• To add license keys and check the license keys details for your account, see Managing License Keys.
• To assign licenses to devices and check the license assignment details, see Managing License Assignments.
• To migrate to the existing licensing model, see Enabling the Auto-Assign Licenses Option.

To manage licenses in MSP mode, see Managing MSP Licenses.

The Overview dashboard and the Reports dashboard in the MSP mode include information specific to the new Aruba Central licensing model.

The Overview page includes the following sections:

• A summary section for the dashboard—Displays the assigned and unassigned devices and licenses for APs, switches, and gateways.
• Overview—Displays the list of customers, the types of devices assigned to each customer, as well as critical alerts, if any.
• Trends—Displays charts for license renewal, the number of devices under MSP management, and the number of customers added over the last year.
• Add New Customer—Enables you to add a new tenant to the account.
• The number in parenthesis () for Customers indicates the total number of customers for that MSP account. In the following image, the total number of customers is 54.

Figure 1   Viewing the MSP Dashboard

 

For more information, see MSP Dashboard and MSP Reports.

For more information about the AOS-Switch devices and firmware versions supported in Aruba Central, see Supported AOS-Switch Platforms.

For more information about the AOS-Switch devices and firmware versions supported in Aruba Central, see Supported AOS-CX Platforms.

For more information about the Access Point devices and firmware versions supported in Aruba Central, see Supported Instant APs.

For more information about the gateway devices and firmware versions supported in Aruba Central, see Supported SD-Branch Components.

Aruba Central now supports configuration and monitoring AOS-CX switches that are added to a UI group, using UI options and MultiEdit mode. For more information on the versions supported, see Supported AOS-CX Platforms.

You can configure 6200, 6300, 8320, 8325, 8360 Switch Series using UI options, MultiEdit mode, and templates, and configure 6405, 6410, and 8400 Switch Series using only templates.

Aruba Central offers several new menu items for AOS-CX switch configuration using UI groups. These menu items are described as follows:

• Properties—Administrators can now view or manage system properties such as contact, location, time zone, and VRFs.

  For more information, see Configuring System Properties on AOS-CX.

• SNMP—Administrators can now configure SNMPv2Simple Network Management Protocol version 2. SNMPv2 is an enhanced version of SNMPv1, which includes improvements in the areas of performance, security, confidentiality, and manager-to-manager communications. and SNMPv3Simple Network Management Protocol version 3. SNMPv3 is an enhanced version of SNMP that includes security and remote configuration features. credentials, and trap destination on AOS-CX switches.

  For more information, see Configuring SNMP on AOS-CX.

• Logging—Administrators can now manage system log levels and add log servers for AOS-CX switches.

  For more information, see Configuring Logging Servers for AOS-CX.

• Administrator—Administrators can now configure authentication, authorization, and accounting services for existing RADIUSRemote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. , TACACSTerminal Access Controller Access Control System. TACACS is a family of protocols that handles remote authentication and related services for network access control through a centralized server. , and Local server groups.

  For more information, see Configuring AAA for AOS-CX.

• Routing—Administrators can now configure static route settings such as destination, next hop IP addresses, VRFs and administrative distance.

  For more information, see Configuring Static Routing on AOS-CX.

• Ports and Link Aggregation—Administrators can now configure link aggregations and modify port settings for AOS-CX using UI groups.

  For more information, see Configuring Ports and LAGs on AOS-CX.

• Authentication Servers—Administrators can now configure authentication servers such as RADIUS and TACACS using UI groups.

  For more information, see Configuring Authentication Servers on AOS-CX.

• Authentication—Administrators can now configure 802.1X802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication and MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.  authentication for AOS-CX switches using UI groups.

  For more information, see Configuring Authentication on AOS-CX.

• Access Control—Administrators can now add access policies and set different rules for the access policies using UI groups. This allows you to permit or deny passage of traffic based on network addresses, protocols, service ports, and other packet attributes.

  For more information, see Configuring Access Control on AOS-CX.

• VLANs—Administrators can now manage VLANVirtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN. settings such as name, description, admin status, and IP assignment for AOS-CX switches using UI groups.

  For more information, see Configuring VLANs on AOS-CX.

• Loop Prevention—Administrators can now enable or disable loop protection and spanning tree protocol and associated parameters such as the mode and priority. Enable or disable various MSTPMultiple Spanning Tree Protocol. MSTP configures a separate Spanning Tree for each VLAN group and blocks all but one of the possible alternate paths within each spanning tree. mode-related settings such as BPDUBridge Protocol Data Unit. A BPDU is a data message transmitted across a local area network to detect loops in network topologies. filter, BPDU protection, admin edge, and root guard.

  For more information, see Configuring Loop Prevention on AOS-CX.

• MultiEdit—Administrators can now view and edit configuration for multiple AOS-CX switches simultaneously using MultiEdit mode.

  For more information, see Using MultiEdit View for AOS-CX.

• Express Config—Administrators can now apply predefined set of configuration settings, such as NAE scripts and device profile to multiple switches.

  For more information, see Express Configuration on AOS-CX.

• Device Search—Search for AOS-CX switches in the Devices table in the MultiEdit mode using search queries, such as device attributes, wildcard characters, Boolean operators, and by grouping characters.

  For more information, see Using Device Search on AOS-CX.

Following are the switch configuration enhancements:

• SNMP—Administrators can now configure SNMPv3 on AOS-Switches. SNMPv3 uses authentication and privacy protocols to provide enhanced security.

  For more information, see Configuring SNMPv3 on AOS-Switches.

• Tunnel Node Server—Administrators can now configure user-based tunnel on switches from the Tunnel Node Server page. This allows the switch to tunnel traffic to an Aruba controller on a user-role basis or device basis.

  For more information, see Configuring Tunnel Node Server on AOS-Switches.

• Authentication—Administrators can now configure authentication order and priority for the authentication methods. This allows switch to authenticate the client requests sequentially.

  For more information, see Configuring Authentication Order and Priority.

