Simplify Network Management with HPE Aruba Networking Central

My name is Doby Spiner within HP Aruba. I'm, um, I'm CTO and Vice President for the System Engineers, which is our pre source people for Europe, middle East and Africa. So, and as you probably notice, I'm the only one, probably non-native English speaker.

I'm living in the Netherlands, so it's my first time face to face, so it's nice to be here. And I will talk a little bit about our, um, our journey or actually our evolution of the, of Aruba Central and what we have been doing in the platform. So when you start looking at the industry in general, I think many times you'll see this table stake aspirations, right?

Things like, oh, it needs to be simple or it needs to be zero trust, or it needs to be done with ai. It needs to be automated done from the cloud. So I think this is many things that I see in the industry, but when we are discussing with customers, actually we can see, and with our partners, we can see different challenges in the enterprise space.

And a few things in there is one of the things is, for example, domain fragmentation. You can see that security and networking are brewing a little bit more together. People need to get more knowledge.

You see different vendors or maybe transformation times within enterprise organizations where they have the skill shortage or it's hard to attract young people. So you see that we getting into this fragmentation. Then the other side is policy inconsistency.

I think it's key now to have a single policy engine and not to have multiple dashboard because it's easy to make a mistake. It's in the mistake can be maybe potentially a security issue or can just be something not working. So I think we need to be consistent with our policies and making sure that every flow where the packet goes to the network adds security as part of that game.

Then the other one is experience gaps. And the experience gaps is a little bit mixed. What we hear from enterprises and one is the experience the network operators or the security operators get from the platform or the management tooling that they have.

The other one is from the BU's out there. So how can you make sure you can start adding sensors without adding a whole new project or waiting for a couple of weeks or months in order to allow these sensors on the network from an IOT perspective. So that's where we drive the experience gaps.

High cost operations is not so much that we, the budgets are increasing, but we are demanding more and more from the networking infrastructure and we want more security in, there needs to be quicker. We need to embed IO OT on, on top of it. And this is, this is some of the words by the way, where you really notice I'm not a native English speaker because we are now getting some of these acronyms in this community.

That's really hard for me. But data serenity where we think about where in the world and there's different parts in the world. If you take a country like Germany, they're very specific laws or you take critical infrastructures across the world where we need to hold the data locally or it's just by the intellectual property that they wanna keep on premise if you are a manufacturing company for example.

So I think that's the reason why you see that trend towards that one. And then the other one is vendor lockin. I think many enterprise organizations don't want to have a vendor lockin or want have a dual vendor strategy.

So that's actually the real challenge is that we see in those infrastructures. And what we are trying to do for some time is the first step, and I get back to it, why we have been on this journey is the first thing we did is unifying that wireless solution since 2017 by a single operating system and making sure that we can cover every use model from tunnel mode to bridge mode to micro branch with a little bit of, let's say policy based routing kind of functionality that you can integrate it with SAZ. And this way you can define per user, per SID, how you will steer the trafficking infrastructure in one single operating system.

I get back to that one, why we did this. Then the second step we did is in 2019 is by unifying the wire infrastructure and it started with doing the same role-based policies and role-based access, same application visibility and recognition on wire as we do on wireless. So we recognize more than 3,800 applications on both of them and we can take control of them.

That's one thing. The top, the next step on that one was also, now these days fabrics get really important, right? In particular multi-site fabrics.

Fabrics in one thing, fabrics, uh, integrated with SD branch or WANs application. So EVPN VXLAN has been also added with the same operating system across the full switch portfolio. On top of that, and again, I got back on that one, why we have been doing this one, the last step actually was on top of that we had to come with a common operation model and that common operation model had to serve all these enterprise challenges.

And the first step James was doing that, we have to be enabled to deliver that whatever any organizations want, and many organizations want to consume it from the public cloud, but there's also a lot of organizations, maybe they have a skill shortage, maybe they don't wanna deal with level one or level two or the full blown. So some of them wanna consume it as a managed platform or as a manager of some of them even go further and go full blown networking as a service. And then the last two, and this has been a, been a pretty engineering challenge journey whilst getting the cloud also in the same operational model on-prem.

