Part 2: Configure and Manage the EX Switch and the Mist AP in the Juniper Mist Cloud

Step-by-step Procedure

This procedure describes how to claim a cloud-ready switch in the Juniper Mist Cloud.

1. Use a Web browser to log in to your Juniper Mist account. The Monitor page appears, showing an overview of the Juniper Mist Cloud and any connected Juniper access points and clients. Click on Organization > Inventory in the menu on the left to open the Juniper Mist Inventory Screen.

   

2. Select Switches at the top of the Inventory screen. Click the Claim Switches button and enter the activation or the claim code for the switch.

   

3. Complete the fields on the screen. Select the Manage configuration with Mist check box and enter a root password for the switch. Note that this choice puts the switch under the management of the Juniper Mist portal. As such, we recommend that local configuration using the CLI be restricted to prevent conflicts. For example, you might want to create a system login message on the switch to warn against making configuration changes locally, from the CLI.

4. Remove the switch from the box and provide the switch management port with Internet access. Next, power the switch on. As part of the zero touch provisioning (ZTP) process, the switch automatically accesses the phone home server (PHS) and connects to the Juniper Mist Cloud for configuration updates.

   Once the ZTP process resolves, the switch automatically appears in the Inventory page. If the switch does not appear after a few minutes, despite refreshing the web page, try logging out and then logging back in. If you still do not see the switch, see Troubleshooting for information about how to confirm whether the device is connected to the cloud.

Step-by-step Procedure

This procedure describes how to set up a secure connection between a supported EX Series switch running a supported version of Junos OS. Also, be sure you can log in to the Juniper Mist portal.

1. Create a branch site in Juniper Mist Cloud. Log in to your organization on Juniper Mist Cloud Click Organization > Site Configuration to open the Sites screen. Click on Create Site and assign the name branch to the new site. You must also enter a location for the site. In this case we enter the address for Juniper’s headquarters.

   Scroll down to the section on switch management and add the desired root password. Later, when you enable configuration management, the Juniper Mist Cloud updates the switch configuration with the password specified. Click on Save to create the new branch location, as shown.

   

2. Adopt the brownfield switch. Click Organization > Inventory to open the Inventory screen. In this example both the Access Points and Switches tabs are empty. Depending on your organization’s login you might see devices that have already be claimed/adopted.

   

3. Select Switches at the top of the Inventory screen and click Adopt Switches in the upper-right corner to generate the Junos OS CLI commands needed to establish secure communications with the Juniper Mist Cloud.

4. The commands configure the switch with a Juniper Mist user account and enable SSH connectivity to the Juniper Mist Cloud. This SSH connectivity uses TCP over port 2200. This port is used for configuration updates and sending telemetry data to the cloud. If you later experience problems connecting to the Juniper Mist Cloud, check to ensure that your organization allows outbound connection requests and the matching return traffic for TCP port 2200 sent to and from the Juniper Mist service.

   

5. In the window that appears, click Copy to Clipboard to get the commands from the Juniper Mist Cloud.

6. On the console of the switch, type configuration to enter configuration mode and then paste the commands you just copied. Use the top command if you are not already at the base level of the configuration hierarchy. Be sure to commit the changes

   .

7. While on the Juniper Mist portal, refresh your browser to update the screen. Within a few minutes the newly adopted switch appears in the inventory list.

   

8. Select the switch you just added and click the More drop-down list at the top right side of the screen, and then click Assign to Site to open the Assign Switches window. Select the branch site you created earlier, but do not click the Manage Configuration option yet. You enable configuration management later, after you have built the configuration template.

   

   Click Assign to Site when done. The display confirms the switch belongs to the branch site. After dismissing the confirmation window the newly adopted switch appears in the inventory with a green status. You might need to refresh the page to see the expected switch status.

   

Step-by-step Procedure

1. A switch configuration template lets you define the standard configurations that are used for all the switches in the branch. The template also allows you to apply specific configurations to select switches when desired. Begin by creating a Switch Configuration template by clicking on Organization > Switch Template in the menu on the left. Use the Create Template button to create a template called branch_template.

   In this example, you populate the template as shown below:

   Click on the headings (All Switches Configuration, Shared Elements, and Select Switches Configuration) to expand a section, and the down arrow to collapse the section when done.

   1. Under the All Switches Configuration, we will add the following parameters:

      • Configure an NTP server for the branch. You use the same public NTP address configured in the SRX.

      • Add a custom login banner to warn users the switch is under control of the Juniper Mist Cloud.

      
      Tip:

      A configuration template supports both authorization and accounting services. These fields are left blank as nether is used in this example. The DNS fields are left blank. In this example the SRX assigns both a domain name and a DNS server to the EX switch and the Mist AP via DHCP.

