HPE Networking Campus and Branch Presents at Networking Field Day 41

Intro to HPE Self-Driving Networks with Sanjoy Dey

Watch on YouTube
Watch on Vimeo

Sanjoy Dey of HPE Networking introduced the company’s campus and branch switching portfolio and its vision of self-driving networks. He outlined the AI-native, cloud-native, and secure-by-design foundations shared by Mist and Aruba Central, along with six tenets guiding the switching roadmap, from agentic switching and zero trust LAN to always-on operations and the combined Juniper EX and Aruba CX lines. Dey, who leads HPE’s campus and branch wired business, delivered this opening session at Networking Field Day 41, setting up later segments on segmentation, platform innovations, and automation.

Dey framed self-driving networks as a correction to decades of switch design focused on speeds, feeds, and capacity, which left operators doing the heavy lifting of gathering forensic evidence, configuring SPAN ports, and taking packet captures whenever something broke. In HPE’s model, the network understands the user experience and remediates problems itself within guardrails set by engineers and architects. He described the three pillars behind both Mist and Aruba Central. AI native means bringing petabytes of telemetry from clients and network elements into the cloud for AI models to act on. Cloud native refers to a microservices architecture that scales from a few branch switches to campuses with tens of thousands of devices, exposed through REST APIs, WebSockets, webhooks, and MCP endpoints. Secure by design covers primitives that contain threats at the point where a device connects.

The six tenets show where HPE is taking the portfolio. Agentic switching explores where intelligence should live across the cloud, the operating system, and custom or merchant silicon. HPE also promised evolution rather than revolution, with no forced overhauls of existing architectures, and applied that to zero trust, which Dey called widely misunderstood and which HPE intends to deliver without replacing standard topologies or overlay fabrics. An always-on tenet targets change management through hitless upgrades, fast boot, and perpetual PoE. The final tenet is the breadth of the combined Juniper EX and Aruba CX lines, from simple branch access to core and distribution, with Mist and Aruba Central providing the intelligence that turns hardware choice into a single self-driving operation.

 

Personnel: Sanjoy Dey

Journey to Self-Driving in HPE Switching

Watch on YouTube
Watch on Vimeo

See how HPE Networking switches and HPE Mist come together to simplify deployment, improve visibility, and accelerate troubleshooting. This session includes a demo of switch onboarding using CX switches, including cloud-native management, Wired SLEs, Marvis Actions, and AI-native assurance. Gain deep insights into your network and how you can improve user and device experiences while adopting a self-driving approach to wired networking. Deepti Ganesh of HPE’s Wired Assurance team presented the session at Networking Field Day 41.

Ganesh organized wired assurance around day zero design, where templates scale across thousands of sites; day one deployment; and day two operations, where Mist does most of its work. With CX switches now managed in Mist alongside EX and QFX, greenfield onboarding works the same way for all of them: scan the QR claim code, which CX switches have shipped with since June, through the mobile app or add it on the dashboard, assign the switch to a site, and the staged template is pushed with zero touch. Brownfield CLI-managed switches can be adopted with a single org-wide registration code that can be scripted and rotated. A checkbox decides whether Mist manages configuration and becomes the source of truth, or only monitors. Delegates pressed on running both Mist and Central, and HPE said both the EX and CX lines will continue, with on-prem management available through Central.

The self-driving story starts with per-minute stats and asynchronous events feeding Service Level Expectations. Marvis Minis acts as a digital twin that tests DHCP, DNS, RADIUS, ARP, and defined applications every hour or on demand, which helps validate a network after an overnight cutover. Marvis Actions now self-drives four wired remediations, all off by default: disabling ports with rogue DHCP servers, adding missing VLANs, bouncing stuck ports up to three times, and shutting down looped ports. Ganesh said the stuck-port action alone auto-remediated 834 tickets. In another example, the Marvis conversational interface traced a flapping MAC address to a VRRP split-brain behind an upstream SD-WAN device. Premium Analytics adds a sustainability dashboard showing energy use by org, site, and device. Together, these features show how HPE is moving from detecting problems to fixing them, with operators deciding how much control to give up.

Personnel: Deepti Ganesh

HPE Campus Zero-Trust Inline Segmentation with Rohan Chadha

Watch on YouTube
Watch on Vimeo

Most organizations assume a compromise will eventually occur. The challenge before us is preventing attackers from turning a single compromised user or device into a widespread business disruption. This session will show how HPE Networking Zero Trust Inline Segmentation (ZTIS) helps enterprises contain threats and reduce the blast radius of attacks through identity-based enforcement at the access edge. You’ll see how microsegmentation can be applied over your existing network to deliver the same zero-day resilience as traditional segmentation approaches. Rohan Chadha of HPE’s wired assurance product management team presented the session at Networking Field Day 41.