• RADIUS—Administrators can now configure ClearPassClearPass is an access management system for creating and enforcing policies across a network to all devices and applications. The ClearPass integrated platform includes applications such as Policy Manager, Guest, Onboard, OnGuard, Insight, Profile, QuickConnect, and so on. Server from the RADIUS page. This allows you to enable the switch to download the user-roles from the ClearPass server.

  For more information, see Configuring RADIUS Server Settings on AOS-Switches.

•  Downloadable User Role—Administrators can now enable Downloadable User Role and configure ClearPass settings to download user-roles, policy, and class from the ClearPass Policy ManagerClearPass Policy Manager is a baseline platform for policy management, AAA, profiling, network access control, and reporting. With ClearPass Policy Manager, the network administrators can configure and manage secure network access that accommodates requirements across multiple locations and multivendor networks, regardless of device ownership and connection method. server.

  For more information, see Configuring Downloadable User Role on AOS-Switches.

• Routing—Routing configuration is moved from the IP Settings tab to the Routing tab.

  For more information, see Configuring Routing on AOS-Switches.

• DHCP Pools—DHCP Pools configuration is renamed to DHCP and moved from the IP Settings tab to the System tab.

  For more information, see Configuring DHCP on AOS-Switches.

• Aruba Central does not support adding pre-configured switches to a UI group. Pre-configured switches that have pre-assigned UI switch groups are added to the Unassigned Devices group. To provision a pre-configured switch to a UI group or move a switch from a template group to a UI group, complete the following steps:

  1. Clear the switch configuration.
  2. Delete the device from Aruba Central.
  3. Provision the switch as a new device in a UI group.

  For more information, see Configuring or Viewing AOS-Switch Properties in UI Groups.

• In Aruba Central, you can now manage Flexible modules and SFPThe Small Form-factor Pluggable. SFP is a compact, hot-pluggable transceiver that is used for both telecommunication and data communications applications. ports using UI groups if the AOS-Switch are running 16.10.0010 or later firmware versions.

  For more information, see Configuring Switch Ports on AOS-Switches.

Following are the configuration audit enhancements:

• Configuration Audit now displays local overrides and configuration differences in an improved UI. It displays the overrides in groups based on the configuration module where the difference exists. For example, any overrides in VLAN configuration is displayed under the VLAN drop-down.

• Failed/Pending Changes option has been renamed to Configuration Status.
• The Aruba Switches Configuration Audit Status report contains following changes:
  • The Status column no longer exists in the report.
  • The ERROR column is renamed to Pending Changes.

For more information, see Viewing Configuration Status.

The Aruba Central built-in AI Insights feature proactively identifies issues and provides configuration recommendations. Listed below are the new insights added in this release: 

• The pie chart data available in the cards within each insight type can be modified based on your requirement. To highlight specific entries in a card, click the checkbox next to each label. Additionally, a few cards have an expandable view option to view the graph.
• The insight detail tables are more interactive. The filter icon allows you to filter data in each table column. The and icons allow you to sort the columns in ascending and descending order.
• The Time Series Graph can now be modified. The entries in each time series bar can be customized to highlight a specific entry by clicking on it. Only one specific entry can be highlighted at a time.
• The Coverage Hole insight now shows uplink as well downlink SNRSignal-to-Noise Ratio. SNR is used for comparing the level of a desired signal with the level of background noise. issues in the network. It has been updated to include the SNR uplink or downlink failure percentage along with the failure reason and the recommendation to resolve the failure.
• The Outdoor clients are impacting Wi-FiWi-Fi is a technology that allows electronic devices to connect to a WLAN network, mainly using the 2.4 GHz and 5 GHz radio bands. Wi-Fi can apply to products that use any 802.11 standard. performance insight now provides information about the optimum Probe and Auth SNR threshold value per AP and per SSIDService Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network..

For more information, see the following:

• The AI Insights Dashboard
• Insights Context
• Cards
• Coverage Holes Identified
• Outdoor Clients Impacting Wi-Fi Performance

This release introduces the following enhancements to the Site > Topology tab:

• The Topology tab now displays the details about third party and Aruba-unmanaged devices available in your network. A new filter Third Party is introduced, to show or hide the third party and Aruba-unmanaged devices in the topology map. An Aruba-unmanaged device is an Aruba or an HP device that is not managed by Aruba Central.

• The Topology tab now includes an Unreachable Devices pane that provides information about the orphan and the offline third-party devices. A third-party device is considered to be an orphan when all its neighboring Aruba devices get deleted. A third-party device is considered to be offline when all its neighboring Aruba devices are offline.
• The Topology map now displays the third-party ZScaler, Azure, and AWS VPNC icons.
• The Topology tab now supports displaying the VLAN overlay details for AOS-Switch and AOS-CX switches.

For more information, see Monitoring Sites in the Topology Tab.

Following are the access point monitoring enhancements:

• Device Details Page

  The access point dashboard has the following UI parameter introduced as part of the Manage > Overview > Summary page:

  • WLANS—Aruba Central now displays a list of all SSIDs configured for the AP. When you expand an SSID in the WLANS table, you can view the additional information for 2.4 GHz, 5 GHz, and 5 GHz (Secondary) radios.
  • Health Status—Navigate to the Access Points overview dashboard, and click an AP listed under Device Name. In the Health Status graph of the AP Details page, the Poor Health Limit text indicates the poor health limit of the device in the network.

  For more information, see Access Point > Overview > Summary.

• The Channel Utilization graph indicates the percentage of channel utilization for the selected time range from the time range filter, and includes the following categories:
  • Transmitting
  • Receiving
  • Non-Wifi Interference
  • Total Utilization

  Navigate to the Access Points configuration dashboard, and click an access point listed under Device Name. In the access point dashboard context, click the RFRadio Frequency. RF refers to the electromagnetic wave frequencies within a range of 3 kHz to 300 GHz, including the frequencies used for communications or Radar signals. tab to view the Channel Utilization graph.

  For more information, see Channel Utilization.

   

The following existing pages in Aruba Central have been enhanced to show NAE Status for AOS-CXswitches:

• Switch > Overview > Summary—The Summary tab displays the NAE Status for the AOS-CX switch.
• Switches List View—The NAE Status column is added to the Switches table.

