Aruba Iap Publish

Automation

Comprehensive Aruba Instant AP (IAP) configuration management with automatic baseline capture, rollback support, and health monitoring. Supports device discovery, configuration snapshots, SSID management, and safe configuration changes with interactive config mode.

Install

openclaw skills install aruba-iap

Aruba IAP Configuration Manager

Comprehensive Aruba Instant AP (IAP) configuration management with automatic baseline capture, rollback support, and health monitoring.

Features

✨ Core Capabilities

Device Mode Detection: Automatically detects Virtual Controller, Single-Node Cluster, or Standalone AP mode
Configuration Snapshots: Full configuration capture with structured JSON output
Safe Configuration Changes: Apply changes with automatic baseline capture and rollback support
Comprehensive Monitoring: 40+ monitoring commands across 10 categories
Risk Assessment: Automatic risk evaluation for configuration changes
Secret Management: Secure secret references (no plain-text passwords)
Change History: Full audit trail with timestamped artifacts
Interactive Configuration Mode: Support for Aruba IAP CLI commit model

📊 Configuration Change Types

Type	Risk	Description
`ssid_profile`	Medium	Create complete SSID profile with WPA2-PSK-AES
`ssid_delete`	High	Remove existing SSID profile
`snmp_community`	Low	SNMP community configuration
`snmp_host`	Low-Medium	SNMP host/trap destination
`syslog_level`	Low	Syslog logging levels
`auth_server`	Medium	RADIUS/CPPM authentication server
`ap_allowlist`	Medium	Add/remove APs from allowlist
`wired_port_profile`	Medium	Wired port configuration
`ntp`	Low	NTP server configuration
`dns`	Low	DNS server configuration
`rf_template`	Low	RF template application

Quick Start

1. Installation

# Clone or download the skill
cd ~/.openclaw/workspace/skills/aruba-iap-publish

# Run install script
./install.sh

# Verify installation
iapctl --help

2. Basic Usage

# Device Discovery
iapctl discover --cluster office-iap --vc 192.168.20.56 --out ./out

# Configuration Snapshot
iapctl snapshot --cluster office-iap --vc 192.168.20.56 --out ./out

# Verify Configuration
iapctl verify --cluster office-iap --vc 192.168.20.56 --level basic --out ./out

3. Add SSID

# Create SSID configuration JSON
cat > add-ssid.json << 'EOF'
{
  "changes": [
    {
      "type": "ssid_profile",
      "profile_name": "MyWiFi",
      "essid": "MyNetwork",
      "opmode": "wpa2-psk-aes",
      "wpa_passphrase": "MySecurePassword123",
      "vlan": 1,
      "rf_band": "all"
    }
  ]
}
EOF

# Generate diff
iapctl diff --cluster office-iap --vc 192.168.20.56 \
  --in add-ssid.json --out ./diff

# Apply changes
iapctl apply --cluster office-iap --vc 192.168.20.56 \
  --change-id $(cat diff/commands.json | jq -r '.change_id') \
  --in diff/commands.json --out ./apply

4. Delete SSID

# Create delete SSID configuration JSON
cat > delete-ssid.json << 'EOF'
{
  "changes": [
    {
      "type": "ssid_delete",
      "profile_name": "OldSSID"
    }
  ]
}
EOF

# Generate diff
iapctl diff --cluster office-iap --vc 192.168.20.56 \
  --in delete-ssid.json --out ./diff

# Apply changes
iapctl apply --cluster office-iap --vc 192.168.20.56 \
  --change-id $(cat diff/commands.json | jq -r '.change_id') \
  --in diff/commands.json --out ./apply

5. Monitor Device

# Monitor all categories
iapctl monitor --cluster office-iap --vc 192.168.20.56 --out ./monitor

# Monitor specific categories
iapctl monitor --cluster office-iap --vc 192.168.20.56 \
  -c "system ap clients wlan" --out ./monitor

Configuration Modes

Supported Device Modes

Virtual Controller Mode
- Manages multiple IAPs
- Full CLI command set available
Single-Node Cluster Mode ✨ NEW
- Single IAP with VC configuration
- Supports interactive config mode
- configure terminal → config commands → commit apply
Standalone AP Mode
- Individual AP without cluster
- Basic configuration available

Interactive Configuration Mode

For Aruba IAP devices, configuration uses the CLI commit model:

Enter configuration mode: configure terminal
Enter sub-mode (e.g., wlan ssid-profile <name>)
Configure parameters (flat commands, no indentation)
Exit sub-mode: exit
Exit configuration mode: exit
Save configuration: write memory
Apply configuration: commit apply

Risk Assessment

iapctl automatically assesses risks for each change set:

Risk Levels

low: Minimal impact, safe to apply
medium: May affect connectivity, review recommended
high: Major changes, requires careful planning

Common Warnings

Removing WLAN or RADIUS configuration may disconnect users
WPA passphrase changes will require clients to re-authenticate
AP allowlist changes may prevent APs from joining the cluster
VLAN changes may affect network connectivity
Large number of changes - consider applying in stages

Best Practices

1. Use Secret References

Always use secret_ref for passwords and keys:

{
  "type": "auth_server",
  "server_name": "radius-primary",
  "ip": "10.10.10.10",
  "secret_ref": "secret:radius-primary-key"
}

Never commit plain-text secrets to version control.

2. Review Risk Assessment

Always review risk.json before applying changes:

cat diff/risk.json

3. Use Dry Run First

Test with --dry-run to verify commands without applying:

iapctl apply --dry-run ...

4. Verify After Changes

Always run verify after applying changes:

iapctl verify --level full ...

5. Apply Changes in Stages

For large change sets, break them into smaller batches:

Stage 1: SNMP and syslog configuration
Stage 2: Authentication servers
Stage 3: SSID profiles
Stage 4: AP allowlist and wired ports

Testing

Comprehensive testing performed on real hardware:

✅ Device discovery and mode detection
✅ Configuration snapshot with multiple artifacts
✅ Configuration diff generation
✅ SSID profile addition
✅ SSID profile deletion
✅ Configuration apply with interactive mode
✅ Configuration verification
✅ Health monitoring
✅ Risk assessment
✅ AP allowlist management

Test Results: 10/11 tests passed (91%)

Known Issues & Limitations

Rollback Functionality

Status: Partially working
Issue: Rollback command execution has limitations
Impact: Low - can be done manually if needed
Workaround: Use no <command> for manual rollback

Post-Apply Verification

Status: Sometimes times out
Issue: show running-config after commit apply can timeout
Impact: Minimal - configuration is applied successfully
Workaround: Wait a few seconds and retry

Changelog

v1.1.1 (2026-02-23)

✅ Add ssid_delete change type
✅ Add send_config_and_apply() method
✅ Add send_config_commands() method
✅ Update diff_engine.py for flat command generation
✅ Fix Result action pattern for 'monitor'
✅ Support Aruba IAP single-node cluster mode
✅ Comprehensive testing on real hardware

v1.1.0 (2026-02-23)

✅ Initial release with core functionality
✅ Device discovery and mode detection
✅ Configuration snapshots
✅ SSID profile management
✅ Configuration diff and apply
✅ Risk assessment
✅ Health monitoring

Requirements

Python 3.8+
scrapli[paramiko] for SSH connections
Aruba Instant AP 6.x, 8.x, or AOS 10.x

License

MIT License - See LICENSE file for details

Support

For issues, questions, or contributions:

ClawHub: https://clawhub.com/skills/aruba-iap
Documentation: See docs/ folder
Examples: See examples/ folder