloud activation key in the Maintenance >About tab in the UI. The activation key is enabled only if the switch has access to the Internet. c. For other Aruba Switches, to view the MAC address and the serial number, run the sh system in Base and sh system in Serial commands at the Switch CLI console. 6. In the WebUI, navigate to: App Selector > Global Settings > Device Inventory > Click on ADD WITH CLOUD ACTIVATION KEY MSP Solutions Guide 23

24 7. In the pop up window that shows, enter the key and device MAC address 8. Confirm devices have been added to in the Device Inventory table Link MSP to Activate (Recommended) Activate is Aruba s free cloud based inventory & provisioning service. 1. In the WebUI, navigate to: App Selector > Global Settings > Device Inventory > Click on ADD USING ACTIVATE 2. In the pop up window, enter your activate username and password and click Add 3. The devices associated with the Activate account are retrieved and added to the list of devices will be displayed on the Device Inventory page. 4. Central automatically adds devices to inventory as soon as new purchase orders are processed. However, if you want to add new devices that have been recently purchased, you can manually synchronize the device inventory by clicking Sync Now. MSP Solutions Guide 24

25 NOTE: You can use this option only once. After the devices are added, Central does not allow you to modify or re-import the devices using your Aruba Activate credentials MSP Solutions Guide 25

26 Add subscription Keys We ve enabled MSP mode and populated the account with purchased devices, next, we will add your subscription keys to the account as well. Aruba Central supports the following types of subscriptions: Device management subscriptions Allows you to add and manage devices (Instant APs and Switches) Cloud service subscriptions Enables access to a cloud service on any capable device. For example, access to application services such as Presence Analytics is based on the cloud service subscription 1. In the WebUI, navigate to: App Selector > Global Settings > Key Management 2. Click Add Key 3. In the pop up window that appears, enter the purchased subscription key and Click Activate MSP Solutions Guide 26

27 Create MSP Users and Roles We ve now got our MSP account setup and populated it with devices and licenses. Next, let s add other MSP users to the account who may also want to administer this account. MSP supports Role Based Access Control (RBAC) function that allows you to configure various types of MSP users each with a specific level of access control. You have the option to use system defined roles or create a custom role. Following are the available system defined roles: Administrator (admin) Read Write (readwrite) Read Only (readonly) Guest Operator (guestoperator) Create a new custom role 1. In the WebUI, navigate to: App Selector > Global Settings > Users & Roles 2. Select the Roles tab and select New Role option at the bottom of the screen 3. From the pop-up that appears, provide a name for the new role and use the options below to customize the access privileges for this role MSP Solutions Guide 27

28 Create a new MSP User and map MSP/Tenant Roles Roles created in the section <insert roles creation> are mapped to individual user accounts 1. In the WebUI, navigate to: App Selector > Global Settings > Users & Roles 2. Select the Users tab and select New User option at the bottom of the screen 3. From the pop-up that appears, enter a valid address for the user name and optionally add a description. 4. Select two roles, an MSP role that defines access to all MSP level functionality and (optionally) a tenant role that defines access to all tenant level functionality. 5. Select an applicable language setting 6. An invite will be sent to the address provided to verify that address MSP Solutions Guide 28

29 Resend Invite If after adding a new user with a valid address in section <insert add user> an invite was not received, use this option to resend the invite 1. In the WebUI, navigate to: App Selector > Global Settings > Users & Roles 2. Select the Action button in the top right corner of the screen and from the drop down menu select Resend Invite 3. Enter the address of the user and select Resend Invite Enable 2 Factor Authentication Central supports two-factor authentication for a second layer of security in addition to the password. When two-factor authentication is enabled on a user account, the user can sign in to their Central account, either through the mobile app or the web application, only after providing their password and the six-digit verification code displayed on Google Authenticator. NOTE: When two-factor authentication is enabled at the customer account level, all the users belonging to the customer account are required to complete the authentication procedure when logging in to Central. 1. Install the Google Authenticator app on any trusted mobile device 2. In the WebUI, navigate to: App Selector > Global Settings > Users & Roles 3. Select the Action button in the top right corner of the screen and from the drop down menu set Two-Factor Authentication (2FA) to ON MSP Solutions Guide 29

30 4. Now that 2FA is enabled, logout of Central and log back in 5. After you enter your username/password you will be presented with a screen to register your device for 2FA. If you have already installed installed Google Authenticator, click Next, if not, install the app and open it before you proceed. 6. The next screen will present you with a QR code to be scanned by the app MSP Solutions Guide 30

