Juniper Mist

---
name: juniper-mist
description: "Expert coverage of Juniper Mist AI-driven wireless platform: Mist AI cloud architecture, Marvis AI assistant, Marvis Minis, Service Level Expectations (SLEs), Mist Edge, AP families, Wired Assurance, WAN Assurance, BLE location services, and vBLE. Use for \"Juniper Mist\", \"Mist AI\", \"Marvis\", \"Marvis Minis\", \"Mist SLE\", \"Mist Edge\", \"Wired Assurance\", \"WAN Assurance\", \"vBLE\", \"Mist AP\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `wireless` skill."
license: MIT
---

# Juniper Mist Wireless

This skill covers the Juniper Mist AI-driven cloud networking platform for wireless, wired, and WAN. Areas of expertise include:

- Mist AI cloud architecture and AI-native operations
- Marvis conversational AI assistant for root-cause analysis
- Marvis Minis virtual network sensors for proactive testing
- Service Level Expectations (SLEs) and classifier-based root-cause analysis
- Mist Edge on-premises gateway for tunnel termination and security
- AP families: AP12/21 (Wi-Fi 6), AP32/43/45 (Wi-Fi 6E), AP63/64 (outdoor 6E)
- Wired Assurance for Juniper EX switch management
- WAN Assurance for Session Smart Router (SSR) SD-WAN management
- BLE and vBLE location services (asset tracking, wayfinding, proximity)
- Mist REST API for automation and integration

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Use Marvis AI, SLE classifiers, and Mist dashboard event correlation
   - **Design / Deployment** -- Apply Mist architecture patterns, SLE-based design validation
   - **Architecture** -- Load `references/architecture.md` for Mist AI cloud, Marvis, Mist Edge, BLE, Wired/WAN Assurance
   - **Monitoring / Operations** -- Use SLEs, Marvis Minis, Org Insights dashboard
   - **Migration** -- Identify source platform (Cisco, Aruba) and map feature/operational gaps

2. **Identify deployment scope** -- Wireless-only, or unified wired + wireless + WAN (full Mist stack)? Mist's value increases with unified visibility.

3. **Load context** -- Read the reference file for deep knowledge.

4. **Analyze** -- Apply Mist-specific reasoning. Leverage AI-driven operations concepts (SLEs, Marvis Actions) rather than traditional manual troubleshooting.

5. **Recommend** -- Provide actionable guidance with Mist dashboard paths, API examples, or Marvis queries.

6. **Verify** -- Suggest validation steps (SLE metrics, Marvis Minis proactive tests, client event timeline).

## Mist AI Cloud Architecture

### Cloud-Native Design
Mist is built as a cloud-native platform from the ground up (not a legacy platform adapted for cloud):
- **Mist Cloud**: SaaS management and AI engine hosted on AWS
- **Microservices architecture**: Independent scaling of monitoring, configuration, AI/ML, analytics
- **Real-time streaming telemetry**: APs stream client, RF, and network events to cloud in real-time
- **AI/ML pipeline**: Telemetry feeds ML models for anomaly detection, root-cause analysis, and proactive alerting

### Key Components

| Component | Role |
|---|---|
| Mist Cloud | SaaS management plane; AI engine; provisioning; monitoring |
| Mist APs | Intelligent APs with BLE radio; local forwarding; cloud-managed |
| Mist Edge | On-premises gateway for tunnel termination, ZTNA, security |
| EX Switches | Juniper EX access switches managed via Wired Assurance |
| SSR Routers | Session Smart Routers managed via WAN Assurance |
| Marvis | Conversational AI assistant for troubleshooting and insights |
| Marvis Minis | Virtual sensors that proactively test network connectivity |

### Data Forwarding
- APs forward data locally (bridge to VLAN) by default
- Optional: tunnel traffic to Mist Edge for centralized policy enforcement
- Split-tunnel: corporate traffic to Mist Edge, guest traffic bridged locally
- No on-premises controller for data plane (unlike Cisco centralized mode)

## Marvis AI Assistant

Marvis is the AI engine embedded in the Mist platform:

### Natural Language Troubleshooting
- Query: "Why is Wi-Fi slow at Building 3 Floor 2?"
- Marvis correlates: RF metrics, client statistics, SLE data, switch port status, WAN SLA
- Response: Root-cause identified (e.g., "Channel utilization on AP-3F-01 is 82% due to adjacent AP co-channel interference; recommend channel change")