And so it's the same software code where you can run it on-prem or you can run it from the cloud. So now you can choose whatever you want to do or even maybe mix in certain organizations, certain use cases. From a connectivity perspective, we want to make sure that we deliver infrastructures that follow the users or the devices.

So anywhere where your network needs to be and for some of that is maybe pure wifi or only switching, but even for others it could be, I have private settler kind of recognition. So we embed that all in that same platform so that you can deliver the network where you want it to be. Policy, I think we see the network as a security sensor and everything we do, everything that packet touch of it from wireless to wired, from from core switching to access, switching up to SD branch or SD WAN needs to be part of that distributed security because I think 85% of this infrastructure, maybe 90 is HT TPS traffic.

So we need to make sure that we have inter intersect security and everything we do. And that's what you can see it started at the edge because at the edges where people are being connected to the infrastructure is where data is being generated. I think it's IOT devices are getting connected, plus we are consuming the application in that perspective.

And then the last part is about experience. It's about experience, making sure that we got the right network and operator experience, and also for the security admins, including how can we onboard IOT devices and x-ray, which we see later in the, in this particular session. So what I wanna do now is I wanna focus a bit more on demonstrations.

I think seeing is believing. So let's hope everything is working and I'm not logged out. But what I'm going to do is a, a couple of demos and I will lead it in one of the demos is the reason why we have been driving this unified architecture and now come with something I think unique in the industry, which is a unified configuration model and it's truly unified.

The next step is what about unified experienced twins? So how can you do troubleshooting easier and get better visibility in the network infrastructure? And then you heard James talking about agen ai.

That's by the way another special term for me. But agen AI is is the other one where we wanna focus on showing you what we mean with it and what it does for the industry. So on this, on this policy model, I'll stand still a little bit what we saw with during overtime and the journey of creating these decentral platforms.

Some people like to use the ui, some people like to use this CLI, some people like to use the API or templates kind of approach. And what we said is that it's hard to figure out what people really need. So we need to make sure that we give you a model that you can do anything.

So that's step one. You can choose CLI, you can choose API, you can choose the ui, but we also wanna make sure that we do it unified. And that means is you should not be worrying if you push a role, you want to create a role for the network infrastructure and if it goes to an ap, if it goes to a gateway or maybe to a switch, you should actually not worry about it.

You want push that role and we need to understand what the config looks like. And that's where you get this central yang model where we will able, okay, where you want to push it and we will dump it for you on that infrastructure and I will demo that and then it should be scalable into all the infrastructure we do, right? Simple architectures, role-based access, maybe full blown dynamic segmentation or EVPN, vxlan, wireless wire gateway.

So that's roughly where it should work. So what I want do now is do a demo and let's see if this will go well. Can you see the screen?

Okay, this is the network overview dashboard of uh, HP Aruba Central. Now I need to get rid of this screen. So you can see here there's a little sun in there and if I click on this one, I get to the configuration overview and in the top level where you can see the orange bar states library, and in that library section, I can start to create profiles, not only configuration profiles like vlan as IDs or all these other, but I can also start pushing roles.

I can start adding named object or start configuring services that we will have in that infrastructure. But let's go back to the profile. Everything we can do here.

So let's give an example of an authentication server. So I want to configure an authentication server in the network, say ClearPass for example, and I configure a server, which you normally would do is you should configure, uh, it on the switch. You should configure it on the ap, on the gateway, or you'd maybe need to do it in multiple UIs.

So you need to put it in device siloed approach. What we say, what I can do here is I can start opening up this one and you can see this one is already pre-configured. I can show you an MP one also if you want, but there's an IP address.

You can add the full qualified domain name to it, the shared secret. So you get the, the, the parameters that you normally fill in for, uh, for, uh, uh, for a radio server. And then you can see here something specific because we do know that maybe for a gateway or maybe for a switch, for example, if I will select that particular switch here, you can see, okay, maybe I wanna do this from within a certain VRF in the infrastructure, if I have that, uh, macro segmentation in there.

So I will, I will leave it like this, but you can see the parameters in order that you can add specific, uh, specific device parameters to it. So you would also be possible if I, oh, I have my screen in here in front of me. Let me remove that.

