Arista SD-Branch Part 5: Wi-Fi 7 Access Points and CV-CUE Wireless Management
The wireless half of Arista’s branch stack is managed from CV-CUE, CloudVision Cognitive Unified Edge, not from the same studios as the switches. This post covers the Wi-Fi 7 access point range and how CV-CUE organises SSIDs, roles and security. It is based on Arista’s specifications and published lab material, and I have not deployed any of it.
The access point range
| Model | Type | Radios | Power | Ports |
|---|---|---|---|---|
| C-460 | Indoor | 4x4 on 2.4, 5 and 6 GHz, multi-function tri-band, BLE 5.3 IoT, GNSS | 802.3bt, or 802.3at with reduced functionality | 2 x 10GbE |
| C-430 | Indoor | 2x2 on all three bands, multi-function, BLE 5.3, GNSS | 802.3at | 2 x 5GbE |
| C-400 | Indoor | 2x2 on all three bands, no multi-function or IoT radio | 802.3at | 1 x 5GbE |
| O-435 | Outdoor | 2x2, multi-function, BLE 5.3, GNSS | 802.3bt, or 802.3at with reduced functionality | 1 x 5GbE |
| O-405 | Outdoor | 2x2, no multi-function radio | 802.3at | 1 x 5GbE, 1 x 10GbE SFP+ |
The C-460 is the only model with 4x4 radios on every band. Its listed maximum data rate is 11.5, 5.76 and 1.4 Gbps across the three bands, against 5.75, 2.88 and 0.7 Gbps for the 2x2 models. Arista also lists HADM, OpenThread, Matter and ZigBee as hardware-capable features with software support to follow, so do not plan around them yet.
For most branches the C-430 is the sensible middle. It runs on plain 802.3at, which every PoE port on a 710P supplies, and its 5GbE uplink matches the switch’s mGig ports. The C-460 earns its place where client density justifies the bt power draw.
What the multi-function radio does
Arista states that all of its access points support WIPS, either through the multi-function radio or by background scanning on the access radios. That is the wireless intrusion prevention story, and it is why the C-400 and O-405, which lack the extra radio, rely on the background-scan method. I compared the wireless side of this with Cisco, Fortinet and Juniper in Five Minutes and an Empty Port Part 10.
How CV-CUE is organised
From Arista’s wireless lab material, the main objects are:
- Folders. Access points are placed in a folder, and settings inherit down the folder tree.
- Roles. A role bundles what a client is allowed to do: VLAN, firewall rules, bandwidth limits. The lab guest role keeps things simple with a placeholder VLAN, and the lab notes that production would use a real guest VLAN.
- SSIDs. Each SSID carries its client authentication method, its role assignment rules and its radio settings. The guest SSID in the lab is private, on 5 GHz only.
- RADIUS servers. An authentication server definition, which for AGNI is a RadSec server on port 2083 using the AGNI CA and a certificate tag.
The role assignment on an SSID can match on the default 802.1X VSA. That is the hook that lets a RADIUS server such as AGNI decide which role a client lands in, instead of baking the decision into the SSID.
A certificate for every access point
Nothing in the RadSec design is unusual for a switch, but it is easy to forget that APs need the same treatment. In CV-CUE, you generate a CSR for the AP under a certificate tag, get it signed by AGNI, and upload the signed certificate to the AP with the same tag. The tag then ties the AP’s certificate to the RADIUS server definition. Part 9 walks through the sequence.
Where wired and wireless meet
The reason to run both sides under one vendor is policy consistency. A user authenticated by EAP-TLS on a wired port and on an SSID hits the same AGNI segments and role profiles. The switches and APs are different enforcement points for one policy engine, which is the shape of Parts 6 to 9.