### Marvis Actions
Proactive, AI-driven actions:
- **Detect**: Marvis identifies anomalies automatically (unusual authentication failures, AP flapping, DHCP latency spike)
- **Diagnose**: Correlates across wired, wireless, and WAN to identify root cause
- **Suggest**: Provides specific fix recommendation
- **Agentic workflows (2025-2026)**: Marvis can autonomously investigate and resolve routine issues spanning wired/wireless/WAN without human intervention

### Cross-Domain Correlation
Marvis correlates issues across network layers:
- "Client Wi-Fi is slow" -> Marvis checks: AP RF, switch port, DHCP server, DNS resolution, WAN latency, application server health
- Single issue identified even though symptoms span multiple domains
- Reduces Mean Time to Repair (MTTR) by 50-80% compared to manual troubleshooting

## Marvis Minis

Marvis Minis are virtual network sensors that simulate user connections:

### How They Work
- Minis run on Mist APs (no additional hardware)
- Each Mini simulates a complete client connection: association -> authentication -> DHCP -> DNS -> gateway reachability -> application reachability
- Tests run continuously (configurable interval)
- Results feed into SLE metrics and Marvis AI engine

### Configuration
- Configure per site or per AP
- Define test parameters: SSID, authentication method, target applications
- Custom application monitoring: specify application name and endpoint URL/IP
- Results visible in: Mist Dashboard > Org Insights (single-pane-of-glass)

### Use Cases
- **Proactive monitoring**: Detect DHCP server failure before users call helpdesk
- **Baseline validation**: Verify network performance after changes (upgrade, configuration change)
- **NOC visibility**: Org Insights dashboard shows all Minis status with pass/fail/degraded
- **SLA verification**: Prove network meets defined service level to stakeholders

## Service Level Expectations (SLEs)

SLEs are Mist's measurable KPI framework. Each SLE has a target percentage and classifiers that break down root causes of failures.

### Wireless SLEs

| SLE | What It Measures | Target Example |
|---|---|---|
| Successful Connects | % of connection attempts that succeed | > 99% |
| Time to Connect | Duration of association + DHCP + auth | < 5 seconds |
| Throughput | Per-client throughput vs expected baseline | > 10 Mbps |
| Coverage | Signal strength adequate for service | RSSI > -72 dBm |
| Roaming | Successful fast roaming events | > 99% |
| Capacity | Channel utilization vs threshold | < 70% |
| AP Availability | AP uptime percentage | > 99.9% |

### Wired SLEs

| SLE | What It Measures |
|---|---|
| Switch Availability | Switch uptime and reachability |
| PoE Compliance | Power delivery within specification |
| AP Affinity | AP connected to expected switch |
| VLAN Compliance | Correct VLANs configured on AP ports |

### SLE Classifiers
Each SLE failure is attributed to a classifier (root cause):
- Example for "Successful Connects" failures: authentication timeout, DHCP failure, association rejection, RADIUS unreachable
- Classifiers enable targeted remediation: fix the specific root cause, not guess
- Historical trends show improvement or degradation over time

## Mist Edge

Mist Edge is an on-premises appliance (physical or virtual) for:

### Tunnel Termination
- APs tunnel SSID traffic to Mist Edge via IPsec or GRE
- Mist Edge terminates tunnels and forwards traffic to local network
- Centralized policy enforcement without on-premises controller
- Use case: corporate SSID traffic inspection, guest traffic isolation

### ZTNA Connector
- Zero-trust access for private applications
- Clients authenticate via Mist identity; Mist Edge brokers access to internal apps
- No full VPN required; application-specific access

### RadSec Proxy
- Secure RADIUS proxy (RADIUS over TLS)
- APs send RADIUS traffic to Mist Edge; Mist Edge forwards to on-premises RADIUS server
- Eliminates need for APs to directly reach RADIUS server (useful for distributed sites)

### Guest Isolation
- Dedicated internet path for guest SSIDs via Mist Edge
- Guest traffic separated from corporate network at the edge
- Configurable bandwidth limits and content filtering

## AP Families

| Family | Wi-Fi Standard | Bands | Key Features |
|---|---|---|---|
| AP12 | Wi-Fi 6 | 2.4/5 GHz | Entry-level indoor; cost-effective |
| AP21 | Wi-Fi 6 | 2.4/5 GHz | General-purpose indoor enterprise |
| AP32 | Wi-Fi 6E | 2.4/5/6 GHz | Indoor tri-band; first 6 GHz Mist AP |
| AP41 | Wi-Fi 6 | 2.4/5 GHz | General indoor enterprise |
| AP43/45 | Wi-Fi 6E | 2.4/5/6 GHz | High-density indoor; flagship 6E |
| AP63/64 | Wi-Fi 6E outdoor | 2.4/5/6 GHz | Outdoor/ruggedized; IP67 |