So I'll exit this one. If I create a new profile, uh, I can for example also ox or you, you get the point. And even below here you can see, again, I can get specific parameters for a specific device persona.

Now you create the library and you can create in the library any profiles that you want. It is not assigned to anything. What we did was, I think many times in the industry we are using hierarchical information, right?

Most of the times it's going from north to south. So you have global, maybe you have Americas and you have maybe a region in America, and then India you have sites. But what we also see is that people are not only interested in north side, north south, but also east west flexibility and configuration.

It's actually more the flexibility in configuration that they want than just pure hierarchy. So what you see here, if I assign something to global, then it means anything and everything in my infrastructure will use this maybe an NTP server. But if you are a global organization, you maybe use, uh, uh, a certain, uh, authentication server in, in the, the European region, maybe Americas and maybe in a PJ.

So you maybe then wanna build site collections, right? Where you can add sites to it. So you can combine multiple sites, but we can also assign it to a single site or we can sign it to a device group.

So for example, all my um, 7 35 aps I'm going to assign this to and the other ones will do this. And then there is one interesting one. You can see the line here.

There is device groups. Um, I'm going to make Jared very happy now, but in the device groups, you can for example say, let's say I want to have a specific ASIS ID in all my lobbies, then I can assign that as a i in the lobby, and then more or less that's the east west or horizontal kind of flexibility. Or maybe in my outdoor wifi in my warehouse, I want to have a different RF profile.

So that's, that's what you can do here. So now I go back to, to the profile management, back to the authentication server, and I can start to assign this. So, and here you can see that we separate device functions and we have scopes.

So in device functions you have access switch, aggregation, ship code, switch mobility, access point, mobility gateway. If I select or deselect anything, then that will not be pushed to that particular device persona or device function. Then when you do that, you add the scope.

So then this, this hierarchy comes back in. So you can put it on global, you can put it on East Wests security. So now if I then start to assign that, what will happen is to the devices that I've been assigning it to plus to the scopes I've been assigning to, they will all get this configuration without going into all these individual CLI or all the individual, uh, individual, uh, individual dashboards for example, or UIs or templates that you need to create.

I think this will save time also makes it much easier from a skill perspective to start managing this. And I think it is truly unified. So Any questions around this one?

So with this, like on the left you've got API, graphical c, LI, everything that you just showed was graphical the same idea apply for CLI and API, Same thing. You can push it also via API, for example, the profile and do the same thing in that one. So you can pick and choose whatever kind of operational model you want, but you speak to the same yang model where it goes through and you can drive the same personas, scopes and everything.

I did it, it's a bit, a bit easier to do, show it in visually, but I think it's the same thing. So you can pick and choose because that's the reason we don't know anymore what end users want. Some have very high skilled, uh, programmers that, that built their own API automation tool.

Uh, and some just want to use the ui. So if, if you're using a combination of those, is there a way for like, like say somebody pushes a template that applies a configuration and someone else goes in and type something from the CLI, is there gonna be a a conflict? Are they gonna know about each other or, So CLI will will handle it, but everything that you do via the API, let me start before you get his mic.

Sure, sure. Everything you do via the c uh, via the API will also show up in that ui, right? So you know that it is being configured.

Uh, we have also role-based access and now we'll hand over to clan to provide, uh, the answer. So clan, by the way, let me introduce him. He is, uh, he is our, uh, my partner in crime to be honest actually he's the brains of our company, but he is my, uh, uh, my, my he is our PLM for the the central solution, Right?

So, uh, very quickly, uh, there is a common configuration database. It's represented in YANG models. And so when you write from an API, it writes into the same yang model that you write from A CLI or from a ui.

Okay? This is, this is a special thing. So that's why we have a resolution mechanism which basically kind of prioritize it's, uh, first in first out or first whatever.

Uh, is the last in in the database in the configurations, uh, is the the final one. Okay, appreciate that. Yeah, because that, because an issue that we've seen with some other platforms that are, that are not yours is that when when somebody applies it through their centralized management and then someone else goes in and does ACL I, they have, they don't know about each other.

They're ships in the night and the next configuration could potentially be a problem because one of 'em not aware of those updates that were made. Yeah. And so a com common config, that's a, it's a, it's a big thing.

