11.3 AI Insights and Aruba User Experience Insight (UXI)

AI Insights and Aruba User Experience Insight (UXI)

Quick Summary: Modern enterprise network operations require shifting from reactive device monitoring to proactive user experience validation. While traditional network management systems report that switches and access points are online ("all green lights"), end users may still suffer from slow authentication, dropped calls, or unresponsive cloud applications. Aruba addresses this gap through two complementary technologies: Aruba Central AI Insights (which uses machine learning to detect anomalies in passive infrastructure telemetry and prescribe root-cause fixes) and Aruba User Experience Insight (UXI) (which deploys dedicated hardware sensors acting as synthetic clients to continuously test services and SaaS applications from the end-user perspective).

---

The Operational Challenge: Infrastructure Health vs. User Experience

A classic frustration for campus network administrators is the disconnect between network infrastructure monitoring and real-world user satisfaction. An access switch may show 0% packet loss on its uplinks, and an access point may show 100% radio availability, yet users in that building report that they cannot connect to Wi-Fi, cannot acquire an IP address, or experience severe jitter during video conference calls.

This phenomenon occurs because traditional monitoring is passive and infrastructure-centric:

• It checks whether physical ports are up and CPU utilization is within limits.
• It rarely evaluates whether a DHCP server is running out of IP addresses in a specific scope.
• It does not measure the round-trip latency of an internal DNS resolver.
• It does not verify whether external SaaS applications (such as Microsoft Teams, Zoom, or Salesforce) are reachable and performing acceptably from a client workstation.

To bridge this visibility gap, Aruba combines passive AI telemetry analysis (AI Insights) with active synthetic client testing (UXI).

---

Aruba Central AI Insights: Machine-Learning Anomaly Detection

AI Insights is an advanced analytics engine integrated directly into Aruba Central. Rather than relying on simple static threshold alarms (such as alerting whenever bandwidth exceeds 80%), AI Insights applies machine learning algorithms across billions of telemetry data points collected from thousands of customer networks.

Core Capabilities of AI Insights

1. Dynamic Baseline Modeling: The machine learning engine continuously analyzes normal traffic, client association volumes, RF interference, and protocol handshake latencies for each specific site. It models historical operational baselines that account for time-of-day, day-of-week, and academic or business seasonal cycles. An activity level that is anomalous at 3:00 AM on a Sunday might be recognized as completely normal at 10:00 AM on a Tuesday.
2. Outlier Detection: AI Insights compares current behavior with learned baselines and with similar devices in the same network to spot outliers, such as an AP whose retry rate is far above its neighbors.
3. Automated Root Cause Analysis (RCA): When a network issue arises, traditional monitoring tools flood administrators with dozens of disconnected alarms. AI Insights correlates multi-tier telemetry to identify the single underlying root cause. For example, if 50 wireless clients fail to connect in Building B, AI Insights correlates the failure logs to discover that the upstream RADIUS server is timing out on EAP requests, rather than blaming the wireless AP radios.
4. Prescriptive Recommended Actions: AI Insights does not merely state that a problem exists; it provides actionable, step-by-step engineering recommendations for remediation. In many cases, Central provides a one-click automated fix or directs the engineer to the exact switch port, VLAN, or configuration parameter requiring adjustment.

Common AI Insights in Campus Deployments

• Excessive 802.1X Authentication Failures: Detects spikes in EAP timeouts or Access-Reject packets, isolating whether the issue is caused by expired client certificates, wrong shared secrets, or RADIUS server latency.
• DHCP Server Latency and Exhaustion: Identifies subnets where DHCP Discover-to-ACK response times exceed acceptable thresholds or where pools are nearing exhaustion before users receive 169.254.x.x link-local addresses.
• DNS Latency and Resolution Failure: Tracks DNS query latency per server, alerting operators when a specific internal or external resolver fails to respond to client lookups.
• Wi-Fi RF and Roaming Anomalies: Identifies high co-channel interference, excessive channel utilization, suboptimal channel assignments, or "sticky clients" that fail to roam to closer APs.
• Switching Telemetry Anomalies: Flags excessive Spanning Tree Protocol (STP) topology change notifications (TCNs), rapid switch port flapping, duplex mismatches, and PoE budget exhaustion on access switches.

---

Aruba User Experience Insight (UXI) Architecture

While AI Insights analyzes passive telemetry generated by network infrastructure, Aruba User Experience Insight (UXI) takes an active, synthetic approach. UXI deploys dedicated physical hardware sensors directly into end-user work environments.