Chadha opened with the 2017 casino breach in which attackers used a fish tank thermometer to steal a high-roller database, arguing that the danger lies in what devices can reach inside a VLAN the firewall never sees. Agentic AI adds overprivileged machines moving at machine speed. ZTIS takes three steps, the last of which is “there is no third step.” An existing NAC, whether Mist Access Assurance, ClearPass, ISE, or FreeRADIUS, sends a group-based policy tag as a RADIUS vendor-specific attribute. Operators then author tag-to-tag policies in the Mist cloud, optionally refined by IP, port, and protocol. The switch binds the tag to the client’s MAC and enforces the policy at line rate, dropping denied traffic at ingress. Devices that can’t authenticate can be tagged statically by MAC, subnet, or VLAN, and when delegates raised MAC spoofing, Chadha acknowledged the risk and pointed to VLAN or subnet tagging instead. Policy hit counts help teams prune unused tags.

ZTIS supports up to 10,000 clients per site, and it works on EVPN multihoming and core-distribution campus fabrics without stretching VXLAN to the access layer. Larger sites can use an EVPN-VXLAN IP Clos fabric, where the tag travels natively in the VXLAN header. For the densest campuses, HPE is bringing the MX304, MX301, and MX204 under Mist Wired Assurance as core and border routers, supporting 200,000 clients, with Marvis support for MX planned. Enforcement still happens at the access switch either way. Chadha stressed that ZTIS doesn’t replace the firewall but targets lateral movement inside the network, and said wireless support is coming soon, enforced at the switch where the AP connects. The point is that microsegmentation becomes a policy change rather than a network redesign, from a single clinic to a 200,000-client campus.

Personnel: Rohan Chadha

HPE Campus EX Switching Portfolio Deep Dive with Umang Saini

Watch on YouTube
Watch on Vimeo

Operational disruptions are rising as machine-speed attacks force organizations to increase the pace of security and vulnerability patches. For organizations caught in between uptime and risk, our in-service software upgrades (ISSU) preserves user experience and business continuity without maintenance windows. Building on this foundation, the EX5200 combines every-port multigig connectivity, rich telemetry, and scalable Virtual Chassis to improve visibility, streamline operations, and support growing campus demands. Tune in for a demo of our latest capabilities, along with a closer look at the EX5200. Umang Saini of HPE’s product management team presented the session at Networking Field Day 41.

Saini introduced the EX5200, launched a few weeks earlier as the top of HPE’s EX access line. It comes in 24- and 48-port PoE and non-PoE models with 10G multigig on every port, a 3,500-watt PoE budget, 90 watts on any port, and stacks of up to ten members over 400G of full-duplex stacking bandwidth. Uplinks double those of the EX4400 to eight 25G or two 100G ports. The switch boots to a login prompt in 55 seconds, with 45 to 47 seconds targeted by year end. It supports campus fabrics, group-based policy, and Zero Trust Inline Segmentation, along with secure boot, MACsec with AES-256, streaming telemetry, and flow-based telemetry that can flag attacks from the first packets of a new flow. Because the EX5200 runs classic Junos, it doesn’t support containers, and delegates questioned the two-OS strategy. HPE said the Junos and AOS-CX lines will remain separate and recommended choosing platforms by requirement.

The second half addressed uptime. Saini demonstrated software upgrade orchestration in Mist, where operators can target an org, site, or switch role, set images per product line, and run upgrades in parallel, staged, or on a schedule. When a delegate noted that daily CVEs make full reboots untenable, Saini presented hitless upgrades on EX access platforms, aimed at keeping traffic loss below 50 milliseconds. Daemons save state, the backup switch and line cards upgrade first while forwarding stays programmed, and a graceful switchover lets the former primary upgrade last. Control plane downtime is 60 seconds or less, and a failed step rolls back without dropping traffic. In the EX4400 stack demo, pings and a Teams call ran uninterrupted while 802.1X sessions, PoE, and LLDP stayed up. HPE’s argument is that patching no longer has to mean negotiating maintenance windows, which matters more as the pace of vulnerabilities speeds up.

