HomeGuidesAPI Reference
GuidesAPI ReferenceGitHubAirheads Developer CommunityLog In

Deploying Devices

Provisioning devices with groups, templates, and variables

Let's start with the anterior workflow, the deployment of devices with Aruba Central. The example workflow illustrated below consists of four steps:

  1. Creating a new template group
  2. Uploading a template to the group
  3. Adding variables for the devices
  4. Assigning the devices to the group


Template mode is not available with AOS-10. The workflow highlighted here is for AOS-8 based devices.


This is an example workflow; as such it is intentionally prescriptive and tailored to fit a certain scenario. The Ansible modules used in this workflow each provide additional capabilities to suit various deployment scenarios. Instead of following the prescribed steps, you could alternatively, for example:
i. Clone an existing template group
ii. Update an existing template
iii. Update or replace variables for devices


For more information on the capabilities of each module, please look at the module documentation in our Github repository. The documentation for each module covers the module's capabilities in depth.

Workflow Prerequisites

  1. Aruba Central Ansible Role installed as outlined on Using the Aruba Central Ansible Role
  • Devices imported beforehand into Central by Activate

Creating a Group

Firstly, we'll create a template group. This task uses the central_groups module which is used to create a template group for wired and wireless devices.

- name: Create a new group
        action: create
        group_name: new-group
          group_password: admin@12345
            wired: True
            wireless: True


The attributes wired: True and wireless: True in the template_group dictionary indicate that the created group is a template group using templates for both wired and wireless devices.

Adding a Template

Step two is to upload a template to the group. In order to do this, we'll create a template file and write an Ansible task to upload it.

An example template for an AOS-Switch device is shown below. Note that some information in the template, namely the SHA-1 hash of the admin user's password, has been redacted.

AOS-S template

hostname "%_sys_hostname%"
no cwmp enable
password manager user-name "admin" sha1 "xxxxxxe75asddfdaf415cxxxxxxfe21axxxx"
timesync ntp
ntp unicast
ntp server-name "time.google.com" iburst
ntp enable
time timezone -420
ip client-tracker
interface 1
   name "To_SW2"
interface 24
   name "Uplink_BGW"
snmp-server community "Aruba123" unrestricted
snmpv3 engineid "%_sys_snmpv3_engineid%"
vlan 1
   name "Management"
   untagged %_sys_vlan_1_untag_command%
%if _sys_use_dhcp=1%
   ip address dhcp-bootp
%if _sys_use_dhcp=0%
   ip address %_sys_ip_address% %_sys_netmask%
   ipv6 enable
   ipv6 address dhcp full
vlan 20
   name "Employee"
   tagged 1-2,5-9,24
   no ip address
vlan 30
   name "Guest"
   tagged 1-2,5-9,24
   no ip address


All non-templated, parametrized CLI text in the template must exactly match the running configuration syntax. As such, the indentation of CLI text in the template should match the indentation in the running configuration. All CLI text in the template is case-sensitive.

A recommended best practice is to perform validation of the configuration input on the device CLI prior to adding it to the template.

In addition to creating the template, we also need to create the task to upload it. This task uses the central_templates module to upload a template text file by specifying its local path:

- name: Upload a new template file and create a new template for a given device type 
      action: create
      group_name: new-group
      template_name: aos-sw-temp
      device_type: ArubaSwitch
      version: ALL
      model: ALL
      local_file_path: /home/admin/sw_template.txt


The examples shown for the above step apply to AOS-S devices. You can upload templates for AOS-CX switches and access points as well. Module documentation, as previously mentioned, and specifically that for the central_templates module, will provide the pertinent information.

Access Point Template


Template mode is not supported with AOS-10. Sample template below is for an AOS-8 device.