It Was a big journey for us also, right? And that's also why we did the unifying that underlying infrastructure very well with more or less two complete the same operating system that are a hundred percent API based. So this gives us the possibility to start building these young models on top of it and really do things unified Transactional.

Is there transactional support and roll backs? Yeah, there is. Yep.

And even backup and uh, Checkpoints and yeah, With, with respect to the unified architecture piece that um, you're talking about, I know some of in the past with across the different deployment models was fragmentation across features that I'm assuming based on this being unified. Now we're saying that whether it's on-prem cloud, you know, on, you know, private cloud, it's fully unified across the board, all feature sets are available. Yeah, all except for some of AI functionalities.

Okay, because uh, which yeah, you need sometimes more data, but in general we covered almost all feature set main differences within the ai. Yeah. Then, uh, let's move to the next demo.

It's our UniFi Unified Experience Twins. And there is two parties here. So let me explain, for those that don't know, UXI stands for User Experience Insight, which is a sensor which you most of the times try to put at the same height of the wall and you can do synthetic testing or real testing.

Our applications are being used, but I think the good thing about the sensor is that it is statistically always the same data, plus you test the last mile. If you do a lot of testing from the ap, you always miss the RF more or less part of the last mile. Uh, and the other one is also the sensor is now also available, uh, as a software agent for Mac, uh, or for MacBooks for example, or for Android.

So you can, uh, for Windows. So you can also use it as a software agent. So you can start doing testing Office 365 or some other applications in there.

The other pathogens you can see here on top of it is very more or less using the network also as a sensor to collect a lot of telemetry data about the clients. Who are the clients, what applications are they consuming, what is the latency? And so now we can start combining this and making sure that we really start to understand where things are going wrong in the networking infrastructure.

So let me go to that demo again. So now if you are here, we are in this, uh, the central dashboard space. So I can for example, start to type, uh, show me box application application users that will give me an overview of all the users that will use the application box.

Then let me focus on the Miami side. Let's say I got a, I caught a call from Miami where we have some maybe delay or latency in the application. Now I can go to the site application and then here, let me filter on one day and do on box.

So now you can see here that the box application is being used. Uh, when I then select box, it gets pretty interesting. You can see that we have some UXI sensors monitoring this, but it could be any client that is using this application here.

I can even, if you want, we add added, oh, uh, I have this zoom thing here. Uh, customize. You can even start at WLAN Mac.

You can start filtering information that is important for you. But now you can see here the application performance in UXI. So app application performance, I can hoover over, I can see the throughput, I can see which clients or how many clients are consuming this application.

I can see some end-to-end latency. And of course when I have a gateway, I can also see the client to gateway latency. This is all coming from aps, uh, from APS and an infrastructure component that are sending a telemetry data to h hp, Aruba Central.

So this is like, let's say you have this by nature in the product, right, to monitor this. But let's say if you also have user experience inside, then you got an other tap here. And this is more or less where you can start seeing the, the, the test data, the in-depth test data coming from, uh, from the sensors.

And now in this particular case you can see hey there is some long latency there around 500 milliseconds and still on that one. Now you go to um, to a separate desk wire. I already went in here for the sake of time, but what I did is there was a high alert in that one on the box application and test.

And now you can see here that okay, there is some long latency, but I think is really cool is this one, this is the part analysis and let me zoom in a little bit, but I can hoover over now every tap and you can see even the autonomous system number, you can even see, uh, the DSCP value that if there was being checked on those one. You can see here, this is Aruba, Aruba, Aruba, and bang, we go to level three. By the way, I didn't know what level three was, but I figured out that it was a service provider.

But you can see the autonomous system number in there is United States. And we had rewritten a specific tool because many of the normal trace route tool and everything are not able to identify ECMP. You can see here there's multiple route and you can figure out during 500 milliseconds, but even takes a snapshot after where it was running around and it was a 90 millisecond.

So I think this way it's really helping you to get pick apart. If I do explore parts, by the way, uh, skip this one, I got a little bit bigger view and you can even start to filter down different application and how we, how that are operating in the infrastructure. So I think this is One of the challenges I've seen with a lot of these tools is that increasingly, you know, the traffic may be in A VPN or going off to a third party, you know, security enforcement, you know, and so it's in a tunnel.