For more information, see Switch > Overview > Summary and Monitoring Switches in List View.

Aruba Central now enables you to monitor remote clients that connect to APs by using a VPNVirtual Private Network. VPN enables secure access to a corporate network when located remotely. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security, and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. connection.

• A new client type called Remote is introduced for clients that are connected through a VPN. You can view the details about the remote client type in the following pages:
  • Summary—The Remote Clients count is added to the Clients graph in the Summary tab at the Global context. For more information, see Global—Summary.
  • Client Details:
    • List view—The Remote column is added to the Client Summary bar and the value indicates the number of remote clients present in the network.
    • Summary view—The Remote column is added to indicate the number of remote clients connected to the network and Remote Bandwidth Usage is added in the Usage tab.
  • Remote client dashboard—Clicking on the remote client in the Client Details page navigates to the context dashboard. It consists of the Health Bar , Summary, Applications, Security, and Tools tabs. For more information, see Remote Client Details.

Aruba Central allows you to troubleshoot issues related to access points. The AP Live events feature is similar to client live troubleshooting, but in this case, we can enable live events at the AP level. Currently users can subscribe to Radio, VPN, and Spectrum events. For more information, see AP Live Events.

Two new columns namely the Global Unicast IPv6 Address and Link Local IPv6 Address are added to the client List and Details pages for the IAP wired and wireless client types. For more information, see All Clients.

The Manage > Clients page in the Network operations app introduces a new tab called Connecting. The Connecting tab enlists only wireless (IAP) clients whose connection to an AP is in progress. The following is the list of status changes that are monitored and displayed:

• If the client successfully connects to an AP, the client status is updated within 35 seconds in the List view under the Connected tab and you can then monitor the client under the Connected tab.
• If the client disconnects from an AP and goes offline, the client status is updated within 50 seconds in the List view under the Offline tab.
• The wireless clients that failed to connect to an AP is listed in the Failed tab .

The client connection status is only supported for clients connected to an AP running ArubaOS 8.6.0.5 or a later version and 10.1.0.0 or a later version. To know more about the Connecting tab in the Clients page, see Client Status Changes.

The parameters for a blocked wireless client is available in the Client Details and the List view pages under Manage > Clients, in the Network operations app. The parameters are different based on the type of blocking. For more information, see Blocking a Wireless Client

The Live Health Bar is a 15-minute session that is initiated when you click the client status icon next to the wireless client name in the Client Details page under Manage > Clients, in the Network operations app. A pop-up appears displaying the latest values that are updated every 5 seconds for the Connection status icon, Device Health, Signal Quality, Tx | Rx Rate, and Connected To parameters. After the 15-minute session of the Live Health Bar, the refresh icon appears. You may click the refresh icon to restart the session. You can also pin this window to the Client Details page. For more information, see Client Live Monitoring.

This release introduces the following enhancements to the Firmware dashboard:

• The Set Compliance option now includes a toggle switch that allows you to enable or disable the set firmware compliance.
• Upgrading all devices now includes the Site level support. You can upgrade all the devices using the Upgrade All option for a specific site or multiple sites. To upgrade all devices, in the global context, click Upgrade All option and select the sites from the Sites drop-down list.
• The firmware devices tab now includes a Site column that displays the site at which the devices are associated.

For more information, see Managing Software Upgrades.

Changing AOS-Switches firmware from latest version to earlier major versions is not recommended if the switches are managed in UI groups. For features that are not supported or not managed in Aruba Central on earlier AOS-Switch versions, changing firmware to earlier major versions might result in loss of configuration.

The following is a list of enhancements for the Reports module in Aruba Central:

• Generating a Report for Offline Devices—A new inventory report is introduced to generate the information about offline devices. The reports feature is available at Global > Analyze > Reports. Use the Infra Inventory report category with the Offline option to view the offline devices distribution by the device type in the PDF and list by the device type in the CSVComma-Separated Values. A file format that stores tabular data in the plain text format separated by commas. format.
• Generating a Report for Local Overrides for Devices—The Configuration & Audit report now contains the Override Devices Count column in the Configuration Audit Status, Aruba Switches Configuration Audit Status, and Virtual Controllers Configuration Audit Status tables to indicate the number of overrides for an AP. The status column is removed from the Aruba Switches Configuration Audit Status, Mobility Controllers Configuration Audit Status, and Virtual Controllers Configuration Audit Status tables.
• Summary report—Administrators can now configure a report to view the following data for a year:
  • Trends such as Unique clients per day, Clients per SSID, Unique client sessions per day, Average client sessions per day, Average clients per day, and Usage over time.
  • Top N Widgets such as Top clients by usage, Top OS by usage, Top APs by usage, Bottom APs by usage, Top sites by WLAN usage, and Bottom sites by WLAN usage. The Top sites by WLAN usage and Bottom sites by WLAN usage options are only available when you select All in the Groups context level. For Top N widgets, you can choose Top 5, Top 10, Top 25, and Top 50 widgets.

For more information, see Report Categories and Creating a Report.

This release introduces the Streaming API tab in the Account Home > Global Settings > Webhooks dashboard. Streaming APIApplication Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software. allows customers to subscribe to select set of services instead of polling the NB API to get an aggregated state or statistics of the events. Streaming API supports the following services:

• Audit
• AppRF
• Monitoring
• Presence
• Location
• Security

For more information, see Streaming API.

Following are the API changes and enhancements:

Label and Site API

• For [POST]/central/v2/labels/associations and [DELETE]/central/v2/labels/associations APIs, it is recommended not to add more than 50 devices at a time.
• For [POST]/central/v2/sites/associations and [DELETE]/central/v2/sites/associations APIs, it is recommended not to add more than 50 devices at a time.
• For creating a new Label, use the [POST]/central/v1/labels API with "category_id=1" as a parameter. To create a new site, use the [POST]/central/v2/sites API.

For more information, see Swagger.

Topology

Following APIs are introduced in the Topology category:

[GET]:

• /vlans/{site_id}
• /unreachableDevices/{site_id}

Following API is modified:

[GET]:

• /{site_id}

  For more information, see Modified APIs.

