Cloud Managed Networks

Hello,

Just new to Aruba Central. We have a small network with 2 x 3810m stacked and 3 stacks of 2930fs.  I configured the network using CLI before the Central licence arrived and all was good.  Everything working. This is a staged deployment so no actual users yet.  
I added the switches to ACentral to the default group.  After a firware update pushed out by Central I can no longer manage the switches via cli.  It seems like a completely restricted command set.

I did notice that if i took the switches offline from central full access was available again.   Is this normal ?

example:

CORE(config)# conf t
Invalid input: conf
CORE(config)# int
Invalid input: int                                                                                                                                                                         
CORE(config)# int
Invalid input: int                                                                                                                                                                         
CORE(config)# interface vlan 100
Invalid input: interface
CORE(config)# wr mem
Invalid input: mem
CORE(config)# 

Any advice guys ?

------------------------------
Andrew Brown
------------------------------

Yes, that is normal. When switches are managed by Central, your local configuration is restricted because any changes you make will be immediately overwritten by the Central configuration at the next push.

If for some reason, you need to do local configuration while connected to Central, you can use the command:

# aruba-central support-mode enable​

What you see is expected. And it is well possible that earlier firmware did not have that check if central is connected

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Hello Team,

Thanks lot for your reply.

Helped me out. 


Best reg,
Umangish

------------------------------
Umangish Chumun
------------------------------

Original Message:
Sent: Mar 01, 2021 03:22 AM
From: Herman Robers
Subject: Firmware upgrade and now restricted CLI commands

Yes, that is normal. When switches are managed by Central, your local configuration is restricted because any changes you make will be immediately overwritten by the Central configuration at the next push.

If for some reason, you need to do local configuration while connected to Central, you can use the command:

# aruba-central support-mode enable​

What you see is expected. And it is well possible that earlier firmware did not have that check if central is connected

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

You can use the command-line interface (CLI) to install software updates. to data during the update, you can use the force flag to override this restriction.

------------------------------
Fraser Watts
------------------------------

Thanks for the reply guys.   Just so used to banging out configs manually !    Got to grips with the Aruba setup and must say very impressed.  Old dog new tricks :)


------------------------------
Andrew Brown
------------------------------

Original Message:
Sent: Mar 17, 2021 12:40 AM
From: Fraser Watts
Subject: Firmware upgrade and now restricted CLI commands

You can use the command-line interface (CLI) to install software updates. to data during the update, you can use the force flag to override this restriction.

------------------------------
Fraser Watts
------------------------------

This is unacceptable in our network.

Here's how it should work:
Pull the config from the switch, compare to template.
Every time.
Report the result.

The product is just not usable to manage switches yet.

------------------------------
john Stigall
------------------------------

I would suggest that you reach out to your local Aruba SE and discuss this. The way it is designed, blocking local configuration when managed by Central, works for most cases. You obviously don't like it, but allowing local configuration that is overridden by a centralized management platform and reversed at the next sync, is probably worse. Or I don't understand what you want, because what you describe is exactly what happens. Template is the 'desired config', and is compared to the running config, then changes are pushed to the switch config.

Many engineers are used to build manual configs, but at scale that will not work and having both central and local control will make it unmanageable, at least at scale. It will require a different way of working from the network admin. And as mentioned before, if you need to test some local commands, enter central support mode and do whatever you want. Just be aware that when you disable that mode, all changed not committed in the central configuration are reverted.

As mentioned, please speak to your local Aruba team to get the options explained and find what is working for you and if features need to be added they can feed that into the product development process as well.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Original Message:
Sent: Apr 21, 2021 01:41 PM
From: john Stigall
Subject: Firmware upgrade and now restricted CLI commands

This is unacceptable in our network.

Here's how it should work:
Pull the config from the switch, compare to template.
Every time.
Report the result.

The product is just not usable to manage switches yet.

------------------------------
john Stigall
------------------------------

Original Message:
Sent: 4/23/2021 3:03:00 AM
From: Herman Robers
Subject: RE: Firmware upgrade and now restricted CLI commands

I would suggest that you reach out to your local Aruba SE and discuss this. The way it is designed, blocking local configuration when managed by Central, works for most cases. You obviously don't like it, but allowing local configuration that is overridden by a centralized management platform and reversed at the next sync, is probably worse. Or I don't understand what you want, because what you describe is exactly what happens. Template is the 'desired config', and is compared to the running config, then changes are pushed to the switch config.

Many engineers are used to build manual configs, but at scale that will not work and having both central and local control will make it unmanageable, at least at scale. It will require a different way of working from the network admin. And as mentioned before, if you need to test some local commands, enter central support mode and do whatever you want. Just be aware that when you disable that mode, all changed not committed in the central configuration are reverted.

As mentioned, please speak to your local Aruba team to get the options explained and find what is working for you and if features need to be added they can feed that into the product development process as well.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------