We can't see the actual path underneath. Is there anything you guys are doing around that? Yeah, We do.

So we, we know what the end application is because it can do to the sensor. We, we can figure out what the end password. We can also see the VPM by the way.

And we send birth to every individual hop. So sometimes you can see that there is a little bit like latency here, but that's because it average out in every of these individual hops. So we are not using trace route or anything else.

It's really our own type of development. So, so what about like a Zscaler and Netscope that's, you know, if they're caping all the traffic sitting there, we lose all that visibility from, from that clientele, it gets to those guys. Yeah, So to, I don't know if I have an example actually with, I can check for you later if I have an example on that one.

'cause from my own laptop, I'm also connected to XS SAZ, which is our own, let's say as a ZZ scaler type solution. I can check for you on that one. Any other questions on this one?

So when you, like how you had the before, during, and after Yep. Is how, how are you defining what is before and after? Yeah, so what it does, we constantly test and then, uh, we test that roughly every five minutes and more or less, if it is an, uh, within a certain barrier, we take a snapshot, uh, and then we keep on testing, take a snapshot, take a snapshot so we know when it is wrong within that five minute barrier.

That's then during, and we have the snapshot from before, then we keep on testing again. If it is good, we, we know that it is after. Okay, so it's not just like, this was at one o'clock, this was at 1255.

Yeah, you can See the time. You can slide it in our window, but it's almost like five minutes because if you do it too much, then you can consume bandwidth or yeah, you also testing on too many, but It's the, that before, during, and after is actually looking at, it's not just the next test or the previous test, it's here's where it was bad, this one. Exactly.

Yeah, Good. This is when it was and then It's average out of all these tests roughly. Yeah.

Good. So let me close this one. Let's go back to the presentation.

So this was, uh, this was then the u user experience, uh, twins. Then let's go to ai. And I think this industry likes to talk about AI ML and everything that we do on it, but I think it's what James said, it's a matter about the outcomes and how we can simplify it.

If you're looking at AI, telemetry drives AI to be honest, and that's why some of the things we can do in the cloud and some of the things we cannot do on-prem, for example, but at the moment we have around 6 million devices connecting to our HBO Aruba Central Cloud. We have 3 billion unique client in there, roughly about 200, uh, 200 customers is divided. We have a lot of data scientists.

Um, there's many patterns that we hold on, on data. There's a lot of things that we do in there to drive that, uh, that innovation. The telemetry comes from many different angles.

It can be from threat detection network, it just plain, uh, user overview and the common angles, and it lands on what we call the GreenLake Central Data Lake. And on top of that, we can do this different ai. And let me continue a little bit in what, um, what James was talking about.

Traditional AI for us was, for example, where we could do NLP. So natural language search and, and asking the data like I did with show me the box application users. Then the next step, the generative AI actually.

So if you, if you look at traditional ai, traditional, I was really good in analyzing, you know, you know, I'm, I'm predicting actually that something was wrong in a larger data set or maybe even was good also, but then the generative AI was able to start creating content and was able to start giving you more meaningful and creating content out of that data. But I think generative was still like, like reactive or at least you need a prompt or a communication with an end user in order to start, uh, to start getting meaningful, uh, meaningful data out of it. Now the next thing is, this is another agentic AI in the agentic ai, you, I always compare agentic AI is you have now the possibility to start doing reasoning and start doing, uh, actions by itself.

I always give the example, if you maybe wanna wanna book a, wanna book a flight in a gen generative ai, you ask, okay, I want to go here. And then you got some example, do you think it's good? What is the weather?

But you are the one prompting the system. Now with agen ai you can say, okay, I want to go to Spain, I want to go that time. This is roughly the price I wanna pay.

And you can figure it out and book the travel for you. I think that's, I always like that, give that example to put perspective. So now let's put this in perspective from a networking, uh, from a networking slash security kind of idea.

