Overview

HPE Aruba Central Inspector (Beta)

HPE Aruba Networking Central is HPE's cloud platform for managing access points, switches, and gateways. MSPs run it from an HPE GreenLake Managed Service Provider (MSP) workspace, where each Customer is a separate tenant workspace. The HPE Aruba Central Inspector (Beta) connects once to your MSP workspace and automatically discovers every tenant workspace that has Aruba Central, so each Customer's wired, wireless, and WAN network gets its own Liongard Environment, with the same drift detection and documentation you already apply to servers, cloud, and identity.

What you can monitor

The HPE Aruba Central Inspector collects MSP-level and per-Customer network data, including:

• Every tenant workspace in your MSP workspace, with its device ownership model, whether Aruba Central is provisioned, site count, device health, and alert counts
• Each Customer's access points, switches, and gateways: model, serial, MAC, IP, status, firmware, site, and last-seen time
• Sites and their health
• Active alerts by severity and status
• Firmware compliance against Aruba Central's recommended version
• Subscriptions expiring in the next 12 months, for the MSP workspace and each Customer
• The last 7 days of configuration and system audit events

How it works

The Parent Inspector reads your MSP workspace with one HPE GreenLake personal API client. It lists your tenant workspaces and creates one Child Inspector for each tenant that has Aruba Central. Each Child Inspector reads only its own tenant's data. No per-Customer credential is needed, and all access is read-only.

Benefits

• Cover every Customer you manage in Aruba Central with one credential.
• Know when devices go offline or critical alerts become active, per Customer.
• Find devices that aren't on Aruba Central's recommended firmware.
• Catch Aruba subscriptions expiring in the next 90 days, at the MSP level and per Customer, before renewals slip.
• Spot tenant workspaces that don't have Aruba Central provisioned yet.
• Track firmware drift, device count changes, and a 7-day audit trail in each Customer's Environment.

The Inspector ships with 8 alert rules, listed in the HPE Aruba Central Inspector Summary. All rules ship turned off. To receive these alerts, turn the rules on under Admin > Actionable Alerts.

Inspector Setup Preparation

Step 1: Create an HPE GreenLake Personal API Client

1. Sign in to HPE GreenLake and confirm the workspace switcher at the top shows your MSP workspace.
2. Open the menu and go to IAM and administration > API access.
3. Select Create personal API client.
4. Enter a nickname such as Liongard and choose your HPE Aruba Networking Central service instance (not HPE GreenLake Platform).
5. Select Create personal API client to finish.
6. Copy the Client ID and Client Secret. HPE GreenLake doesn't store the secret; if you lose it, reset it from API access.

Step 2: Record your Workspace ID and API Base URL

1. In HPE GreenLake, go to IAM and administration > Workspace details and copy the Workspace ID.
2. Launch HPE Aruba Networking Central from your MSP workspace.
3. Open the menu, go to API Gateway, open the REST API tab, and copy the base URL. It looks like https://us1.api.central.arubanetworks.com.

Inspector Setup:

Step 3: Configure the HPE Aruba Central Inspector in Liongard

1. Log in to the Liongard platform.
2. In Liongard, navigate to Admin > Inspectors > Inspector Types > Navigate to the HPE Aruba Central Inspector > Select Add System.

Since Aruba Central is a multi-tenant system where one MSP workspace manages many Customers, you'll set up a single Parent Inspector with your MSP workspace credentials. It will then auto-discover a Child Inspector for each tenant workspace.

Fill in the following information:

• Type of Inspector: Parent
• Environment: Select your MSP's Environment
• Friendly Name: Suggested Naming: [MSP Name] HPE Aruba Central Parent
• Agent: Select the On-Demand Agent
• Inspector Version: Latest
• Aruba Central API Base URL: Select the base URL you recorded in Step 2
• GreenLake API Client ID: The Client ID from your personal API client
• GreenLake API Client Secret: The Client Secret from your personal API client
• MSP Workspace ID: The Workspace ID from Workspace details
• Scheduling: The Inspector will default to run once a day at the time it's set up. Here you can adjust the schedule
• Select Save. The Inspector will now be triggered to run within the minute.

Step 4: Child Inspector Setup

After the first run of the Parent Inspector, your tenant workspaces that have Aruba Central will be auto-discovered and surfaced in the Discovered Systems tab on the Inspectors > HPE Aruba Central page. Each maps to one Liongard Environment.

• Activate or Archive your Discovered Systems by ensuring they're mapped to the correct Environment > Check the checkbox to the left of Inspector(s) > Select the Actions drop-down menu > Activate Launchpoints (or Archive Launchpoints).
• Click Save.

Troubleshooting

• HPE GreenLake rejected the API client ID or secret: The Client ID or Client Secret is wrong, the secret was reset, the client was created in a different workspace than the MSP Workspace ID you entered, or the GreenLake user who created the client was removed. Create a new personal API client in the MSP workspace and update the Parent Inspector.
• Aruba Central rejected the access token at the Aruba Central API Base URL: Aruba Central answers a valid credential sent to the wrong region with the same error as a bad one. Copy the base URL again from API Gateway > REST API, and confirm the personal API client was created for the HPE Aruba Networking Central service, not HPE GreenLake Platform.
• HPE GreenLake refused to list tenant workspaces: The MSP Workspace ID belongs to a standard workspace, or the client's GreenLake user lacks MSP administrator access. This version supports MSP workspaces only.
• HPE GreenLake refused access to a tenant workspace (Child): The tenant was deleted or moved out of the MSP workspace. Archive the launchpoint; the Parent discovers the current tenants on its next run.
• Aruba Central stopped accepting the access token during the inspection: The personal API client was reset or deleted, or its GreenLake user was removed, during the run. Create a new client and update the Parent Inspector.
• The Inspector is missing required settings, or the API Base URL isn't an Aruba Central API host: Fill in every field on the Parent Inspector. The base URL must be one of the *.api.central.arubanetworks.com hosts.
• A tenant workspace is missing from Discovered Systems: Only tenants with Aruba Central provisioned are discovered. The Parent's Managed Tenants tab lists every tenant and shows Central Provisioned: false for the ones that need it, or an empty value when two tenants share a name.
• A Child Inspector shows zero devices: Expected for a tenant with no onboarded devices, or one using MSP device ownership with no devices assigned yet. Zero is a confirmed count; an empty value means the collection couldn't be read (see Skipped Collections on the Overview tab).
• A Child Inspector reports Central Provisioned: false and empty counts: Aruba Central was removed from that tenant after it was discovered. Provision it again or archive the launchpoint. This isn't an error and doesn't fail the run.

Inspector FAQs