Post 4: Groups, Sites, and Organizational Structure – The Foundation for Scale (Week 4)

Purpose

Teach readers how to logically organize devices using Groups (for configuration) and Sites (for monitoring), setting up a scalable architecture.

Content Outline

Why Organization Matters

• Groups = configuration containers (devices in same group share config)
• Sites = physical locations (used for monitoring, reporting, maps)​
• Labels = flexible tags for filtering and reporting​
• Proper organization now saves hours of troubleshooting later

Understanding Groups

• Groups apply configurations to all member devices
• UI-based groups: Configure via web interface (point-and-click)​
• Template-based groups: Configure via CLI scripts and variables​
• Device-specific groups: AOS-CX switches, AOS-S switches, APs, Gateways
• Important: Devices can only belong to one group at a time

UI Groups vs. Template Groups: Which to Choose?

Feature	UI Groups	Template Groups
Learning curve	Easy, visual interface	Requires CLI knowledge​​
Flexibility	Limited to UI options	Full CLI control​​
Speed	Slower for bulk changes	Fast for bulk changes​​
Best for	Small-medium deployments, APs	Large deployments, switches​​
Version control	Not available	CLI templates can be versioned​

Recommendation: Start with UI groups for APs; consider template groups for switches if you're comfortable with CLI.​​

Step 1: Create Your First Group (UI-Based for APs)

• In Central, click "Global" in the context filter (top-left)​
• Click the "Groups" column title​
• Click the "+" (plus sign) in the upper-right corner​​
• In the "Add Group" wizard, configure:
  • Group Name: Use a descriptive name (e.g., "Corp-Campus-APs", "Branch-01-APs")​
  • Device Type: Check "Access Points"​
  • Click "Next"​
  • Configuration Mode: Select "UI" (default)
  • Click "Add"​

Step 2: Move Devices to Your Group

• New devices land in the "default" group automatically
• Set context filter to "Global" or "All Devices"
• Navigate to "Manage" > "Devices" > "Access Points"
• Find your devices in the "default" group (expand the group if needed)
• Select the devices you want to move (checkboxes)
• Click "Move Device" button (bottom-right corner)
• Select your new group as the destination
• Click "Move"
• Critical: Verify configuration sync in Audit Trail

Verifying Configuration Sync

• Set context to your new group​
• Click "Audit Trail" from the left menu
• Look for "Access Point Configuration sync successful" message
• If sync fails, check: AP has internet connectivity, DNS resolution working, firewall not blocking Central

Understanding Sites

• Sites represent physical locations (buildings, floors, campuses)​
• Used for monitoring, not configuration​
• New Central requirement: All devices must be assigned to a site​
• Sites enable location-based reporting and maps​​

Step 3: Create Your First Site

• Switch context filter to "Global"​​
• Click "Organization" in the left menu​​
• Click the number above "Sites"​​
• Click "New Site" (bottom-left of Network Structure pane)​​
• Fill in site details:
  • Site Name: Descriptive (e.g., "HQ-Building-A", "Branch-NYC")
  • Address: Street, city, state, postal code
  • Latitude/Longitude: Auto-populated from address (used for maps)​
  • Time Zone: Important for accurate event logs​
  • Contact: Optional, but helpful for multi-site deployments​
• Click "Add"

Step 4: Assign Devices to Sites

• After creating the site, you'll see it in the site list​​
• Drag and drop devices from the device list on the right into the site on the left​
• Or: Click the site name, then drag devices into it​​
• Central prompts you to confirm—click "Yes"​​
• Verify: Click the site name and check that your devices appear in the device list​​

Best Practices for Groups and Sites

Group Design:

• Create groups based on configuration similarity, not location
• Examples: "Corporate-APs", "Guest-APs", "IoT-APs"​
• Avoid too many groups—consolidate where possible​

Site Design:

• Create sites based on physical locations, not configuration​​
• Use hierarchical naming: "Region-Building-Floor" (e.g., "US-West-HQ-Floor2")​
• One device can be in one site, but you can create site hierarchies​​

Labels (Bonus):

• Labels are flexible tags you create (e.g., "High-Density", "Outdoor", "Conference-Rooms")​
• Useful for filtering and custom reports​
• One device can have multiple labels​

Common Issues and Troubleshooting

• "Configuration sync failed": Check AP internet connectivity, DNS, firewall rules for Central
• "Can't move device to group": Ensure device is in "default" group first; check device type matches group type​
• "Device not showing in site": Refresh browser; verify drag-and-drop action completed​​

Lionel's TIp: Scaling Your Organization Structure
In enterprise environments, I've seen two successful models:

1. Geography-based groups: "HQ-APs", "Branch-APs"—simple but requires duplicate configs across locations
2. Function-based groups: "Corp-APs", "Guest-APs", "Warehouse-APs"—scales better, uses dynamic VLAN assignment

For most deployments, function-based groups + site-based sites gives you the best of both: centralized config management with location-specific monitoring.

What We Accomplished
✅ Created our first group (UI-based for APs)
✅ Moved devices from "default" group to our new group
✅ Verified configuration sync via Audit Trail
✅ Created our first site with location details
✅ Assigned devices to the site
✅ Understand the difference between groups (config) and sites (monitoring)

Next Week: We'll physically install our access points and watch them automatically provision via Zero-Touch Provisioning. Bring your power cables and network drops!