Hardware Sensor Characteristics

• Dedicated Synthetic Client: A UXI sensor is not an access point, router, or packet sniffer. It is a purpose-built client device equipped with Wi-Fi, Ethernet, and Bluetooth radios.
• Realistic Physical Vantage Point: Sensors are mounted at desk or user height where employees, students, or medical personnel work, experiencing the exact same RF conditions, physical obstacles, and signal attenuation as real laptops and smartphones.
• Reporting Path: Sensors send results to the UXI cloud dashboard. Cellular-capable sensor models include an LTE modem, so they can still report when the local network they are testing fails.

---

The UXI End-to-End Synthetic User Journey

To evaluate network quality, a UXI sensor continuously simulates the complete user connectivity journey, executing a loop of synthetic tests every few minutes:

+--------------------------------------------------------------------------+
| Step 1: Wireless & RF Association                                        |
| - Connects to SSID/BSSID; records RSSI, SNR, and channel utilization     |
+--------------------------------------------------------------------------+
                                     |
                                     v
+--------------------------------------------------------------------------+
| Step 2: Network Security & Authentication                                |
| - Performs 802.1X EAP-TLS/PEAP, WPA3-SAE, or Captive Portal web login    |
+--------------------------------------------------------------------------+
                                     |
                                     v
+--------------------------------------------------------------------------+
| Step 3: Layer 3 Addressing (DHCP DORA)                                   |
| - Measures round-trip time for Discover, Offer, Request, ACK lease        |
+--------------------------------------------------------------------------+
                                     |
                                     v
+--------------------------------------------------------------------------+
| Step 4: Name Resolution (DNS)                                            |
| - Queries internal & external resolvers; measures resolution latency     |
+--------------------------------------------------------------------------+
                                     |
                                     v
+--------------------------------------------------------------------------+
| Step 5: Application & SaaS Performance                                   |
| - Executes synthetic HTTP/HTTPS transactions to Teams, Zoom, Webex, M365  |
+--------------------------------------------------------------------------+
                                     |
                                     v
+--------------------------------------------------------------------------+
| Step 6: Results and Issues                                               |
| - Test results and detected issues are reported to the UXI dashboard     |
+--------------------------------------------------------------------------+

The Synthetic Test Steps in Detail

1. Wi-Fi Association: The sensor scans for configured SSIDs, associates to target BSSIDs across 2.4 GHz, 5 GHz, or 6 GHz bands, and logs physical RF metrics including Received Signal Strength Indicator (RSSI) and Signal-to-Noise Ratio (SNR).
2. Authentication: The sensor authenticates using enterprise credentials. For corporate networks, it tests 802.1X (EAP-TLS or PEAP-MSCHAPv2). For guest networks, it loads captive portal splash pages, accepts terms of service, and submits guest credentials.
3. DHCP DORA Exchange: The sensor initiates a standard DHCP lease exchange (Discover, Offer, Request, ACK) and records how long it takes, flagging slow or failed DHCP as an issue.
4. DNS Name Resolution: The sensor issues DNS queries for common corporate hostnames and public domains, measuring lookup response times and tracking lookup failures.
5. Application and Cloud SaaS Testing: The sensor tests internal intranet servers and external cloud services (such as Microsoft 365, Google Workspace, Zoom, Cisco Webex, Salesforce, and custom HTTP web services). It measures round-trip time, web page load times, VoIP packet jitter, and packet loss.
6. Results and Issues: Every test result is reported to the UXI dashboard, which shows where in the journey a failure happened (Wi-Fi, authentication, DHCP, DNS, or application), so the engineer knows which team and which part of the network to investigate.

---

Isolating Fault Domains: Wired vs. Wireless vs. Service

By systematically evaluating each tier of the connection sequence, UXI sensors and AI Insights allow network engineers to isolate the exact fault domain of an outage:

---

Comparing AI Insights and UXI Sensors

---

Common Exam Traps

• Role of the UXI Sensor: Remember that a UXI sensor functions strictly as an end-user client. It never broadcasts SSIDs, forwards transit packets, acts as a router, or replaces an enterprise access point.
• AI Insights Prerequisites: AI Insights does not require dedicated UXI hardware sensors; it operates natively on the telemetry generated by standard Aruba CX switches and APs managed in Aruba Central.
• Symptom vs. Cause: Exam scenarios frequently ask how to diagnose a situation where "users report Wi-Fi is down," but diagnostic data shows 802.1X EAP timeouts. The correct deduction is that the authentication server (RADIUS) is failing, not the Wi-Fi physical medium.