31 7. On the app, click on the option to scan a QR code 8. After the QR code has been scanned, a new series of expiring codes will appear in your Google Authenticator app 9. Going back to the Central login page, enter the latest available code in the area provided MSP Solutions Guide 31

32 10. Click Finish. If the code is verified you will have successfully logged into Central. 11. Selecting the option to Remember 2FA for 30 days will not prompt you to enter your 2FA credentials for 30 days after a successfully login with 2FA. Customize the customer facing portal with MSP branding The Portal Customization pane allows you to customize the look and feel of the user interface and the notifications sent to the customers and users. For example, you can use your company logo in the user interface and company address in the notifications sent to the customers or users. To customize the look and feel of the portal, complete the following steps: 1. In the WebUI, navigate to: App Selector > Global Settings > Maintenance -> Portal Customization 2. Under Customization, configure the following information: a. Product Name Name of the product. b. Provider Name Name of the company. c. Contact Link The URL to the company website that shows the contact address of the company. d. Sender Address The address from which the notifications are sent. e. Mailing Address The postal address of the company. f. Service Link The URL to the company website showing the service related information. MSP Solutions Guide 32

33 g. Terms and Conditions Link The URL to the company website listing the terms and conditions. 3. If you want customize the logo of your portal, click the Skinning tab a. Browse to your local directory and upload the logo image. b. Click Save Settings. The customized logo will appear in the following pages: Tenant account All the apps and pages applicable to the tenant. For more information about tenant accounts, see Provisioning Tenant Accounts. invite invite sent while adding a new user. The contains the registration link. For more information about adding a new user, see Adding a User. MSP Solutions Guide 33

34 Create an MSP UI Group An MSP group can be used to push a common set of configurations to a set of tenants 1. In the WebUI, navigate to: App Selector > Global Settings > Manage Groups > Click on New Groups 2. Select a group name and assign a password 3. A new group will be created, and you will be redirected to the Wireless Management > Wireless Networks where you can start to configure your group configuration. To map a group to a customer, follows steps in section Create a new tenant and map to an MSP group MSP Solutions Guide 34

35 Manage Tenants Create a New tenant 1. In the WebUI, navigate to: App Selector > Monitoring & Reports > Customers > Add Customer 2. Fill in customer name (required) 3. Add a description (optional) 4. Click Save 5. Refresh the page. Notice that the Customer provision status changes from In Progress to Completed 6. Click on the Customer ID & the interface transitions into standard enterprise for the customer. 7. Click on Return to MSP View to go back to MSP Interface. MSP Solutions Guide 35

36 Create a new tenant and map to an MSP group 1. In the WebUI, navigate to: App Selector > Monitoring & Reports > Customers > Add Customer 2. Fill in customer name 3. Optionally, add a description 4. Enable the Add to group toggle 5. Select the MSP group to map this customer to 6. Optionally, choose to lock the group SSIDs. This option prevents Tenant users from modifying the SSID settings of the mapped group at the tenant default group. 7. Click Save Customer Created 8. Refresh the page. Notice that the Customer provision status changes from In Progress to Completed Create a tenant user Tenant users are created within each tenant account. navigate down to the tenant level. 1. In the WebUI, navigate to: App Selector > Monitoring & Reports > Customers 2. Click on the customer ID of the end-customer in question 3. Within the tenant view, navigate to App Selector > Global Settings > Users and Roles MSP Solutions Guide 36

37 4. Click on New User 5. Provide the requested user information. a. Username is the address of the user. A verification will be sent to this address. The verification step will need to be completed before the user can access their account. b. Role is the Tenant role created by the MSP admin. Note, roles can only be created by the MSP admin in the MSP view, they cannot be created in the tenant view. c. Allowed Groups allows the users access to be restricted to particular groups only. Create a Tenant Template Group 1. Since template groups are created at the tenant level, we first navigate down to the tenant level. In the WebUI, navigate to: App Selector > Monitoring & Reports > Customers 2. Click on the customer ID 3. Navigate to: App Selector > Global Settings > Manage Groups > click New Group 4. Fill in customer name and check the box for Use as a template group and click Add Group MSP Solutions Guide 37

38 Delete Tenant 1. In the WebUI, navigate to: App Selector > Monitoring & Reports > Customers 2. Hover over the customer to be deleted and click the Delete icon MSP Solutions Guide 38

39 Assign Devices to Tenants 1. In the WebUI, navigate to: App Selector > Global Settings > Device Inventory 2. The device inventory table will list all available devices and includes the CUSTOMER column which indicates which customer the device is currently assigned to. If the device has not been assigned to any tenant, it will be assigned to the MSP itself. 3. From the list of devices select one or multiple devices that are currently assigned to the MSP account. 4. Click on the button Assign to Customer that appears below the table. 5. From the pop-up window the appears, select the customer and (optionally) select the customer group to assign the device MSP Solutions Guide 39

