End-Customer Owns Both Devices and Subscriptions But MSP Manages (Deployment Model 2)

HPE Aruba Networking recommends that you contact your HPE Aruba Networking Central sales representative or the HPE Aruba Networking Central Support team if you are an MSP proposing this model to your end-customer.
Please contact your HPE GreenLake sales representative or your HPE HPE Aruba Networking account manager to enable this feature in your HPE GreenLake workspace. Managing tenants who own devices and subscriptions is an allow-listed feature.

In this model, the end-customer owns both the devices and subscriptions, but the MSP manages the end-customer's network. MSP can use the HPE Aruba Networking Central MSP mode to have the capability of managing the tenant who owns both devices and subscriptions. Managing tenants who own devices and subscriptions is an allow-listed feature.

Setup and Provisioning

The end-customer purchases the devices and subscriptions. The end-customer contacts the MSP to manage the network. As the devices and subscriptions are owned by the end-customer, MSP requires to set up and provision the tenant account.

MSP can use HPE Aruba Networking Central MSP mode to have the capability of managing the tenant who owns both devices and subscriptions. Managing tenants who own devices and subscriptions is an allow-listed feature. The HPE Aruba Networking Central MSP mode functionality enables the seamless onboarding of devices and subscriptions into the tenant workspace. For detailed instructions on creating a new tenant account, please refer the HPE GreenLake Edge to Cloud Platform User Guide .

In the HPE Aruba Networking Central MSP dashboard, the total device count, device trends data is based only on the MSP Managed Service Provider. The Managed Service Provider (MSP) mode is a multi-tenant operational mode that Aruba Central accounts can be converted into, provided these accounts have subscribed to the Aruba Central app. owned devices and subscriptions allocated to Customers.
The MSP Reports data is based on the MSP owned devices and subscriptions.

Monitoring and Reporting

MSP provides Network as a Service to end-customers in a single pane view using HPE Aruba Networking Central MSP mode. HPE Aruba Networking Central provides simplified provisioning and monitoring. The MSP administrator manages the tenant network, performs device management and monitoring using the HPE Aruba Networking Central MSP dashboard.

Managing Firmware and Maintenance

The MSP have the option to use the Firmware menu under Maintain to view the latest supported firmware version of the device, details of the device, and the option to upgrade the device for all tenant accounts. The MSP administrator has to manage software upgrades for each end-customer individually.

Example Deployment Scenario

In this scenario, an MSP has to configure Instant APs and manage end-customer networks at two different sites. The following are the site details:

Site 1

Location: University Ave, Berkeley, CA Certificate Authority or Certification Authority. Entity in a public key infrastructure system that issues certificates to clients. A certificate signing request received by the CA is converted into a certificate when the CA adds a signature generated with a private key. See digital certificate.SSID Service Set Identifier. SSID is a name given to a WLAN and is used by the client to access a WLAN network. Name: “WiFi_CE” Security: WPA2 Wi-Fi Protected Access 2. WPA2 is a certification program maintained by IEEE that oversees standards for security over wireless networks. WPA2 supports IEEE 802.1X/EAP authentication or PSK technology, but includes advanced encryption mechanism using CCMP that is referred to as AES.-PSK Pre-shared key. A unique shared secret that was previously shared between two parties by using a secure channel. This is used with WPA security, which requires the owner of a network to provide a passphrase to users for network access. SSID Password: “password@123” VLAN Virtual Local Area Network. In computer networking, a single Layer 2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them through one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN, or VLAN.: 20

Site 2

Location: University Ave, Berkeley, CA SSID Name: “WiFi_CE” Security: WPA2-PSK SSID Password: “password@123” VLAN: 40

Considering the requirements, each site needs two Instant APs. The only difference between the sites is the VLAN ID.

Deployment Using User-Defined UI Groups

The MSP can configure Instant APs at both sites using user-defined UI groups. As the Wi-Fi Wi-Fi is a technology that allows electronic devices to connect to a WLAN network, mainly using the 2.4 GHz and 5 GHz radio bands. Wi-Fi can apply to products that use any 802.11 standard. configuration per site is different, one UI group must be created for each site.

For each site, the tenant account administrator has to do the following:

  1. Create a new UI group for each site.
  2. Configure the UI group with Wi-Fi settings specific to each site.
  3. Map the Instant APs in each site to the respective UI group.

Points to Note:

  • One user-defined UI group is created for each site.
  • For any new site with a different VLAN ID, the tenant account administrator must create a new UI group.
  • If a configuration change is required at all sites, the tenant account administrator must manually edit each UI group as each group is independent of the other. For example, to change the Wi-Fi SSID name from WiFi_CE to WiFi_Secure_CE, the tenant account administrator must edit UI group.

Deployment Using Template Groups

The MSP can configure Instant APs at both sites using template groups. The tenant account administrator can create a single template group for both sites with a variable file that differentiates the VLAN setting per device.

Template groups are not supported at the MSP level. However, template groups can be defined and managed at each tenant account individually.

For both sites, the tenant account administrator has to do the following:

  1. Create one tenant template group.
  2. Configure the newly created template group by uploading a base configuration with the WiFi_CE setting and a variable for the SSID VLAN.
  3. Upload a variable file with unique entries for each Instant AP. For the Instant APs part of Site 1, the VLAN variable value is 20. For the Instant APs part of Site 2, the VLAN variable value is 40.
  4. Map Site 1 and Site 2Instant APs to the common template group.

Points to Note:

  • One tenant template group is created for both sites.
  • For every additional site with a different VLAN ID, the same template group can be used with a modified variable file.
  • If a configuration change is required at all sites, the common template group can be updated and pushed to all sites. For example, to change the Wi-Fi SSID name from WiFi_CE to WiFi_Secure_CE, the tenant account administrator can edit the common template group and push the configuration changes to all sites.