Overview

The Aruba Central (New / HPE GreenLake) integration lets Envoy automatically sign employees in to the workplace when they connect to your Wi-Fi network. Envoy monitors Wi-Fi connection events from your New Central instance and uses them to track real-time workplace capacity.

This integration supports a limited subset of features today and will expand as HPE and Aruba build out the New Central APIs.

If you rely on visitor Wi-Fi provisioning, stay on the Classic integration for now (see What's supported below).

Classic vs. New: which version do I have?

Aruba has two generations of its Central platform:

HPE Aruba Central (Classic): the legacy platform, accessed via app.central.arubanetworks.com style URLs.
Aruba Central (New): the current platform (also called "New Central" or "CNX"), running on HPE GreenLake.

These two versions are not compatible.

If you are unsure which version your organization is on, check the URL you use to log in to Aruba Central, or ask your HPE/Aruba administrator. Envoy has no programmatic way to detect the version automatically. You choose at install time by picking the correct tile.

On Classic? Use the Aruba Central (Classic) integration instead. If you see an authentication error immediately after connecting, you may have installed the wrong version.

What's supported

Feature	Supported in Aruba Central (New)?
Workplace auto sign-in (Wi-Fi based)	Supported
Visitor Wi-Fi provisioning (guest portal)	Not available
Splash screen / guest portal configuration	Not available
Guest network selection	Not available
Visitor session duration configuration	Not available
Visitor sign-in / sign-out	Not available

We plan to add all of these features in a future release once the Aruba APIs reach general availability. If your organization relies on any of these features today, you must remain on the Aruba Central (Classic) integration until they are available.

PREREQUISITES

You must be a location or global admin in Envoy to set up this integration.
An HPE GreenLake account with access to your organization's New Central instance.
A Personal API client (Client ID and Client Secret) created in the HPE GreenLake UI. See Step 1 below.
Your Central region (for example US, EU, or APAC). See Step 2 below.

GreenLake configuration

Step 1: Create a Personal API client in HPE GreenLake

Log in to the HPE GreenLake portal.
Navigate to Manage Workspace → Personal API clients.
Create a new API client scoped to your Central instance.
Copy the Client ID and Client Secret. You will need both when setting up the Envoy integration.

Choose the right API client type. HPE GreenLake has two kinds of API clients: workspace-scoped (15-minute tokens) and Central-scoped (2-hour tokens). You need the Central-scoped one. Workspace-scoped credentials will fail to authenticate with the Envoy integration.

Resetting or deleting the API client immediately invalidates all tokens it issued. If the integration stops working after a credential change, reconnect using the new credentials.

Step 2: Find your Central region

The region corresponds to where your HPE GreenLake / New Central data is hosted.

Common regions:

Region	Code
United States	us1, us2, us4, us5, us6
Canada	ca1
Germany	de1, de2, de3
United Kingdom	gb1
India	in1
Japan	jp1
Australia	au1
UAE	ae1
China	cn1

If you are unsure of your region, check with your HPE/Aruba administrator, or look at the URL you use to log in to New Central.

Envoy App configuration

Step 1: About

In Envoy, go to the App Store and search for Aruba Central CNX.
Click Install and follow the setup flow.
Click Authorize to give the app permissions and continue to the next step.
Click Next Step after reading the info box.

Step 2: API Access

Click Connect Account to launch the connection window.
Enter your Client ID and Client Secret, then select your region.
Click Save to connect.
Select the site and wireless network (SSID) to monitor for auto sign-in.
Complete the setup. Envoy will validate your credentials automatically.

Step 3: Workplace

In this step, you'll select the specific Network and site to use to sign employees in at this location.

Select a Network Name, Site Name or Match Network and Site Names.
1. Select Network Name if your SSIDs are unique across your whole organization, meaning no two sites share a network name. For example, if your SSIDs are titled "Glacier-Austin," "Glacier-Chicago," etc. Envoy will check employees in whenever it sees a connection to the network name(s) you select, regardless of site.
2. Select Site Name if you'd rather scope check-ins by physical site and don't need to narrow down to a specific SSID, or if you want every connection at a given site to count.
3. Pick Match Network and Site Names if the same SSID exists at more than one location. This is the common case for companies that reuse a standard network name like "Glacier-WiFi" everywhere. Matching both ensures an employee is checked in only when the connection happens on the specific network and the specific site you choose, so someone connecting to "Glacier-WiFi" in the Austin office doesn't accidentally get checked in at the New York site.
Next, select how to identify employees who sign in: Identity authentication with user email or Device authentication with MAC address.
1. Identity authentication with user email is only available if the Identity field uses employee email addresses. These email addresses must match the ones in your employee directory.
  1. (Optional) Exclude Employees from this auto sign-in service.
2. Device authentication with MAC address must be used if Identity field does not use the correct email address.
  1. MAC addresses can be managed by uploading a CSV of current mappings. To remain current, you'll need to re-upload this each time the list changes. Learn more about managing employee MAC addresses.
  2. (Recommended) You can automatically pull employee MAC addresses mapping from Aruba by granting access in the next step.
  3. (Optional) You can automatically pull MAC address mapping from a device management service like Jamf or Intune.
Click Next Step to save and continue.

Step 4: MAC Address Sync

You can automatically manage employee MAC addresses by syncing them from Aruba. This is highly recommended if you plan on using MAC addresses to provide employee check-in data.

Note: MAC address sync only works for employees whose email address and MAC address are both available through the Aruba Central integration. Employees missing either field will not be synced.

Check the box next to Sync MAC addresses.
Click Complete Setup to save and finish the app configuration.

Viewing employee sign-ins and signals

When employees are signed in via Aruba, their entry in the employee log (Workplace > Employee log) will show "via Wi-Fi Connection" under Checked in, alongside the time the connection occurred.

Learn more about the Employee log.

Each time Envoy detects a connection event, whether or not it creates a check-in, it appears in the Access log. These are nested under each employee. You can expand the employee's signals and view a full record.

Learn more about the Access log.

Troubleshooting

Problem: Authentication error right after connecting

Double-check that you are using Central-scoped Personal API client credentials, not workspace-scoped credentials. If you are on Aruba Central Classic, you need the Aruba Central (Classic) integration instead.

Problem: Employee auto sign-ins aren't appearing.

Check that the correct SSID and site are selected in step 3 of the integration settings. Envoy polls for new Wi-Fi connections every 5 minutes, so sign-ins may take up to 5 minutes to appear. If the issue persists, verify that your Personal API client has the appropriate permissions in HPE GreenLake.

Aruba Central (New / HPE Greenlake) [Beta]