Simple Six Steps: Intent-Based Self-Driving Day-1 Configuration for EX, QFX & CX in Mist

[YashNagaraju]

Simple Six Steps: Intent-Based Self-Driving Day-1 Configuration for EX, QFX, CX and MX in Mist

Step 0: Before you start

• Mist account and organisation. You need admin access at https://manage.mist.com/ with a Wired Assurance subscription.
• Network path to the cloud. A DHCP server must be reachable, and the firewall must allow TCP 2200 and TCP 443 between the switch and Mist.
• A code or a CLI session. New (cloud-ready) switches have a claim code under the QR code on the chassis. Switches already running (brownfield) need CLI or SSH access.
• A backup. If Mist will manage an existing switch, save its current Junos OS (EX) or AOS-CX (CX) configuration first, because Mist becomes the source of truth.

CX stacks: if the CX switches form a Virtual Switching Framework (VSF) stack, finish auto-stacking first. Onboarding supports only VSF stacks in a ring topology.

Step 1: Get the switch into your Mist inventory (onboarding)

Pick the path that matches your switch. All three end with the switch listed on the inventory page.

Path A: New cloud-ready EX switch (claim)

1. Connect an Ethernet cable from any traffic (revenue) port on the switch to your local network, then power it on.
2. Find the alphanumeric claim code printed above the QR code on the switch. If you bought several switches, use the activation code that came with your purchase order.
3. In the Mist portal, go to Organisation > Admin > Inventory > Switches and click Claim Switches.
4. Enter the claim or activation code.
5. Select Manage configuration with Mist and enter a root password. This becomes the root password on every claimed switch.
6. Click Claim. The switch contacts Mist through zero-touch provisioning (ZTP) and appears in the inventory.

For a single switch you can instead scan its QR code with the Mist AI mobile app.

Path B: Existing EX or QFX switch (adopt)

1. Back up the current Junos OS configuration.
2. In the Mist portal, open the inventory and click Adopt Switches. In the Switch Adoption window, keep the EX/QFX option selected.
3. Copy the CLI command that Mist shows.
4. Log in to the switch, enter configuration mode, paste the command, and run commit.
5. Back in Mist, confirm the switch shows up on the Inventory page.

Path C: Existing CX switch (adopt)

1. Back up the current AOS-CX configuration.
2. In the Switch Adoption window, select the CX option and copy the registration code (use the copy button).
3. Log in to the CX switchover CLI or SSH and apply the registration code exactly as Mist displays it.
4. Confirm the switch appears on the inventory page.

If you choose to manage configuration with Mist on a CX switch, management from HPE Aruba Networking Central is switched off automatically. Pick one platform per switch to avoid conflicting configuration.

Step 2: Site Creation & Device Assignment

Mist requires devices to be assigned to a site before applying global templates and policies.

1. Navigate to Organisation > Site Configuration > Create Site

2. Provide site details (name, country, time zone, notes, and location) and click Save 

3. Go back to Organisation > Inventory, select all onboarded switches, and choose the newly created site from the dropdown

4. Enable Mist Managed Configuration to allow Mist to push and manage device configurations

Step 3: Assigning Device Roles

Mist uses device roles, names, or models to apply conditional configuration rules via templates.

1. In the site inventory, select a switch and click More Options > Assign Role 

2. Assign roles according to your topology

   • Core Switch Role: Assigned to the QFX/EX/CX core switch

   • Access Switch Role: Assigned to the remaining EX/CX access switch

Step 4: Creating the Global Switch Template

The template acts as a single source of truth for both switch platforms.

1. Navigate to Organisation > Switch Template > Create Template 

2. All Switch Configuration (Operational Baseline): Configure global settings applied to all associated switches (authentication servers, DNS, Radius, SNMP) 

3. Management Section: Configure admin passwords, login banners, configuration rollback timers (default is 10 minutes), local users, and site time zones

4. Shared Elements (VLANs / Networks): Define reusable VLANs (e.g., VLAN 10 for Users, VLAN 20 for Voice, VLAN 30 for Camera, VLAN 40 for Guest). Initially, these sit in the Unused Network List until mapped to port profiles

5. Port Profiles:

   • Click Add Profile, name the profile (e.g., Camera Network), and set the Product Family EX + CX so it applies to both platforms 

   • Assign the respective VLAN and configure port modes, speed/duplex, and edge port settings

   • Note: Once a profile is created and mapped, the corresponding VLAN moves from the unused list to the user network list

Step 5: Defining Switch Configuration Rules (Intent-Based Rules)

Conditional rules determine how configuration is applied based on switch roles.

1. Navigate to Switch Configuration rules within the template

2. Access Switches Rule:

   • Set the product family to EX (or CX), apply via Switch Role (access), and map the specific port range to the required port profiles/VLANs

3. Core Switches Rule:

   • Create a rule for the core switch role and map the comprehensive set of VLANs and port profiles required for core operations

4. Click Save. Mist provides a pre-save verification preview showing added/removed configurations

Step 6: Assigning the Template to the Site & Verification

1. Select the created template, click Assign to Sites, choose your target site, and apply the configuration

2. Mist evaluates device roles and automatically pushes platform-appropriate syntax to each switch (Junos for EX, AOS-CX for Aruba CX)

3. Verify Configurations:

   • EX Access Switch: Verify VLANs and port mappings match the access role 

   • CX Access Switch: Verify scoped access-layer VLANs

   • CX Core Switch: Verify core-layer VLANs, banner settings, user configurations, and full port mappings

Happy selling EX, CX, QFX and MX! 

Thank you.

Yash Nagaraju,

Director, Technical Marketing Engineering

Campus and Branch, HPE Networking

[Thaufique_Mod]

Thanks for posting this informative topic. It is very useful.