Personnel: Umang Saini

HPE Campus CX Switching Portfolio Advancements with Yash Nagaraju

Watch on YouTube
Watch on Vimeo

Most troubleshooting time is spent finding the problem, while much of the downtime comes from applying critical network and security updates. Join us for a discussion and live demo of the latest innovations in HPE Networking CX switches, including Dynamic Packet Capture, end-to-end application diagnostics, and enhanced In-Service Software Upgrade (ISSU) capabilities that help accelerate root-cause identification and minimize operational disruption. You’ll also see how the CX6300M combines always-on resiliency with high-density edge performance to support demanding enterprise Wi-Fi 7, video, and IoT environments. Yash Nagaraju presented the session at Networking Field Day 41.

Nagaraju said HPE treats high availability as a framework rather than a feature, which matters more as vulnerability patches pile up. Every CX switch, from the 6000 to the 9300, supports hot patching for critical fixes. In-release ISSU arrived in 2023, and HPE now offers standalone ISSU too, with no extra license required. The cloud-native AOS-CX design lets microservices restart against a database that serves as the single source of truth while the ASIC keeps forwarding. Delegates noted the industry has been burned by ISSU for decades, and Nagaraju invited lab testing and pointed to a large retailer that upgraded its whole fleet this way. He then demonstrated a major-to-major ISSU on a ten-member VSF stack, using kexec to replace the Linux OS. MAC learning, MACsec, BFD, and IPFIX export pause during the process, and it aborts if the target image or TCAM programming fails validation. Stackable ISSU is limited to the 6300 and 6400 because smaller platforms lack CPU headroom.

The second half made the case for HPE’s custom silicon, built for campus over 30 years. A common architecture scales from 10 Mbps to 100 Gbps, so features behave the same from a 6200 in a small clinic to an 8360 in the core. Flexible TCAM fits IPv4 and IPv6 entries on the same row to avoid exhaustion, and nine parallel ingress lookups plus four at egress support advanced policy without added latency. Virtual output queuing drops congested traffic at ingress instead of carrying it across the fabric. Application recognition inspects the first packets of HTTPS flows, so operators can enforce application-based policy in TCAM, and reflexive ACLs block traffic that servers initiate. The closing platform delivers 90 watts on every port. Nagaraju argued that this level of control over silicon is what makes per-client visibility and hitless upgrades possible.

Personnel: Yash Nagaraju

HPE Campus Automation for the Self-Driving Network

Watch on YouTube
Watch on Vimeo

Learn how Model Context Protocol (MCP) enables cross-domain automation across both HPE Aruba Central and HPE Mist that simplifies IT operations. This session explores how HPE Self-Driving Network uses MCP to share context, trigger actions, and enhance network intelligence. See real-world examples of how MCP connects network intelligence with agent-driven workflows to enable more efficient, automated, and actionable network operations. Jay Pathak and Thomas Munzer of HPE’s campus and branch automation team, focused on agentic automation, presented the session at Networking Field Day 41, with Munzer joining remotely from France.

Pathak started with the automation ecosystem HPE has built around both platforms, including Ansible and Terraform for infrastructure as code, ServiceNow for automatic ticketing, and a range of third-party integrations. He said both Mist and Aruba Central are 100% API-first with standardized OpenAPI models, so anything an operator can do in the UI has an API call behind it. The platforms also offer webhooks for event-triggered workflows, WebSocket and streaming APIs for raw telemetry, Postman collections, and SDKs for Python, Go, and Ansible. Both now offer cloud-hosted MCP servers, which Pathak called the API for AI models and agents. He framed response quality as the product of MCP server quality, data quality, and LLM quality, noting that HPE controls the first two and that its servers work with lightweight or frontier models. In a conversational demo, an MCP client checked user issues in a Mist org for the week, returned recommended actions, and then traced a client to its AP and upstream switch in a single query that spanned multiple domains.

Munzer then showed a fully agentic workflow. In his setup, Aruba access points managed by Central connected to a Juniper switch managed by Mist, and both platforms sent alerts through a webhook collector to an AI agent with its own LLM, memory, and MCP servers for Aruba Central, Mist, and ServiceNow. When he disabled PoE on the switch port, Central reported the AP as disconnected, and the agent queried both platforms, correlated the data, and opened a ServiceNow incident. The incident identified the root cause as the switch configuration change in Mist, not the AP itself. Munzer argued that scripting every event combination across multiple platforms isn’t practical, while an agent can adapt to whatever it finds. The result is proactive operations, with teams learning about issues almost in real time, with full context, before users ever call support.

Personnel: Jay Pathak, Thomas Munzer