Access Points

Following APIs are introduced in the Monitoring > AP category:

[GET]:

• /monitoring/v2/bssidsBasic Service Set Identifier. The BSSID identifies a particular BSS within an area. In infrastructure BSS networks, the BSSID is the MAC address of the AP. In independent BSS or ad hoc networks, the BSSID is generated randomly.
• /monitoring/v3/aps/bandwidth_usage
• /monitoring/v2/aps/bandwidth_usage/topn
• /monitoring/v2/aps

Following APIs are deprecated:

[GET]:

• /monitoring/v1/bssids
• /monitoring/v2/aps/bandwidth_usage
• /monitoring/v1/aps/bandwidth_usage/topn
• /monitoring/v1/aps

  For more information, see Deprecated APIs.

Following API is modified:

[GET]:

• /monitoring/v1/aps/{serial}

  For more information, see Modified APIs.

The Label parameter in the new APIs supports only label filter request and returns empty result on site filter request. However, for the deprecated APIs, both the site and label filter request is supported in the Label parameter.

Network

Following APIs are introduced in the Monitoring > Network category:

[GET]:

• /monitoring/v2/networks
• /monitoring/v2/networks/{network_name}
• /monitoring/v2/networks/bandwidth_usage

Following APIs are deprecated:

[GET]:

• /monitoring/v1/networks
• /monitoring/v1/networks/{network_name}
• /monitoring/v1/networks/bandwidth_usage

  For more information, see Deprecated APIs.

The Label parameter in the new APIs supports only label filter request and returns empty result on site filter request. However, for the deprecated APIs, both the site and label filter request is supported in the Label parameter.

Client

Following APIs are modified in the Monitoring > Client category:

[GET]:

• /monitoring/v1/clients/wireless
• /monitoring/v1/clients/wired

  For more information, see Modified APIs.

Switch

Following APIs are modified in the Monitoring > Switch category:

[GET]:

• /monitoring/v1/switches
• /monitoring/v1/switches/{serial}
• /monitoring/v1/switch_stacks

  For more information, see Modified APIs.

Gateway

Following API is modified in the Monitoring > Gateway category:

[GET]:

• /monitoring/v1/gateways

  For more information, see Modified APIs.

Swarm

Following API is modified in the Monitoring >Swarm category:

[GET]:

• /monitoring/v1/swarms

  For more information, see Modified APIs.

Presence Analytics

Following API are removed in the Presence Analytics category:

[GET]:

• /presence/v1/config/thresholds
• /presence/v1/analytics/aggregates
• /presence/v1/analytics/trends
• /presence/v1/insights/top_sites
• /presence/v1/insights/bottom_sites
• /presence/v1/insights/sites/aggregates

[POST]:

• /presence/v1/config/thresholds

For more information, see Removed APIs.

Licensing

Following APIs are introduced in the New Licensing category:

[GET]:

• /platform/licensing/v1/subscriptions
• /platform/licensing/v1/subscriptions/stats
• /platform/licensing/v1/services/enabled
• /platform/licensing/v1/services/config
• /platform/licensing/v1/autolicensing/services/{service}/status
• /platform/licensing/v1/customer/settings/autolicense
• /platform/licensing/v1/msp/customer/settings/autolicense

[POST]:

• /platform/licensing/v1/subscriptions/assign
• /platform/licensing/v1/subscriptions/unassign
• /platform/licensing/v1/subscriptions/devices/all
• /platform/licensing/v1/msp/subscriptions/devices/all
• /platform/licensing/v1/customer/settings/autolicense
• /platform/licensing/v1/msp/customer/settings/autolicense

[DELETE]:

• /platform/licensing/v1/subscriptions/devices/all

• /platform/licensing/v1/msp/subscriptions/devices/all

• /platform/licensing/v1/customer/settings/autolicense
• /platform/licensing/v1/msp/customer/settings/autolicense

Following APIs are deprecated in the Deprecated Licensing category:

[GET]:

• /subscriptions
• /subscriptions/stats
• /services/enabled
• /subscriptions/assign
• /services/config
• /autolicensing/services/{service}/status
• /customer/settings/autolicense
• /msp/customer/settings/autolicense

[POST]:

• /subscriptions/unassign
• /subscriptions/devices/all
• /subscriptions/devices/all
• /msp/subscriptions/devices/all
• /customer/settings/autolicense
• /msp/customer/settings/autolicense

[DELETE]:

• /subscriptions/devices/all
• /msp/subscriptions/devices/all
• /customer/settings/autolicense
• /msp/customer/settings/autolicense

  For more information, see Deprecated APIs.

This release introduces the following enhancements to the Central Search bar:

Dynamic Search Suggestions

Aruba Central search is enhanced to provide dynamic search suggestions depending on the user journey in the app. The search suggestions guide you into getting started with Central, adding devices, assigning licenses to devices, creating groups and sites, and so on. For more information, see Dynamic Search Suggestions.

Search Cards for Clients, Devices, and Sites

Aruba Central search shows cards with additional information and options specific to the search context. You can click on the available options to navigate to that particular pages in the app. For more information on search cards, see Client Search Terms, Device Search Terms, and Site Search Terms pages.

This release introduces the following enhancements to the Floorplans feature:

• If you unassign licenses from IAPs, they are removed from the Floorplans and the deployed device-list. If you re-assign licenses to the IAPs, they are added back to the same Floorplan location and deployed device-list. Also, if the license auto-expires, the affected devices are removed, and the affected devices are added, only after the license is renewed.

• The navigation to the Floor plan dashboard from an AP is now improved. You can navigate to the floorplan for a specific site by using the floorplan available at the AP dashboard.

  To view the Floorplans page from an AP details page, complete the following steps:

  1. In the Network Operations app, set the filter to Global.
     The global dashboard is displayed.
  2. Under Manage > Devices, click Access Points.
     A list of APs is displayed in the List view.
  3. Click the Access Point name to view the Access Point Details page.
     If there are multiple APs connected to the network, click Online or Offline to filter the online or offline APs.
  4. Optionally, enter the AP name in the Device Name column and then click the AP.
     The Access Point Details page is displayed.
  5. Under Manage > Overview, click Floor Plan.
     The floor plan details for the highlighted AP is displayed.
  6. Click anywhere on the floor plan to navigate to the floor plan for a site with the AP highlighted.