40 6. Confirm the devices are now assigned to the tenant 7. To unassign devices from a customer follow the steps in section Unassign devices from a tenant Unassign devices from a tenant 1. In the WebUI, navigate to: App Selector > Global Settings > Device Inventory 2. The device inventory table will list all available devices and includes the CUSTOMER column which indicates which customer the device is currently assigned to. If the device has not been assigned to any tenant, it will be assigned to the MSP itself. MSP Solutions Guide 40

41 3. From the list of devices select one or multiple devices that are currently assigned to a tenant account 4. Click on the button Unassign from Customer that appears below the table. 5. Click Yes on the confirmation pop-up that appears 6. Confirm that the devices are now unassigned from the tenant and assigned back to the MSP 7. To reassign devices to a customer, follow the steps in section Assign devices to tenants Assign/Unassign Device subscriptions to tenant devices Aruba Central supports the following types of subscriptions: Device management subscriptions Allows you to add and manage devices (Instant APs and Switches) Network service subscriptions Enables access to a cloud services on any capable device. For example, access to application services such as Presence Analytics is based on the cloud service subscription 1. In the WebUI, navigate to: App Selector > Global Settings > Subscription Assignment 2. Under the Device Subscriptions sections, click SELECT DEVICES 3. In the pop-up that appears, under the checkbox column, select and unselect the devices to be subscribed and unsubscribed, respectively. MSP Solutions Guide 41

42 Assign Network Service subscriptions to tenant devices Aruba Central supports the following types of subscriptions: Device management subscriptions Allows you to add and manage devices (Instant APs and Switches) Network service subscriptions Enables access to a cloud services on any capable device. For example, access to application services such as Presence Analytics is based on the cloud service subscription NOTE: Service subscription are not applicable for switches only IAPs 1. In the WebUI, navigate to: App Selector > Global Settings > Subscription Assignment 2. Under the Network Service Subscriptions sections, drag and drop IAPs from the device list on the right to the service list on the left 3. You can select and drag more than one IAP at a time, as long as they are all being applied to the same service subscription i.e Clarity, Cloud Guest or Presence Analytics MSP Solutions Guide 42

43 MSP Solutions Guide 43

44 Manage Tenant Configurations Central MSP supports a number of configuration constructs including UI-Groups, Template Groups, Local Overrides, etc. A detailed description how to create and configure each construct is outside the scope of this document. The section below uses deployment examples to describe when and how these constructs can be used. Scenario 1 In this scenario, an MSP is offering the following wireless management services: WiFiConnectGo In this program, for a monthly fee per Instant AP, customers part of this program agree to broadcast the MSP s free public WiFi SSID WiFiConnectGo. Customers can add up to 15 additional custom SSIDs, including guest, of their own. Tenant account administrators are responsible for configuring any additional SSIDs and ongoing monitoring and maintenance. MSP is responsible for installing and bringing up the Instant AP only. WiFiConnectGo-Plus In this program, for an additional monthly fee per Instant AP, customers part of this program need not broadcast the free public WiFi SSID WiFiConnectGo. Customers can add up to 15 custom SSIDs, including guest, of their own. MSP is responsible for installing Instant APs, configuring custom SSIDs, and ongoing monitoring and maintenance. MSP Solutions Guide 44

45 Using Default UI Groups Use this deployment model if your customer deployments are identical. UI groups support an inheritance model from MSP to the tenant. As shown, the MSP uses MSP UI groups to push SSID configuration to the default group in each tenant account. Tenants can choose to add additional custom SSIDs to the default group. All sites are mapped to the same default group. MSP Solutions Guide 45

46 Using User Defined UI-Groups Use this deployment model if your customer deployments are unique and if you wish to use the Aruba Central user interface for configuring. As shown, each tenant has their own custom SSID configuration. In this scenario, the MSP administrator can create separate user-defined UI groups for each tenant. Sites with common SSID configurations are mapped to the same UI group. MSP Solutions Guide 46

47 Using Template Groups As shown, one template group is defined for each tenant and all devices are associated to the same group. Using the if/else conditional statements, you can push SSIDs to Instant APs selectively. MSP administrators can use the template and variable APIs to add, modify, or remove any wireless configuration. You can use this deployment model if you wish to automate your customer deployments using Aruba CLIs and Aruba Central APIs. MSP Solutions Guide 47

