Arista SD-Branch Part 6: AGNI Explained, Networks, Segments and Role Profiles
AGNI is the policy engine in this stack. The switches and access points do not decide who gets in. They ask AGNI and enforce the answer. Before configuring any of that, it helps to know what AGNI’s objects are and how they chain together. This post is built from Arista’s AGNI datasheet and published lab material, and I have not used the product myself.
What AGNI does
| Capability | What the datasheet says |
|---|---|
| Authentication | 802.1X, MAC Bypass Authentication, UPSK, captive portal |
| Onboarding | Built-in PKI with SCEP and EST, full certificate lifecycle, self-service SSO onboarding |
| External PKI and MDM | Works with Jamf and Microsoft Intune |
| Device profiling | DHCP fingerprinting, user agent strings, LLDP, plus richer data from partners such as Medigate and CrowdStrike |
| Guest access | Guest book, SMS, host approval, social login, web forms, click-through |
| Transport | RadSec between AGNI and switches or APs |
| Identity | OAuth 2.0 and OIDC federation with Google Workspace, Okta, OneLogin and Azure AD |
| API | OpenAPI 3.0 |
It also works with Arista, Cisco and HPE access devices, which matters if a branch is not all Arista yet.
The object model
Arista’s lab material makes the structure clear, and it follows a pattern anyone who has used a policy-based NAC will recognise.
- Access devices and groups. The switches and APs that ask AGNI for decisions. You add them individually and group them, for example a wired group and a wireless group. Each one needs a client certificate for RadSec, which Part 7 covers.
- Networks. A network describes how a kind of access authenticates. A wired EAP-TLS network sets the authentication method, whether MAC fallback is allowed (and whether it is limited to registered clients), and whether onboarding is on. A guest network uses captive portal authentication with a portal type.
- Segments. A segment is the rule. It has conditions, for example the network name and the authentication type, and an action such as allow access. This is where policy actually lives.
- Role profiles. The result of a matching segment. A guest segment, for instance, assigns a guest role profile, which CV-CUE or the switch maps to a VLAN or a set of firewall rules.
- Clients and users. The identities and devices policy applies to, either registered by hand, onboarded through the PKI, or created through the guest flow.
The useful mental model is: network says how you authenticate, segment says what you are allowed, role profile says what that looks like on the wire.
Authentication methods in practice
EAP-TLS is the strong option. The client presents a certificate, no password crosses the network, and the private key stays on the device. The datasheet specifically calls out corporate devices authenticating with certificates and no passwords.
MAC bypass exists for devices that cannot do 802.1X, such as printers and sensors. Combined with device profiling, you can restrict a MAC to the device class it should be. A plain MAC allow-list is easy to spoof, which I covered from the attacker’s side in Five Minutes and an Empty Port Part 8. Profiling is what makes MAB defensible.
UPSK gives each user or device group its own pre-shared key on one SSID. That is the sensible answer for IoT and consumer-grade devices that cannot do 802.1X but should not share one passphrase.
Guest access covers portals, SMS and host approval, with the captive portal URL configured on the CV-CUE side.
Why RadSec
RADIUS over UDP sends AAA traffic with only a shared secret protecting parts of it. RadSec wraps RADIUS in TLS with mutual certificate authentication, on port 2083. For a branch whose switches reach a cloud service across the internet, that is the right choice and effectively the only sensible one. I made the same argument for FortiGate in Part 1 of the RADIUS vs TACACS+ series.
Licensing and scale
AGNI is a subscription sold on a pay-as-you-go basis, priced by the average number of concurrently active end-user and IoT devices over a seven-day period. Tiers run from 100 to 10,000 devices, and software support is included. The seven-day averaging matters for a branch with seasonal or visiting-device traffic, because you pay for the average and not the peak.