As part of this workflow, we're also deploying an access point. An access point template is provided below (again, with certain values censored); it is left as an exercise to the reader to create the additional task to upload this template!

virtual-controller-country US
virtual-controller-key fdxxxxxxzzzzzzyyyyyda0542c660a35xxxxxxxxx8
name %vc_name%
openflow-server host internal2-ofc.central.arubanetworks.com tcp-port 443
openflow-server tls-enable
ntp-server time.google.com
clock timezone Pacific-Time -08 00
clock summer-time PDT recurring second sunday march 02:00 first sunday november 02:00
rf-band all
ams-identity xxxxxxxx689723993xxxxxxxxx5bbfaxx
report-rssi-to-central unassociated-and-associated-clients
allowed-ap aa:aa:aa:aa:aa:aa
allowed-ap bb:bb:bb:bb:bb:bb
allowed-ap cc:cc:cc:cc:cc:cc
allowed-ap dd:dd:dd:dd:dd:dd
allowed-ap ee:ee:ee:ee:ee:ee
 wide-bands none
 a-channels 52,56,60,64
 g-channels 6
 min-tx-power 9
 max-tx-power 127
 band-steering-mode prefer-5ghz
 air-time-fairness-mode default-access
rf dot11g-radio-profile
 max-distance 0
 max-tx-power 9
 min-tx-power 6
 disable-arm-wids-functions off
 free-channel-index 40
rf dot11a-radio-profile
 max-distance 0
 max-tx-power 18
 min-tx-power 12
 disable-arm-wids-functions off
syslog-level warn ap-debug
syslog-level warn network
syslog-level warn security
syslog-level warn system
syslog-level warn user
syslog-level warn user-debug
syslog-level warn wireless
hash-mgmt-user admin password hash 11111111111111111f1c4xxxxxxxxxxxxxeb2bd3f632xxf29e35xxxxxx08ezzzz
wlan access-rule default_#guest#_
 index 0
 rule alias licdn.com match tcp 443 443 permit
 rule alias twimg.com match tcp 443 443 permit
 rule alias bam.nr-data.net match tcp 443 443 permit
 rule alias js-agent.newrelic.com match tcp 443 443 permit
 rule alias symcb.com match tcp 80 80 permit
 rule alias symcd.com match tcp 80 80 permit
 rule alias digicert.com match tcp 80 80 permit
wlan access-rule default_wired_port_profile
 index 1
 rule any any match any any any permit
wlan access-rule wired-SetMeUp
 index 2
 rule any any match udp 67 68 permit
 rule any any match udp 53 53 permit
wlan access-rule %ssid_name%
 index 5
 rule any any match any any any permit
wlan ssid-profile %ssid_name%
 index 1
 type employee
 essid %ssid_name%
 wpa-passphrase xxxxxx1111xxxzz1111fb2bzzzzz1880ba4fxxxxx1aca2222
 opmode wpa2-psk-aes
 max-authentication-failures 0
 vlan 20
 auth-server InternalServer
 rf-band 5.0
 captive-portal disable
 dtim-period 1
 broadcast-filter arp
 dmo-channel-utilization-threshold 90
 local-probe-req-thresh 0
 max-clients-threshold 64
auth-survivability cache-time-out 24
wlan auth-server AS2_#guest#_
 radsec port 443
 ip naw2-elb.cloudguest.central.arubanetworks.com
 port 1812
 acctport 1813
 timeout 20
 nas-id 7xxxaaeaa1-xxcx-111z-11x1-0xxxxxx99zz
wlan auth-server AS1_#guest#_
 ip naw2.cloudguest.central.arubanetworks.com
 port 1812
 acctport 1813
 timeout 20
 nas-id 77xxxaaeaa1-zzcx-111z-11x1-0xxzzzxx99zz
wlan external-captive-portal
 server localhost
 port 80
 url "/"
 auth-text "Authenticated"
wlan external-captive-portal default_#guest#_
 server naw2.cloudguest.central.arubanetworks.com
 port 443
 url "/portal/scope.cust-xxxxxxxx11111111zzzzzzzzz1111111/default/capture"
 auth-text ""
 wireless-containment none
wired-port-profile wired-SetMeUp
 switchport-mode access
 allowed-vlan all
 native-vlan guest
 no shutdown
 access-rule-name wired-SetMeUp
 speed auto
 duplex auto
 no poe
 type guest
 captive-portal disable
 no dot1x
wired-port-profile default_wired_port_profile
 switchport-mode trunk
 allowed-vlan all
 native-vlan 1
 access-rule-name default_wired_port_profile
 speed auto
 duplex full
 no poe
 type employee
 captive-portal disable
 no dot1x
enet0-port-profile default_wired_port_profile
 enforce none
 failover-internet-pkt-lost-cnt 10
 failover-internet-pkt-send-freq 30
 failover-vpn-timeout 180
airgroupservice airplay
 description AirPlay
airgroupservice airprint
 description AirPrint
airgroupservice DIAL
airgroupservice remotemgmt
airgroupservice AmazonTV
airgroupservice allowall
airgroupservice googlecast
airgroupservice itunes
airgroupservice sharing
airgroupservice chat
airgroupservice "DLNA Print"
airgroupservice "DLNA Media"
 per-ap-settings %_sys_lan_mac%
  hostname %hostname%
  zonename %zonename%