48 Scenario 2 In this scenario, an MSP has to provide Wi-Fi for a tenant at two different sites. Except for the VLAN ID, the configuration is identical between the two sites. The following are the site details: Site 1 Location: University Ave, Berkeley, CA SSID Name: WiFi_CE Security: WPA2-PSK SSID Password: password@123 VLAN: 20 Site 2 Location: University Ave, Berkeley, CA SSID Name: WiFi_CE Security: WPA2-PSK SSID Password: password@123 VLAN: 40 Deployment Using User-Defined UI Groups The MSP can provide Wi-Fi for both sites using user-defined UI groups. As the Wi-Fi configuration per site is different, one UI group must be created for each site. For each site, the tenant account administrator has to do the following: 1. Create a new UI group for each site. 2. Configure the UI group with Wi-Fi settings specific to each site. 3. Map the Instant APs in each site to the respective UI group. Point to Note: One user-defined UI group is created for each site. For any new site with a different VLAN ID, a new UI group is created. If a configuration change is required at all sites, the tenant account administrator must manually edit each UI group as each group is independent of the other. For example, to change the Wi-Fi SSID name from WiFi_CE to WiFi_Secure_CE, the tenant account administrator must edit each UI group independently. MSP Solutions Guide 48

49 Deployment Using Template Groups The MSP can provide Wi-Fi for both sites using template groups. The tenant account administrator can create a single template group for both sites with a variable file that differentiates the VLAN setting per device. For both sites, the tenant account administrator has to do the following: 1. Create one tenant template group. 2. Configure the newly created template group by uploading a base configuration with the WiFi_CE setting and a variable for the SSID VLAN. 3. Upload a variable file with unique entries for each Instant AP. For the Instant APs part of Site 1, the VLAN variable value is 20. For the Instant APs part of Site 2, the VLAN variable value is Map Site 1 and Site 2 Instant APs to the common template group. Points to Note: One tenant template group is created for both sites. For every additional site with a different VLAN ID, the same template group can be used with a modified variable file. If a configuration change is required at all sites, the common template group can be updated and pushed to all sites. For example, to change the Wi-Fi SSID name from WiFi_CE to WiFi_Secure_CE, the tenant account administrator can edit the common template group and push the configuration changes to all sites. MSP Solutions Guide 49

50 Managing the Tenant Network Navigating to the Tenant view MSP users with administrative privileges to tenant accounts can drill down to tenant accounts. To drill down to a specific tenant account: 1. From the MSP view, go to the app selector, click Monitoring & Reports. 2. Click either All Customers or Customers. 3. In the Name column, click the name of the tenant. The Monitoring & Reports page of the tenant account opens. 4. To return to the MSP view, click Return to MSP View. Monitoring tools Network Overview Within the tenant view, an MSP admin can use the following tools to monitor the status of the customer s network: Network Overview: Displays a summary of the tenant environment including bandwidth usage, client count, top APs by usage, top 5 clients, top Instant AP clusters by usage, top Instant AP clusters by clients, application usage, and WLAN network details. o Device Details: For detailed information about any managed device, navigate to Network Overview -> Select appropriate device list (AP, Switch or Gateway), and click on the device name from the table show. Network Health: Provides detailed network health and usage information per tenant site. Client Overview: Displays the total number of clients, bandwidth usage, and the application usage by the clients connected to the wired and wireless networks. MSP Solutions Guide 50

51 o Client Details: For detailed information about any connected client, navigate to Client Overview -> List, and click on the MAC address of the client in question. AppRF: detailed information on application usage by the clients connected to the network Topology: provides a graphical representation of the network layout, details of the devices deployed in a branch site, and the health of the WAN uplinks and tunnels. Alerts: Displays all types of alerts generated for events pertaining to device provisioning, configuration, and user management. Network Health Client Details MSP Solutions Guide 51

52 AppRF Troubleshooting Tools Topology The Troubleshooting menu in the Maintenance module allows your network administrators to run troubleshooting or diagnostics commands on the devices managed from Central. When a troubleshooting operation is initiated, Central establishes a session with the devices, retrieves the output of the commands, and displays the output in the UI. Central supports running troubleshooting operations on one or several devices. You can select up to 10 devices for a troubleshooting operation. MSP Solutions Guide 52

53 Troubleshooting Tools Firmware Management The Firmware menu in the Maintenance app provides an overview of the latest supported version of firmware for the device, details of the device, and options to upgrade the device. Central also allows you to run a firmware compliance check and force firmware upgrade for devices in a group. Firmware Management MSP Solutions Guide 53