Cloud Managed Networks

Any hints in Audit logs if sync was at least attempted? 

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

Looks like we need to wait for next release. Should we open TAC case or put this into Innovation zone?

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

Any hints in Audit logs if sync was at least attempted? 

Best, Gorazd

My understanding is that a role can be created only at Global scope for now.

Also, roles are not provisioned to the device until there is a security policy associated with the created role.

https://arubanetworking.hpe.com/techdocs/new-central/content/get-started/cx-cfg.htm#CreatRole

Looks like we need to wait for next release. Should we open TAC case or put this into Innovation zone?

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

Any hints in Audit logs if sync was at least attempted? 

Best, Gorazd

THANK YOU! - I have tested all the combinations of your statement, and even though the documentation says:

Note:

A role can be created only at Global scope. If you create a role at any other scope, HPE Aruba Networking Central will display error with a failed message.

That is not actually the case. You can create library based roles and only assign them at lower levels of the hierarchy - they will still sync to the switch IF you respect the second part of your statement, that policies needs to be associated as well. The documentation also states that - along with negating the Global only assignment that it said previously.

Note:

• Roles are not provisioned to the device until there is a security policy associated with the created role.

• You can create user roles and policies at lower hierarchy. Navigate to the appropriate hierarchy (Site Collection, Site, Devices, or Device Group and select the Device Function (Access Switch) from the drop-down list to create roles and the relevant user role policies.

 The trick is:

In my testing I had several roles created which had security policies assigned. But even though the role was assigned to switches, the polices were not (they were only assigned to access points). This is the reason they did not sync. After manually assigning the policies to access switches as well, they sync'ed.

My other testing was of a Role meant to assign the proper uplink config of a LLDP device group (device identity profiles) that detects AP's. That role has no need of a policy, so It did not sync because of that. After assigning a pointless any/any policy to the role it synced, and my device identity profile started working as well.

Good catch, and thank you.

My understanding is that a role can be created only at Global scope for now.

Also, roles are not provisioned to the device until there is a security policy associated with the created role.

https://arubanetworking.hpe.com/techdocs/new-central/content/get-started/cx-cfg.htm#CreatRole

Looks like we need to wait for next release. Should we open TAC case or put this into Innovation zone?

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

THANK YOU! - I have tested all the combinations of your statement, and even though the documentation says:

Note:

A role can be created only at Global scope. If you create a role at any other scope, HPE Aruba Networking Central will display error with a failed message.

That is not actually the case. You can create library based roles and only assign them at lower levels of the hierarchy - they will still sync to the switch IF you respect the second part of your statement, that policies needs to be associated as well. The documentation also states that - along with negating the Global only assignment that it said previously.

Note:

• Roles are not provisioned to the device until there is a security policy associated with the created role.

• You can create user roles and policies at lower hierarchy. Navigate to the appropriate hierarchy (Site Collection, Site, Devices, or Device Group and select the Device Function (Access Switch) from the drop-down list to create roles and the relevant user role policies.

 The trick is:

In my testing I had several roles created which had security policies assigned. But even though the role was assigned to switches, the polices were not (they were only assigned to access points). This is the reason they did not sync. After manually assigning the policies to access switches as well, they sync'ed.

My other testing was of a Role meant to assign the proper uplink config of a LLDP device group (device identity profiles) that detects AP's. That role has no need of a policy, so It did not sync because of that. After assigning a pointless any/any policy to the role it synced, and my device identity profile started working as well.

Good catch, and thank you.

My understanding is that a role can be created only at Global scope for now.

Also, roles are not provisioned to the device until there is a security policy associated with the created role.

https://arubanetworking.hpe.com/techdocs/new-central/content/get-started/cx-cfg.htm#CreatRole

Looks like we need to wait for next release. Should we open TAC case or put this into Innovation zone?

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

Thank you for your testing! This is good to know. 

THANK YOU! - I have tested all the combinations of your statement, and even though the documentation says:

Note:

A role can be created only at Global scope. If you create a role at any other scope, HPE Aruba Networking Central will display error with a failed message.

That is not actually the case. You can create library based roles and only assign them at lower levels of the hierarchy - they will still sync to the switch IF you respect the second part of your statement, that policies needs to be associated as well. The documentation also states that - along with negating the Global only assignment that it said previously.

Note:

• Roles are not provisioned to the device until there is a security policy associated with the created role.

• You can create user roles and policies at lower hierarchy. Navigate to the appropriate hierarchy (Site Collection, Site, Devices, or Device Group and select the Device Function (Access Switch) from the drop-down list to create roles and the relevant user role policies.

 The trick is:

In my testing I had several roles created which had security policies assigned. But even though the role was assigned to switches, the polices were not (they were only assigned to access points). This is the reason they did not sync. After manually assigning the policies to access switches as well, they sync'ed.

My other testing was of a Role meant to assign the proper uplink config of a LLDP device group (device identity profiles) that detects AP's. That role has no need of a policy, so It did not sync because of that. After assigning a pointless any/any policy to the role it synced, and my device identity profile started working as well.

Good catch, and thank you.

My understanding is that a role can be created only at Global scope for now.

Also, roles are not provisioned to the device until there is a security policy associated with the created role.

https://arubanetworking.hpe.com/techdocs/new-central/content/get-started/cx-cfg.htm#CreatRole

Looks like we need to wait for next release. Should we open TAC case or put this into Innovation zone?

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

Any hints in Audit logs if sync was at least attempted? 

Best, Gorazd

For Campus Access point:

Another finding is that when you create an SSID , then there is automatically created a role with the name of the SSID with a policy allow_all attached.

Thank you for your testing! This is good to know. 

THANK YOU! - I have tested all the combinations of your statement, and even though the documentation says:

Note:

A role can be created only at Global scope. If you create a role at any other scope, HPE Aruba Networking Central will display error with a failed message.

That is not actually the case. You can create library based roles and only assign them at lower levels of the hierarchy - they will still sync to the switch IF you respect the second part of your statement, that policies needs to be associated as well. The documentation also states that - along with negating the Global only assignment that it said previously.

Note:

• Roles are not provisioned to the device until there is a security policy associated with the created role.

• You can create user roles and policies at lower hierarchy. Navigate to the appropriate hierarchy (Site Collection, Site, Devices, or Device Group and select the Device Function (Access Switch) from the drop-down list to create roles and the relevant user role policies.

 The trick is:

In my testing I had several roles created which had security policies assigned. But even though the role was assigned to switches, the polices were not (they were only assigned to access points). This is the reason they did not sync. After manually assigning the policies to access switches as well, they sync'ed.

My other testing was of a Role meant to assign the proper uplink config of a LLDP device group (device identity profiles) that detects AP's. That role has no need of a policy, so It did not sync because of that. After assigning a pointless any/any policy to the role it synced, and my device identity profile started working as well.

Good catch, and thank you.

My understanding is that a role can be created only at Global scope for now.

Also, roles are not provisioned to the device until there is a security policy associated with the created role.

https://arubanetworking.hpe.com/techdocs/new-central/content/get-started/cx-cfg.htm#CreatRole

Looks like we need to wait for next release. Should we open TAC case or put this into Innovation zone?

Best, Gorazd

The audit log clearly states that the Role is assigned in the heirachy, by nothing is synced to to switch. i have tried additional changes as well as leaving the switch powered off/boot again to force a complete configuration sync, and it says everything is peachy - there is just no roles on the switch

Any hints in Audit logs if sync was at least attempted? 

Best, Gorazd