Setting Variables

The next step of this workflow is to upload device-specific variables so that they can be used to render the template into actual concrete running configurations to be applied to the devices.


Unlike a template, which belongs to a group, variables are associated with a device, irrespective of which group to which the device belongs.

There are two approaches to adding variables:
i. Adding variables for one device by specifying its serial number
ii. Adding variables for multiple devices using a JSON file wherein each device has a dictionary containing its variables and values.

Because this workflow performs an initial rollout for multiple devices, it makes sense that we employ the second approach to upload variables for our devices.

The example JSON file shown below is a variables file containing variable definitions for an AOS-S switch and an access point. Note that each key in the overarching dictionary is a device's serial number, and the corresponding value is a dictionary containing the device's variable definitions in a key-value format. Like with the example templates before, certain values here have been redacted.

    "_sys_serial": "CNXXXXXXXD",
    "_sys_lan_mac": "aa:aa:aa:aa:aa:aa",
    "_sys_gateway": "",
    "_sys_hostname": "SW1",
    "_sys_ip_address": "",
    "_sys_module_command": "module 1 type jl261a",
    "_sys_netmask": "",
    "_sys_oobm_command": "",
    "_sys_snmpv3_engineid": "00:00:00:0b:00:00:b8:83:03:d5:fc:a0",
    "_sys_stack_command": "",
    "_sys_template_header": "; JL261A Configuration Editor; Created on release #WC.16.08.0003\n; Ver #14:27.6f.f8.1d.9b.3f.bf.bb.ef.7c.59.fc.6b.fb.9f.fc.ff.ff.37.ef:04\n",
    "_sys_use_dhcp": "1",
    "_sys_vlan_1_tag_command": "",
    "_sys_vlan_1_untag_command": "1-28",
    "community": "Aruba123",
    "dhcp": "true",
    "dns": "",
    "gw": "",
    "ip": "",
    "mask": "",
    "ntp_server": "time.google.com",
    "test": "0",
    "timezone_seconds": "-420"
    "_sys_lan_mac": "bb:bb:bb:bb:bb:bb",
    "_sys_serial": "CNYYYYYYYD",
    "ssid_name": "Employee-test",      
    "vc_name": "Instant-AP-VC",
    "hostname": "IAP-1",
    "zonename": "Ground-Floor"


The variables _sys_lan_mac and _sys_serial are mandatory and must be included in every template and in every device's variable definitions.

In addition to defining our variables file, we'll need a task to upload the variables file. This task uses the central_variables module:

- name: Create/set template variables for all/multiple devices using a JSON file   central_variables:
    action: create_all
    local_file_path: /home/admin/variables.json

Moving Devices to a Group

Lastly, to provision our devices, we'll move them into the group that now contains the appropriate templates. The act of moving devices takes them out of one group and places them in another. When the device is placed in a template group with an applicable template, the template is automatically applied, and the variables associated with the device are used in conjunction with this template to seamlessly deploy the resultant running configuration to the device.


When a device is imported into Central, it is automatically placed in the default group.

In general, it is recommended that a device is moved to a newly created group after the group contains the applicable template and all the variables parametrized in the template have been defined for the device.

This task example uses the central_devices module to move devices to a group using their serial numbers.

- name: Move devices to a group
        action: move_devices
        group_name: new-group
          - CNXXXXXXXX
          - CNXXXXXXYY

Success and Debrief!

And that's it! If you've followed this tutorial as directed, your playbook should contain five tasks.

To summarize briefly, the requisite conditions for successful device deployment are that :

  1. a template group for the device type (i.e. wired or wireless) exists
  • the template group contains a template applicable to the device
  • the device has variables associated with it
  • the device is situated in the template group

What’s Next