   2. Scroll down to Shared Elements to add the following:

      • Under NETWORKS define the branch office’s networks and the associated VLANs according to Table 1. In this example we use the system defined “default” network for the native VLAN on trunk interfaces.

        Table 1: Network to VLAN Mapping

        Network Name	VLAN ID
        iot_network	20
        camera_network	30
        corp_network	40
        restricted	99

      • Under PORT PROFILES, create new port profiles with the names ”mist_ap”, “iot_device", “camera_device”, “corp_device”, and “restricted_device”, and map the port profiles to the above networks (VLANs). Use Table 2 to set port parameters such as trunk vs. access, STP, and POE. We enable STP on edge/access ports in this example as a best practice to guard against loops.

        Table 2: Port Profile Settings

        Port Profile	Port Settings
        mist_ap	Trunk (all), default (VLAN 1), POE, STP edge
        iot_device	Access, VLAN 20, STP edge
        camera_device	Access, VLAN 30, STP edge
        corp_device	Access, VLAN 40, STP edge
        restricted_device	Access, VLAN 99, POE, STP Edge

        Note:

        Be sure to set the correct mode of operation (trunk vs. access) and POE for the port groups. The Mist AP in this example requires that POE be enabled. In addition, dynamic profiling is used for the Mist AP. This means the port attached to the Mist AP is initially placed in the restricted VLAN. The port is reassigned to the “mist_ap” profile once the device is recognized as a Mist AP. Therefore, you must enable POE for the “restricted_device” profile to ensure the Mist AP remains powered up and able to identify itself using LLDP.

        The settings for the “mist_ap” port group are shown:

        

      • This example demonstrates a mix of static and dynamic port profiles. Dynamic profiling allows a device to be placed into a specific VLAN based on user authentication or identification of the device. In this step you define two dynamic port configuration profiles.

        Under Dynamic Port Configuration, create a rule that assigns the port profile “mist_ap” to Juniper access points automatically. The rule uses LLDP to detect the chassis ID. When it identifies a device with the first three octets of the chassis ID matching our Juniper access point, it assigns the device to the “mist_ap” profile you created earlier. In this example we match on the value “D4:20:B0”.

        Tip:

        Verify the MAC address of your Mist AP using the sticker on the chassis, or with a show lldp neighbors command on the EX.

        

      • Under Dynamic Port Configuration, create a second rule that dynamically assigns the device with MAC address “ec:3e:f7:c6:80:84” to the “corp_network” profile. This MAC address is assigned to the wired client that is attached to the ge-0/0/3 interface of the EX switch.

        

        The completed Shared Elements screen is shown:

        

   3. Under Select Switches Configurations, we will add the following:

      • Under Info create a rule to associate a port profile with your switch. For this example you add a rule that maps the EX4300 switch to an "access" role.

      

      • Click the Port Config tab and map the port profiles defined under Shared Elements to physical switch ports based on table Table 3. To better demonstrate dynamic port profiling, both the Mist AP and the corporate device are placed into a restricted VLAN with dynamic profiling enabled. The other devices are statically mapped to their associated networks.

        Table 3: EX Switch Port Profiles

        Interface	Function	Profile-* indicates a system defined profile
        ge-0/0/1	Trunk Uplink to SRX	*Uplink
        ge-0/0/3	Roaming Corporate Device	restricted_device, dynamic profiling
        ge-0/0/5	Trunk Uplink from Mist AP	restricted_device, dynamic profiling
        ge-0/0/11	Wired IoT	iot_device
        ge-0/0/15	Wired Camera	camera_device
        All other ports	Restricted VLAN	restricted_device

        Note:

        Ports that are not assigned a port profile inherit the system default profile. The default profile places these ports into VLAN 1, which allows attached devices to obtain a DHCP address from the SRX on the 192.168.1.0/24 network. In this example you define a port range that places all unused ports into the restricted VLAN with dynamic profiling disabled. This setting effectively places these unused ports into a quarantine network that cannot pass through the SRX. Recall that VLAN 99 is not configured on the SRX end of the trunk interface, and that no DHCP pool has been configured for this VLAN.

        Recall that dynamic profiling is enabled for the Mist AP on ge-0/0/5 and the corporate device on ge-0/0/3. Be sure to select the Enable Dynamic Configuration option when you map these ports to the "restricted_device" profile as shown.

      

      The completed port configuration is shown:

      

   You can include configuration statements in the CLI Config tab when the configuration is not supported on the Juniper Mist Cloud. In this example, we have set a custom login banner that applies to all switches in the branch location using the All Switches Configuration portion of the template. This example does not require switch specific CLI configuration.