  The floor plan details for the AP is only accessible for the devices that are assigned with license.

For more information, see About Floorplans.

The following enhancements are introduced in the Alerts & Events page:

• Site-Specific Email Notifications for Alerts—Aruba Central enables you to add specific email addresses for each site. You can now configure site-specific email addresses, so that alert notifications for each site are sent to the respective site administrators. Since the email notifications are differentiated based on the site, it is possible for site administrators to only receive those alerts which are pertinent to their sites. You can add up to ten email addresses for each site.

  To configure an email address for a site, select a site in Aruba Central and navigate to the Alerts & Events page. When you configure email addresses in the site dashboard, the email settings for the site configured in the global dashboard are ignored.
  For more information, see Configuring Site-specific Email Notifications.

• A new column, Elapsed Time is added in the Acknowledged Alerts table to show the timestamp difference between when a specific alert actually occurred and when that alert was acknowledged.

• The Events table offers additional details regarding events related to IAPs running ArubaOS version 8.5 or later. If you have an IAP running ArubaOS version 8.7 or later, the expanded text box for an event displays more data compared to a similar event generated for an IAP running an earlier version of ArubaOS.
• The following new Switch alerts are added:
  • Switch Uplink Port Usage— It generates an alert when the total uplink port usage of a switch at a site exceeds the configured value in gigabytes (GB) within a specified duration.
  • Switch NAE Status—It generates an alert when the NAE status for the AOS-CX switches exceed the Normal value.

  For more information, see Switch Alerts

• The following new AP alerts are added:
  • Radio Non WiFi Utilization— It generates an alert when the AP radio non-Wi-Fi utilization exceeds the threshold value.

  • AP Tunnel Down—It generates an alert when a single L3 tunnel is configured on the AP goes down.

  • All AP Tunnels Down—It generates an alert when all the L3 tunnels configured on the AP goes down.

This release introduces the Forward Error Correction (FEC) technology, with the ability to compensate any packet loss during traffic flow. This is achieved by inserting intermittent error recovery or redundant packets in the traffic flow. These redundant packets compensate for the lost packets when the link loss quality goes below the configured SLA limit. The uplink works until the packet loss reaches the FEC threshold beyond which the uplink is non-complaint. This feature is very useful for business-critical applications, since it improves the application’s performance across the WAN. This feature is configured as part of the Dynamic Path Steering (DPS) policy. The DPS policy provides WAN performance enhancements, with real-time traffic steering over broadband and MPLSMultiprotocol Label Switching. The MPLS protocol speeds up and shapes network traffic flows. links based on user-defined DPS policies. This feature complements DPS by overcoming the effects of dropped and out-of-order packets on the Internet connections.

As part of this enhancement, a new color coding in purple is introduced in the graph, which indicates that the uplink is compliant and it is FEC protected. The color code is displayed when you hover over the Compliance Summary chart in the Path Steering monitoring page. The new Application Performance tab displays three separate charts to view the performance of the application for QoE, Packet Loss, and Latency. You can further expand the Packet Loss chart to drill-down on the details.

The following figure displays an example for the FEC threshold.

For more information, see Gateway > WAN > Path Steering and Configuring Policies for Dynamic Path Steering.

Figure 3  FEC Threshold

From this release onwards, you can enable bandwidth contract per tunnel on both Branch Gateways and VPN Concentrators to provide equal bandwidth to all branches connected to a head-end.

To ensure that a VPNC is not overloaded with traffic from all the Branch Gateways connected to it, and to allow all branches to have a fair acces to the datacenter, ensure that the amount of traffic transmitted from a Branch Gateway or VPNC is configured with a maximum bandwidth threshold.

You can configure the maximum bandwidth threshold using the new Tunnel max bandwidth threshold field to specify the maximum transmit rate in percentage. For more information, see Configuring Uplinks.

From this release onwards, when using IP Next-Hop lists, Aruba SD-Branch gateways allow configuring two options for tracking. When configured with an IP address or a DHCPDynamic Host Configuration Protocol. A network protocol that enables a server to automatically assign an IP address to an IP-enabled device from a defined range of numbers configured for a given network.  default-gateway, gateways can either track the immediate next-hop or the IP/FQDNFully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. of the remote host defined as WAN Health Check. For more information, see Configuring Policies for PBR.

The following are the BGPBorder Gateway Protocol. BGP is a routing protocol for exchanging data and information between different host gateways or autonomous systems on the Internet. routing enhancements introduced for this release:

• This release introduces a new option for Route map configuration. Now, you have one more option called Community list added to the Option drop-down list. You can choose to Append or Delete this to the community attribute and define the rule. For more information, see Configuring Route Maps.
• Now, you can enable distribution of default information to the BGP neighbors. A default route is used to forward packets to networks that are not present in the local IP routing table.
• A check box to enable Default Information and a drop-down to select the Route Map are introduced to configure default route for BGP. For more information, see Enabling BGP.

Route redistribution enables routes learned from one routing protocol, to be advertised to another routing protocol. Route redistribution is very useful for multi-protocol networks. In the Aruba SD-Branch solution, if your corporate network is running on OSPFOpen Shortest Path First. OSPF is a link-state routing protocol for IP networks. It uses a link-state routing algorithm and falls into the group of interior routing protocols that operates within a single Autonomous System (AS). and you have multiple remote and home offices on IAP-VPN (called Micro Branches), you have the option to use route redistribution between the Micro Branch and the corporate office networks.

You can enable route redistribution from IAP-VPN overlay networks to OSPF networks by accessing the gateway configuration page for either a VPNC or a Branch Gateway.

To know more about configuring the related options for route redistribution and configuring OSPF routing, see Routes Advertisement Using OSPF.

From this release onwards, Aruba SD-Branch gateways advertise an aggregate route only when any of the summarized routes are present in the BGP routing table. For more information, see Advertising Networks to BGP.