So if I go one slide further is what we have is we have specialized agent, we roughly have a little bit more than 15 specialized agents. And over time we will probably add, there's a difference between real time agent that can, can collect directly information and sometimes that's why you also need to wait for an answer if it is really probing and pinging directly real time information. And then we also have knowledge.

Knowledge can, for example, be okay, look in our documentation or look in our, uh, tech database for example, if there is something going on or maybe wrong with a certain combination of clients or something like that, that all communicates with an autonomous orchestrator. And then the dashboard that the user sees is a network co-pilot. And we will see that in a second.

That's where you can start asking questions and start prompting things that goes to the agent and he knows, okay, I need to go to the document search agent, or I need to go to the real time device agent, something like that. And then combined, they will give you an answer. So that's roughly how this will look like.

But if you have here, this was in a, in an engineering cluster here you will get a network pilot. I will visualize you what's going to happen. You have a network pilot there and you can click on it and then you get see it like a little bit like you have a chat, GPT, you got a, you got an interface where you can start communicating.

And then I can start asking questions like, okay, show me the gateway that last joined our Roseville side and including, I wanna see the parts and connectivity on top of it. Then it'll give you an overview. It'll start to reach out.

Can for example take sometimes like between 40 and 50 seconds because I need to figure out, okay, it starts to understand the content, the reasoning, okay, I need to go to Roseville site, I know it is a gateway, I know it needs to join the site. And then it start to create connectivity and parts on top of this. And then when it does that, it's also start to create that part in the same way as we view it from an HP Aruba central perspective.

So that's one thing. And the other thing, maybe it's there now let me try again to refresh it. I don't know why it's not there.

Okay, so something is wrong there. The other thing that can do is, that's more or less still where I prompt the agent and get the information for the network. It starts to create, it starts to reasoning and can get additional content, but we also have a lot of insights and in the inside they can now become autonomously.

So for example, I can have an insight where I look which clients don't support 8 0 2 11 are roaming, although it support some of the other amendments out there. And I can start to figure out that these clients are running on the network and the agent can then start to collect the data automatically and starts to give you a prompt that hey, we see this issue. Then when you click on that issue, you, you can follow up, you can see all the data, which clients it are, what is the reason, what is the impact, which sites, and then it can even start to add the thing.

Do you want to solve it maybe by disabling 11 R on this particular entity or maybe by creating a new study. But then you also, you make, make sure that the clients of course will connect to that study and you can say yes, you can schedule it or you say, okay, I will do it later. And then it automatically starts to close loop actually functions for you.

Then one thing, one last thing, uh, I want to show you is that remember that James told you about, um, about multi-vendor operability and it's, I think it's a, it's a thing in the infrastructure now, if you can look here is we can now with, uh, with some of the, some of the, the systems we have in, uh, in uh, in the networking environment. For example with the ops ramp acquisition, I think third party management is always a big thing in the industry because to do not to get vendor lockin to get a single pane of glass to maybe do a transition, there's no big band migration anymore. What we did here is, let me see if I can get the site for you, Mexico, for example, you can go to the network and then you can see here that we are monitoring, monitoring, reporting, troubleshooting a Cisco switch in the same infrastructure, which gives you the possibility that maybe to transition, maybe you have an investment done on a certain side, but you wanna push the other sides to HP Aruba.

So we also have third party management now within HP Aruba Center. So you can see the networking pilot here. Some conversations he already did.

That was the example. Maybe click one, uh, lan, this is the ai. So this is the conversation you more or less can prompted and you can see now there's already a done, but you can get the point.

So you can see the amount of data that it got generated. And he was asking, show me all issues with my VLAN in my network. So it start to build this table.

So you got all the alerts and all the other information and if you, um, if you go back to the networking pilot, uh, silan there, you need to close it off. Silan on the top right, uh, you have a cross. Yeah, it's nice to have you as my assistant actually that one.

Yeah. And then you do the, uh, do the other one. And then here is the agent.

So if you take the top one Siam, you can see this is the agent one. So this is quicker because this has already run automatically. So now you can see, uh, what is the errors, it has, the reasoning why it fails, what is the impact of which client, and it gives you, this is the immediate schedule.

And during maintenance window, I will talk to you, you can say, you can schedule it and take that particular action. So we even still showed it.