Overview
The Arista AGNI + Envoy Visitors integration automatically provisions temporary Wi-Fi credentials for your visitors, streamlining the arrival experience while keeping your network secure. When a visitor signs in through Envoy, the integration creates a guest user in Arista Guardian for Network Identity (AGNI) and delivers their Wi-Fi credentials inline in the Visitor Welcome Email, and optionally via SMS. When the visitor signs out, their guest access is automatically disabled or removed.
This is a cloud-based integration that connects to your Arista CloudVision AGNI cluster using an API token, so there is no on-premises hardware or agent to maintain.
PREREQUISITES
You must have an Arista CloudVision AGNI cluster with a guest captive portal configured.
Arista CloudVision AGNI admin privileges to generate an API Key
You must generate an API token in AGNI for Envoy to authenticate with your cluster.
To deliver AGNI credentials to your visitors, you must use a sign-in flow that captures an email address (and a phone number, if you plan to send credentials via SMS).
How it works
When a visitor signs in at Envoy, the integration creates a guest user in AGNI's captive portal. AGNI generates a unique pre-shared key (UPSK) passphrase for that guest, which Envoy retrieves and delivers to the visitor. The credentials, including the visitor's Wi-Fi username and the auto-generated passphrase, are included inline in the Visitor Welcome Email, and can also be sent by SMS.
You control how long the credentials remain valid by setting a configurable access duration that begins when the visitor signs in. When the visitor signs out through Envoy, the integration applies your chosen sign-out behavior: it can either disable the AGNI guest user or delete it entirely.
Configuration
AGNI Admin Setup
Login to your Arista admin portal, then navigate to Launchpad > Admin > Keys.
Confirm that at least one captive portal exists under Identity > Guest > Portals.
Step 1: Credentials
You'll need to establish a connection to Envoy by providing your AGNI credentials.
AGNI FQDN: Provide your fully-qualified domain name for your AGNI cluster.
API Launch Key: The API Key ID, located in your AGNI instance under Launchpad > Admin > Keys.
API Key Value: The value for your API Key.
(Optional) CAS URL: If Arista directs you to a specific CAS login endpoint, provide that URL here.
Once all required fields are populated, click Next Step.
Step 2: Visitors
Once the connection is successful, you'll need to configure how visitors are given access to your network.
Guest Portal: Select the captive portal from the dropdown that will host your visitors.
Access duration: Define how long the WiFi connection will be available after the visitor signs in.
If you want to provision only invited guests, check the box next to Only invited visitors.
Blocked flows: Select any visitor sign-in flows that will not be automatically provisioned.
Sign-out behavior: Select the appropriate action for visitor sign-out.
Check the box next to Send credentials via SMS to send AGNI credentials via text. You'll need to collect visitors' mobile phone numbers to send credentials this way.
Device limit: Limit the number of devices visitors can connect by setting a number here.
Click Complete Setup to save your settings and finish installation.
Step 3: Adding AGNI credentials to the Welcome Email
Once your portal and visitors' settings have been configured, the final step is to add a custom content block to your welcome email to display the AGNI-created credentials.
See main article: Configure the Welcome email
In the Envoy dashboard, navigate to Visitors > Settings > Email templates, then click the Welcome email tab.
You can either Add template, or view an existing template to make edits.
Scroll down to the Body section, and click + Add block to add a new custom content block.
In your new custom content block, click Add dynamic content, then select Arista AGNI WiFi Welcome Email. This will add your automatically-provisioned AGNI credentials to your Welcome email.
Be sure to save your changes by clicking Save in the upper-right corner.
You'll need to repeat this process for any welcome email template that is sent to AGNI-provisioned visitors.
Apply this template to applicable sign-in flows by clicking Manage by sign-in flow.