From this release onwards, Aruba SD-Branch gateways are capable of redistributing a route to null into other protocols such as BGP or the SD-WAN Overlay (OAP). For more information, see Configuring Redistribution Rules for BGP Routes and Advertising Overlay Routes.

From this release onwards, Aruba SD-Branch gateways can apply route filters with attributes, to the connected routes that are aggregated, when redistributing to the SD-WAN Overlay. The route map applied to redistribution is also applied to aggregated and non-aggregated routes. For more information, see Advertising Overlay Routes.

The following are the Role-Based Access Control (RBAC) enhancements for this release:

• Privileged Configuration Option for Network Operations Role

  For creating or modifying a role for the Network Operations app, a new Network Management module is available for a configuration called Privileged Configuration. The Privileged Configuration option controls access to the Device(s) > Gateway(s) > System > Admin tab for both the gateway group dashboard and the gateway device dashboard. You can create a role to set the access to View Only, Modify, or Block.

  To access the option, perform the following steps:

  1. Navigate to Account Home > Global Settings > Users and Roles > Add Role.
  2. On the New Role page, select Network Operations.
  3. Scroll to Network Management.
  4. Click Customize to see the available modules under Network Management.

     The Privileged Configuration option is listed here.

     The available permissions for the Privileged Configuration option are View Only, Modify, and Block.

  For more information on creating roles set with different permutations of permissions, see Configuring User Roles.

• Roles to Access Users, Roles, and SSOSingle Sign-On. SSO is an access-control property that allows the users to log in once to access multiple related, but independent applications or systems to which they have privileges. The process authenticates the user across all allowed resources during their session, eliminating additional login prompts. Details for Account Home

  You can create a role for the Account Home page that controls access to the user details, role details, and SSO details available under Global Settings. The available permissions are View Only, Modify, and Block.

  The new roles available include the following:

  • Users—Defines a role for accessing the user details in the Account Home > Global Settings > Users and Roles > Users page.
  • Roles—Defines a role for accessing the role details in the Account Home > Global Settings > Users and Roles > Roles page.
  • SSO—Defines a role for accessing the Single Sign-On profiles details in the Account Home > Single Sign On page.

  To create the role, perform the following steps:

  1. Navigate to Account Home > Global Settings > Users and Roles > Add Role.
  2. In the New Role page, select Account Home.

     The Users, Roles, and SSO options are listed in this page.

  For more information on creating roles, see Configuring User Roles.

This release introduces the following enhancements.

SaaS Express offers several new monitoring options for predefined and custom SaaS applications. These options must first be configured.

• Monitor and Optimize options—This release introduces a new field called Mode to allow users to choose between Monitor and Optimize. Selecting Monitor gathers the uplink performance statistics and displays it in the monitoring dashboard, whereas selecting Optimize not only monitors but also optimizes the performance of the SaaS applications. This feature applies to the predefined SaaS applications. The probing frequency for Monitor mode is two probes for every 60 seconds, and for Optimize mode, it is two probes for every 10 seconds.
  To configure the feature, in the Network Operations app, select the Branch Gateway group dashboard, and navigate to Devices > Gateways > WAN > SaaS Express.
• Active Monitoring option—This release introduces a new column called Active Monitoring. Selecting this checkbox allows the users to only monitor the performance of the SaaS application. Users can view the performance scores in the monitoring dashboards.
  This feature applies to the custom SaaS applications. To configure the feature, in the Network Operations app, select the Global dashboard, and navigate to Manage > Applications > Config icon.

For more information about how to configure the new monitoring options, see SaaS Application Traffic Management with SaaS Express.

The following enhancements are introduced in the Guided Setup and Basic mode pages:

Configuring SaaS Express using Guided Setup

This release introduces support to configure SaaS Express using the Guided Setup. In the Guided Setup configuration page for a Branch Gateway group, go to Policies > DPS to configure SaaS policies.

To define custom policies, go to Global > Applications > SaaS Express > Config icon.

For more information about how to configure the new monitoring options, see Configuring Policies for a Branch Gateway Group.

Configuring DHCP IP Reservation Using Guided Setup or in Basic Mode

This release introduces support for reserving IP addresses in the DHCP pool to assign the same IP address to a client whenever it requests for a network connection. This feature which is already available in the Advanced mode can now be configured using the Guided Setup or Basic mode. For more information, see Configuring DHCP for LAN Interfaces.

Configuring PBR Policies in Basic Mode

Now, you can configure Policy Based Routing (PBRPolicy-based Routing. PBR provides a flexible mechanism for forwarding data packets based on polices configured by a network administrator.) policies to allow full-tunnel traffic to the data center or to a cloud service provider for further inspection. For more information, see Configuring Policy-Based Routing (PBR) Policy.

This release introduces the following new tabs under the SD-WAN Overlay tab:

• Global Settings—Allows you to configure the overlay ASAutonomous System An autonomous system is a single network or a collection of networks that is under a single administrative control. The routing devices in an Autonomous System generally use a single interior gateway protocol (IGP) for routing information. Routing between two Autonomous Systems is handled by the Exterior Gateway Protocols like BGP. number, timers, dynamic data center path computation, and dynamic backup route advertisement (DBRA).
• Group Orchestration—Allows you to enable group orchestration of gateways.
• Topology—Allows you to configure the hub and spoke, hub mesh, and branch mesh topologies.
• Network Segments—Allows you to add a new network segment.
• Route Aggregates—Allows you to aggregate routes for branches or VPNCs in data centers.

For more information, see Configuring Overlay Network Using SD-WAN Orchestrator.

The Overlay Tunnel Orchestration service is enhanced to support the SHA2-256 authentication method. This service creates IPsecInternet Protocol security. IPsec is a protocol suite for secure IP communications that authenticates and encrypts each IP packet in a communication session. tunnels with the SHA2-256 authentication method when both the tunnel endpoints are running SD-Branch 2.3.0.0 or a later version.

This release introduces the WAN Health—Transport dashboard to display the network health of all the uplinks belonging to an end-user. This dashboard monitors network health of all uplinks based on active monitoring probes, and helps in accessing information of all uplinks in one place to troubleshoot network issues.

For more information, see WAN Health—Transport.

