Aruba CX (AOS-CX) — Deployment

Stage, diff, commit and roll back fabric changes for Aruba CX (AOS-CX) data center fabrics (VXLAN/EVPN). Part of the multi-vendor Data Center automation guide.

Repository

Aruba

AOS-CX

REST API

VXLAN / EVPN

Render per-vendor config from the intent model

Stage as a candidate on Aruba, then diff

Commit only the expected diff — roll back on failure

Setup, key commands & run examples

deploy.sh

Stage / diff / commit

The Aruba CX (AOS-CX) change workflow. AOS-CX is REST-first: the pyaoscx SDK (and the community napalm-aoscx driver) drive the box over the REST API. Use checkpoints to snapshot, diff and roll back changes.

deploy.sh

bash

# 1. stage:   checkpoint / configure (candidate via REST checkpoints)
# 2. diff:    checkpoint diff <pre> <post> / show running-config
# 3. commit:  write memory (or REST PUT to running config)
# 4. revert:  checkpoint rollback <name>

deploy.py

Guarded commit

Render config from intent, stage it on Aruba, preview the diff and only commit when it matches what you expect.

deploy.py

python

dev.load_merge_candidate(config=rendered)   # checkpoint / configure (candidate via REST checkpoints)
diff = dev.compare_config()                 # checkpoint diff <pre> <post> / show running-config
print(diff)
if diff and "vlan 120" in diff:
    dev.commit_config()                     # write memory (or REST PUT to running config)
else:
    dev.discard_config()

Best practices

Diff before every commit
Always review checkpoint diff <pre> <post> / show running-config (or gate it in CI) so no Aruba change is applied blind.
Deploy leaf-pairs, not rows
Roll one MLAG/ESI pair at a time and verify before moving on, so redundancy survives a bad change.
Confirmed commits
Aruba has no confirmed-commit — keep a rollback (checkpoint rollback <name>) one command away and watch the session.
Post-change verification
Re-read EVPN/VTEP state after each commit and abort the rollout if anything regressed.

Hands-on exercises

Guided practice tasks — copy the starter snippet, run it against a lab device, and extend it to meet the goal.

Exercise 1

Guarded VLAN rollout

Goal: Add an L2VNI to one Aruba leaf pair: stage, print the diff, commit only if it contains the expected VLAN id.

exercise_1

python

rendered = render_l2vni(vlan=120, vni=10120)
# TODO: stage -> diff -> commit only if "120" in diff, else discard

Exercise 2

Rollback drill

Goal: Apply a bad change, detect the EVPN peer drop, and roll back with: checkpoint rollback <name>

exercise_2

bash

# apply change, then on failure:
checkpoint rollback <name>

Curated videos & guides

Checklist — pitfalls, gotchas & verification

Common pitfalls

•Committing without reviewing the diff first.
•Deploying both leaves of an MLAG/ESI pair at once and dropping the redundant path.
•Assuming Aruba commit semantics match other vendors — they differ.

Gotchas to watch

•compare_config() returns an empty string (not None) when there is no change — test truthiness.
•Losing your management session mid-commit can lock you out without confirmed-commit.

Verify it works

•After deploy, re-read EVPN neighbors and confirm every peer returned to up.
•Diff running-config against intent post-change to prove zero unexpected drift.