   Note:

   When done mapping switch ports, be sure to click the check mark to save the port profile, and then click the Save button at the top of the page to save the changes to the branch template.

2. To map the switch template that you created to your branch site, click Network > Switch Configuration in the menu on the left. Select the check box next to your branch site and click the Assign to Template link to map the “branch” template to your site.

   

3. Assign your EX switch to the branch site. Click Switches in the menu on the left, then select the branch site in the site pull down menu. Next, select your switch and use the More pull down menu to select Assign to Site and add the switch to the branch site. Recall the EX switch current has a factory default modified with a root password. Also note this switch has not been under management by the Juniper Mist Cloud. Therefore, you select the Do not retain configuration option.

   

   Next, click the Assign to Site button. The Assign Switches confirmation dialog box confirms the site assignment. Dismiss the window by clicking the Close button.

   

4. In this step you activate Juniper Mist Cloud configuration management for the EX switch. This causes the configuration settings in the “branch_template” to be activated in the switch.

   Warning:

   Once under the control of the Juniper Mist Cloud you should not make any CLI changes directly. Manual CLI changes might conflict with the Mist managed configuration. In addition, manual changes might be overwritten when the cloud pushes an updated configuration.

   While still on the Switches page and viewing the branch site, select your switch to view its details. Scroll down to the Switch Configuration section. At this time the switch is not .

   

   Before enabling configuration management, make the following changes to the switch configuration:

   • Assign the host name for your switch. In this example we use “branch-ex”

   • Assign a role of “access” to activate the select switches portion of your branch template. In the branch template you specified that the switch-specific port configuration is applied to any switch of type “EX4300*” with a role of “access”. Once you specify a role of “access”, the Port Configuration portion of the window should populate with the port settings from the branch template.

   • The rest of the settings are left at their defaults. When needed you can override many of the template settings. Alternatively, you can use the Additional CLI Commands box to include specific CLI commands for the selected switch. The CLI commands are merged with the template configuration before being sent to the switch.

     Note:

     This example uses console access. If you plan to use an Ethernet based management network you can use the IP Configuration (Out of Band) section to specify the use of DHCP or a statically assigned management address. Make sure that the switch does not receive a default route when using DHCP based management. In this example default routes are used to direct traffic from the branch office to the WAN and the broadband Internet links. A default route on the management network can cause branch traffic to be sent over the management link.

     Enable Juniper Mist management of the switch by clicking on the Enable Configuration Management box. Be sure to click on Save to activate the change. Dismiss the Confirm Configuration Management confirmation window.

   

Congratulations. Your switch is now managed by the Juniper Mist Cloud!

Step-by-step Procedure

1. You start by creating a wireless configuration template for the branch office. Click Organization > Config Templates in the left menu. Click the Create Template button and assign a template name. Here we again use the name “branch”.

2. Select whether you want to apply the template to the entire organization or to specific sites. For this example, we apply our configuration to the branch location.

   

3. Create a WLAN template by clicking the Add WLAN button. We use this template to create an SSID (WLAN) for corporate devices in VLAN 40. Numerous options exist for a given SSID, to include a range of authentication mechanisms such as 802.1X, RADIUS, or a passphrase. For our example we use simple passphrase authentication. Be sure to select Tagged as the VLAN type and to specify a VLAN ID of 40.

   

4. Repeat the above step to define SSIDs for the IOT and the camera devices, using VLANs 20 and 30, respectively. When done your SSIDs should look like the example below:

   

   Be sure to save the changes to your template by clicking the Save button when finished. The display confirms that the configuration template is associated with the “branch” site.

   

5. In this step you claim the Mist AP to begin managing the device through the Juniper Mist Cloud. To claim an access point for the branch site, click on Access point in the menu on the left, and then on Claim APs. Enter the claim code on the Mist AP sticker, and add the AP to the “branch” site. When ready click on the Claim button. This displays the Claim Access Points and Activate Subscriptions confirmation dialog screen. Click Close to dismiss the confirmation window.

   

   After a few moments the AP displays a green connected status. You might need to refresh your browser window.

   

6. If desired, click on the AP to view details about its configuration and operational status.

   

A Functional Branch Office

Congratulations! You have configured your SRX services gateway to support DHCP services and Internet access for the EX switch, the Mist AP, and the various corporate devices and their respective VLANs. You used this internet access to adopt/claim your switch and the AP into the Juniper Mist Cloud. You then configured both devices, leveraging the simplicity of configuration templates and the GUI interface.

You can view the resulting branch office topology by clicking on Switches in the left menu and then on the Topology tab. You can click on objects in the topology to display details about attached devices and their MAC addresses.

In the next section of this NCE you add sophisticated application based quality of services configuration to the SRX device to help ensure user experiences are compliant with your organizations SLAs.