The Gateway > Overview > Sessions page for the gateway dashboard now displays the DSCPDifferentiated Services Code Point. DSCP is a 6-bit packet header value used for traffic classification and priority assignment. value and the Priority value for each application listed under the Sessions section. For more information about monitoring the different gateway sessions, see Gateway > Overview > Sessions.

This release introduces the following enhancements.

The following new parameters are introduced for the SaaS Express monitoring dashboard.

• Filtering Applications—In the Global dashboard, under Manage > Applications > SaaS Express, you can now filter the applications which you need to monitor. If you do not select any application, the SaaS Express page displays data for all the configured SaaS applications.
• QoE and MOS Parameters—In the Gateway dashboard, under Manage > Applications > SaaS Express, two new columns are introduced, namely, Observed LANLocal Area Network. A LAN is a network of connected devices within a distinct geographic area such as an office or a commercial establishment and share a common communications line or wireless link to a server. QOE and Observed WAN QOE. A new parameter called the Mean Opinion Score (MOS) is also introduced in the graph of an application category.

For more information about the application filtering and the new monitoring parameters, see Monitoring SaaS Express .

The following are the BGP routing enhancements introduced for this release:

This release introduces a small red circle in the BGP monitoring page to indicate that the number of routes received by the BGP neighbor has exceeded the configured limit.

For more information, see Adding BGP Neighbors.

This release introduces the following enhancements to the Security > Firewall tab:

• For both the Global and Gateway dashboards, in the list view and chart view, the time range for historical firewallFirewall is a network security system used for preventing unauthorized access to or from a private network. activity is now, 3 hours, 1 day, and 1 week .
• For the Gateway dashboard, in the list view, the Blocked Sessions tab now includes a histogram that allows you to select and view the sessions data for a selected time range. This time range can be selected for a minimum of 15 minutes and maximum of 6 hours. Based on the time range selection, the histogram in the list view displays the blocked session data in the following time interval:
  • 3 hours—15 minutes time interval
  • 1 day—1 hours time interval
  • 1 week—6 hours time interval
• For the Gateway dashboard, the Blocked sessions table now includes the Blocked reason column that displays the cause of the blocked session.

For more information, see Gateway Firewall Logging.

This release introduces the following enhancements for gateway monitoring.

Application Visibility for the WAN Network

The Summary page for the gateway dashboard is now enhanced for application visibility related to the WAN network. The Summary page displays in-depth details about the usage of different applications per uplink. You can now see the WAN usage for the top 10 applications under the Usage section. For more information, see the WAN Interfaces section in the Gateway > WAN > Summary page.

VLAN Subnet Masks for Gateway > LAN > Summary Page

The Gateway > LAN > Summary page for the gateway dashboard now displays the subnet mask along with the IP address for the VLANs displayed in the VLAN Interfaces Summary table. For more information on the Summary page for LAN connections, see the Gateway > LAN > Summary page.

Control Connections Display in Gateway > Overview > Routing > Overlay Page

The Control Connections status is now displayed as either Up or Down in the Overlay Summary section of the Gateway > Overview > Routing > Overlay page. To know more about the Overlay network details, see Gateway > Overview > Routing > Overlay.

AWS VPCs and Azure VPN Gateways in Topology Tab User Interface

The Overview > Topology page for a site now displays the AWS VPCs and Microsoft Azure VPN Gateways integrated to SD-Branch through Cloud Connect service. For more information, see Monitoring Sites in the Topology Tab.

The following are the device enhancements in this release:

• Aruba SD-Branch gateways starting from version 8.7.0.0-2.3.0.0, no longer require additional reboot when they receive the controller IP from Aruba Central after the ZTPZero Touch Provisioning. ZTP is a device provisioning mechanism that allows automatic and quick provisioning of devices with a minimal or at times no manual intervention. process. Some services are restarted, resulting in an expected network impact, but the gateways do not reload for the second time. However, the gateways will reboot if there are any subsequent controller IP changes. For more information, see Connecting Aruba Gateways to Aruba Central.
• Aruba SD-Branch gateways with proxy-ARPAddress Resolution Protocol. ARP is used for mapping IP network address to the hardware MAC address of a device. enabled can now be configured to either respond to ARP requests with their own MAC or the MAC address of any client in the user table. For more information, see Configuring Other Parameters for VLAN.
• Aruba introduces support for 9012 and 9004 gateways to be deployed as VPN Concentrators. For more information, see Supported SD-Branch Components.
• When IDS/IPS is disabled for Aruba 90xx series gateways, the maximum session limit is increased from 64k to 128k sessions.

From this release onwards, Aruba Central allows configuring the Gateway IDS/IPS in SD-Branch gateways, in fail-open mode and in fail-close mode.

The following new Aruba Gateway IDS/IPS alerts are introduced in the Alerts & Events page:

• Gateway Threat Count— Generates an alert when the number of threats exceeds the configured limit in the given duration.
• Gateway Threat Count Per Signature— Generates an alert when the number of threats associated with a specific signature exceeds the configured limit in the given duration.

For more information, see Gateway Alerts.

The following are the enhancements for the Aruba 9004-LTELong Term Evolution. LTE is a 4G wireless communication standard that provides high-speed wireless communication for mobile phones and data terminals. See 4G. gateway:

• This release introduces a new network mode to enable selection of a custom 3GThird Generation of Wireless Mobile Telecommunications Technology. See W-CDMA. or 4G frequency bandBand refers to a specified range of frequencies of electromagnetic radiation.. For more information see, Managing 9004-LTE Branch Gateway.
• The following new event types are introduced in the Events table in the Alerts & Events page:
  • Cellular Mode Change—An event is generated when the network mode changes.
  • Cellular Data Usage—An event is generated at 75% of configured usage.
  • Cellular Connectivity—An event is generated when the WAN uplink interface is disconnected.
• This release introduces a new column in the Device Inventory page to display the IMEI number of 9004-LTE gateway. For more information, see Managing Your Device Inventory.

