Before you begin
- A Atlas AVD plan. The Integrations hub is not available on Community
- The Administrator role in Atlas to connect, configure or disconnect a connector. Integrations appears under Administration only for administrators
- A tenant selected in the tenant picker. Credentials are stored encrypted per tenant, so each tenant you manage connects its own account
- Access points, switches and gateways managed in Aruba Central and assigned to a site or a configuration group
- An Aruba Central API client and a refresh token generated for it, from Organization → Platform Integration → REST API
- To sync into Vault: a Vault admin and at least one asset template (the Network Device template is a good fit)
What you can do
- Document every Aruba access point, switch and gateway as an Atlas Vault asset, with no manual data entry.
- Map each Central site, or each configuration group, to the customer company it belongs to.
- Keep the documentation current: every hour Atlas adds new devices, updates changed details and archives devices Central no longer reports.
- See what changed and when: name, model, IP and MAC address, firmware, site and group changes, each with the previous value kept.
- Ask Atlas Advisor about documented equipment, for example "What firmware are our Aruba access points running?"
Step 1: Create an API client and a token in Aruba Central
- Sign in to Aruba Central and go to Organization → Platform Integration → REST API.
- Under System Apps & Tokens, add an API client. Atlas only reads sites, groups and device inventory, so read-only access is enough.
- Copy the client's Client ID and Client Secret.
- Click Generate Token for the client and copy the Refresh Token.
- Note your cluster: the API Gateway URL on the same page names it, for example apigw-prod2.central.arubanetworks.com is US-2.
Aruba Central gives out a new refresh token every time one is used, and the old one stops working. Atlas saves each new token for you. Use this token only for Atlas: if a script or another tool uses the same token, Atlas's copy stops working and you need to generate a new one.
Step 2: Connect in Atlas
Once connected, the card shows Manage, which opens Atlas Vault → Assets, and Disconnect. The client ID, client secret and tokens are stored encrypted and are never shown again. Checking the connection uses up the token you pasted, so if a connection attempt fails after reaching Aruba Central, generate a new token before you try again.
- Select the tenant in the tenant picker.
- Go to Administration → Integrations and click Connect on the Aruba Central card.
- Pick your Aruba Central region (cluster), then paste the client ID, client secret and refresh token.
- Click Connect. Atlas checks the token and lists your sites and groups before saving anything; if it is rejected, nothing is stored.
Step 3: Map each site or group to a company
Use sites when each customer has its own sites, or groups when you keep one configuration group per customer. Each site or group can be mapped only once in an Atlas tenant. Renaming a site in Aruba Central does not break its sync.
- Open Atlas Vault → Assets → RMM & PSA sync and click Add sync.
- Source: Aruba Central.
- Device type: pick a site (shown as Site: name) or a configuration group (shown as Group: name).
- Template: pick Network Device. Atlas fills in the field mappings for you: Name, Type, Manufacturer, Model, Serial Number, Management IP, MAC Address, Firmware Version and Location. You can change or add any mapping.
- Company: the customer this site or group belongs to.
- Leave Sync automatically every hour on, click Save Changes, then click Run now to document it straight away.
Keep the hourly sync running
Aruba Central expires a refresh token that goes unused for about two weeks. The hourly sync keeps the token fresh. If you connect Aruba Central but don't add a sync, or turn every sync off for longer than that, disconnect and connect again with a new token.
What gets documented
- Identity: name, manufacturer (HPE Aruba Networking), model (for example AP-515, 6300M or 9004) and serial number.
- Type: Access Point, Switch or Gateway.
- Network: the device's IP address and MAC address.
- Software: the firmware version.
- Placement: the Central site and configuration group.
- Operational: whether Central reports the device up or down.
Devices are matched by serial number, so renaming a device, changing its IP or moving it to another group updates the same asset instead of creating a new one. Atlas does not keep client counts, uptime or port statistics. Wireless clients, SSIDs and configuration are not documented.
Your own documentation is kept
Atlas only fills the fields you map. Notes, attachments, custom fields and anything else you add in Vault are yours and are never touched. If you edit a mapped field by hand, Atlas keeps your value; if Aruba Central later reports something different, the field is flagged under Drift to review so you can choose which to keep. A device Aruba Central stops reporting is archived, not deleted, and comes back automatically if it returns. Atlas archives a device only after a complete read, so an outage or a rejected token never empties your documentation.
Change history
Open an asset's ⋯ menu and choose History to see what changed: when the device was first documented, a new name, model, IP or MAC address, firmware, site or group (each with the previous and new value), when it was no longer reported, and when it came back. Routine up and down changes are not recorded. The same entries appear on the Operations Timeline.
Ask Atlas Advisor
Atlas Advisor answers questions from the documented assets, read-only and limited to what you can see in Vault, with or without an AI provider. For example: "list our Aruba switches", "What firmware are our Aruba access points running?" or "Is Aruba Central connected?".
What the integration does not do
- It is read-only. It never changes a configuration, upgrades firmware or reboots a device.
- It does not document wireless clients, SSIDs or configuration.
- It reads devices managed in Aruba Central only. Aruba Instant On has no public API, so Instant On devices are not covered.
- It syncs every hour or when you click Run now; the interval cannot be changed.
- It connects one Aruba Central API client per Atlas tenant. Credentials cannot be edited in place: disconnect and connect again with the new values.
GCC High tenants
On a tenant or deployment in Azure Government (GCC High), calls to Aruba Central are blocked by default, because they can carry VM, host-pool and tenant names to a service outside the Government boundary. Connect fails with an Azure Government (GCC High) egress boundary message and nothing is stored, and pages that read from Aruba Central stay empty. The operator who runs your Atlas deployment can approve Aruba Central as a destination that is allowed to receive that data; once approved, the connector works normally. Running in Azure Government does not by itself make a third-party integration GCC High or CMMC compliant.
Disconnecting
Click Disconnect on the card and confirm. Atlas deletes its stored copy of the API client and tokens and pauses every Atlas Vault sync from Aruba Central. The documented assets and their history stay in Vault; turn the syncs back on after you reconnect. Nothing changes in Aruba Central. Delete the API client in System Apps & Tokens too if you no longer want Atlas to use it.
Troubleshooting
- Aruba Central rejected the refresh token: the token expired, was used by something other than Atlas, or the API client was deleted. Generate a new token for the API client and connect again.
- The connection test fails straight away: the client ID or client secret is wrong, or the region does not match the API Gateway URL shown in Aruba Central. Generate a new token, check the values and connect again.
- A site or group is missing from the Device type list: the API client cannot see it, or it was deleted in Aruba Central.
- A device is missing: it is not assigned to that site or group in Aruba Central.
- Aruba Central is temporarily rate limiting requests: scheduled syncs wait and retry on their own; try again in a few minutes.
- A sync reports the integration is not configured: Aruba Central was disconnected. Connect it again, then turn the sync back on.