You can now use the Google Cloud Platform to deploy an Aruba Virtual Gateway in unmanaged mode. In the unmanaged mode, IT administrators bring up and configure the Virtual Gateway instance and monitor the deployed Virtual Gateway from Aruba Central. The Aruba Virtual Gateway requires the use of a supported Google Cloud instance with a minimum of 500 MbpsMegabits per second of throughput and the instance can support up to 1600 IPsec tunnels.

For more information on deploying a Virtual Gateway in Google Cloud Platform, see Deploying Aruba Virtual Gateways in Google Cloud Platform (Unmanaged Mode).

You can now deploy an Aruba Virtual Gateway in unmanaged mode in the MSP mode of Aruba Central. The MSP mode of Aruba Central enables a service provider to maintain and monitor different Aruba Central accounts belonging to different customers.

For more information on deploying a Virtual Gateway in MSP mode, see Deploying Aruba Virtual Gateways in MSP (Unmanaged Mode).

This release now introduces the following summary tabs for Virtual Gateways:

• Orchestrated—lists the automatically orchestrated managed devices.
  To view the Orchestrated tab, in the Network Operations app, select the Global dashboard, and navigate to Network Services > Virtual Gateways > Orchestrated. For more information, see Creating a Cloud Provider Account in Aruba Central.
• Manual—lists the manually orchestrated unmanaged devices.
  To view the Manual tab, in the Network Operations app, select the Global dashboard, and navigate to Network Services > Virtual Gateways > Manual. For more information, see Verifying the Deployment Status

This release introduces the SD-Branch integration with Microsoft Azure through the Cloud Connect service. As a result of which, you can set up a secure connection between the Aruba Virtual Gateways and the Microsoft Azure VPN Gateways.

The Cloud Connect service uses SD-WAN Orchestrator as the transport medium to send configurations to Aruba Virtual Gateways and establish direct communication with the Microsoft Azure VPN Gateways.

To integrate SD-Branch with Microsoft Azure through the Cloud Connect service:

1. Configure Microsoft VPN Gateway in Azure Admin Portal.
2. Onboard a Cloud Provider Account in Aruba Central.
3. Discover a Microsoft Azure VPN Gateway in Azure Admin Portal.
4. Orchestrate tunnels to connect Microsoft Azure VPN Gateway with Aruba SD-Branch Group.
5. Verify and monitor the Microsoft Azure VPN Gateway in the SD-WAN Site topology.

For more information on how to integrate SD-Branch with Microsoft Azure through the Cloud Connect service, see Aruba SD-WAN Integration with Microsoft Azure Public Cloud Tech Note and Integration with Microsoft Azure Public Cloud through Cloud Connect Service.

This release introduces the SD-Branch integration with AWS through the Cloud Connect service. As a result of which, you can set up a secure connection between the Aruba Virtual Gateways and the AWS Virtual Private Cloud (VPC) environments.

The Cloud Connect service uses SD-WAN Orchestrator as the transport medium to send configurations to Aruba Virtual Gateways and establish direct communication with the AWS VPN Concentrators.

To integrate SD-Branch with AWS through the Cloud Connect service:

1. Generate API token in AWS Console.

2. Onboard AWS accounts into Aruba Central through Cloud Connect service.

3. Orchestrate tunnel to the AWS VPC through Cloud Connect.

4. Verify tunnel status.

For more information on the steps to integrate SD-Branch with AWS through the Cloud Connect service, see Aruba SD-WAN Integration with AWS Public Cloud Tech Note and Integration with AWS Public Cloud through Cloud Connect Service.

In the Network Operations app, use the filter to select a group, label, site, or a device and then, select Analyze > Tools to use different troubleshooting tools. The Tools menu option enables users to troubleshoot AP, gateway, and switch issues in the network through various tests available in the Network Check, Device Check, and Commands tabs. Listed below are the troubleshooting tools enhancements, In this release:

• New Gateway Connectivity Tests—Apart from Ping Test and Traceroute, users can now diagnose gateway network issues with the following tests:
  • Ping Sweep Test—Performs an advanced check on the host reachability and network connectivity.
  • HTTPHypertext Transfer Protocol. The HTTP is an application protocol to transfer data over the web. The HTTP protocol defines how messages are formatted and transmitted, and the actions that the w servers and browsers should take in response to various commands. Test—Sends packets to the HTTP URL and tries to establish a connection and exchange data.
  • HTTPSHypertext Transfer Protocol Secure. HTTPS is a variant of the HTTP that adds a layer of security on the data in transit through a secure socket layer or transport layer security protocol connection. Test—Sends packets to the HTTPS URLUniform Resource Locator. URL is a global address used for locating web resources on the Internet. and tries to establish a connection and exchange data.
  • Speed Test (iPerf)—Performs a speed test to measure the network speed and bandwidth. To perform a speed test, you must provide the iPerf server address, protocol type, and speed test options such as bandwidth.
• Additional Tests Parameters—In the Network Check tab, additional parameters are introduced in the Show Additional Test Settings section to enhance the troubleshooting procedure for the following tests:
  • Ping Test—Sends ICMP echo packets to the hostname or IP address of the selected devices to check for latency issues.
  • HTTP Test—Sends packets to the HTTP URL and tries to establish a connection and exchange data.
  • HTTPS Test—Sends packets to the HTTPS URL and tries to establish a connection and exchange data.
  • TCPTransmission Control Protocol. TCP is a communication protocol that defines the standards for establishing and maintaining network connection for applications to exchange data. Test—Sends packets to the host, for example, FTP server, and tries to establish a connection and exchange data.
  • Speed Test (iPerf)—Performs a speed test to measure the network speed and bandwidth. To perform a speed test, you must provide the iPerf server address, protocol type, and speed test options such as bandwidth.

  The Show Additional Test Settings is not displayed when a Test type is not selected. You can now show or hide the Show Additional Test Settings section.

• Device check—This test is now available for gateways, and you can perform interface bounce and PoEPower over Ethernet. PoE is a technology for wired Ethernet LANs to carry electric power required for the device in the data cables. The IEEE 802.3af PoE standard provides up to 15.4 W of power on each port. bounce to check the PoE issues for the gateways available in the network.

  For more information about these enhancements, see Using Troubleshooting Tools.