All Mist APs include:
- Integrated BLE radio for location services
- USB port for IoT sensor connectivity
- Cloud-managed via Mist cloud
- Zero-touch provisioning (DHCP/DNS-based cloud discovery)

## Wired Assurance

Wired Assurance extends Mist AI to Juniper EX switch management:
- **Zero-Touch Provisioning (ZTP)**: EX switches claim to Mist cloud via DHCP/DNS; no manual configuration
- **AI-driven insights**: Port anomalies, STP issues, PoE problems detected automatically
- **Marvis Actions**: Suggested fixes for switch issues
- **CableSim**: Virtual cable testing identifies cable/transceiver issues without physical testing
- **Unified dashboard**: Switches, APs, and WAN devices in single Mist dashboard

### Supported Switches
- EX2300, EX3400, EX4100, EX4300, EX4400, EX4650 series
- Configuration via Mist cloud or Junos CLI (Mist manages Junos configuration)
- Port-level visibility: per-port traffic, PoE status, connected device identification

## WAN Assurance

WAN Assurance integrates Juniper Session Smart Routing (SSR) into Mist AI:
- **SD-WAN**: SSR routers managed from Mist dashboard alongside wireless and wired
- **Application-aware routing**: Per-application SLA steering across WAN links
- **AI operations**: Mist AI detects WAN anomalies, correlates with wireless/wired issues
- **MTTR reduction**: AI correlation across all network layers for faster root-cause analysis
- **Marvis Minis in WAN**: Simulate user flows through WAN paths to detect issues proactively

## BLE and Location Services

### vBLE (Virtual BLE)
Mist's patented directional BLE technology:
- Software-defined BLE antenna arrays in Mist APs
- Sub-meter accuracy for indoor location (vs 3-5 meter for traditional Wi-Fi triangulation)
- No additional BLE beacons or infrastructure needed

### Use Cases
- **Asset tracking**: BLE tags on equipment tracked in real-time on floor maps
- **Wayfinding**: Turn-by-turn indoor navigation via mobile app integration
- **Proximity services**: Trigger workflows when assets/people enter defined zones
- **Contact tracing**: Historical location data for compliance and safety

### Wi-Fi Location
Also available for devices without BLE:
- RSSI triangulation combined with AI for 3-5 meter accuracy
- Works with any Wi-Fi client (no BLE required)
- Adequate for zone-level location (room, area) but not precise positioning

## Mist REST API

Mist provides comprehensive REST APIs:
```
GET  /api/v1/orgs/{org_id}/sites                    # List sites
GET  /api/v1/sites/{site_id}/devices                 # List APs/switches
GET  /api/v1/sites/{site_id}/stats/devices           # Device statistics
GET  /api/v1/sites/{site_id}/stats/clients           # Client statistics
POST /api/v1/sites/{site_id}/wlans                   # Create WLAN
GET  /api/v1/orgs/{org_id}/sles/{sle_metric}         # SLE data
POST /api/v1/sites/{site_id}/devices/claim           # Claim device
```

**Webhook events**: Mist streams events via webhook for real-time integration:
- Client connect/disconnect, AP status change, alert triggers, Marvis Action events
- Integration with ServiceNow, PagerDuty, Slack, custom event handlers

## Common Pitfalls

1. **Treating Mist like a traditional controller-based platform** -- Mist is cloud-native. Do not try to replicate on-premises controller workflows. Embrace SLE-driven operations and Marvis AI instead of manual CLI troubleshooting.

2. **Ignoring SLE classifiers** -- SLE dashboards show a percentage, but the real value is in classifiers. A "95% successful connects" SLE is meaningless without knowing that the 5% failure is caused by "DHCP timeout" (classifier). Fix the classifier, not the symptom.

3. **Deploying without Wired Assurance** -- Mist's AI correlation is most powerful when it sees wireless + wired + WAN. Deploying wireless-only limits Marvis's ability to identify root causes that involve switch ports or WAN links.

4. **Over-relying on Mist Edge** -- Mist Edge is needed for tunnel termination and ZTNA, but many deployments work well with local bridging. Only deploy Mist Edge when centralized policy enforcement is truly required.

5. **Not configuring Marvis Minis** -- Marvis Minis are included with the platform but must be configured. Without Minis, proactive monitoring is limited to reactive alerts. Configure Minis for at least the primary SSID at every site.

6. **BLE deployment without floor maps** -- vBLE location requires accurate floor maps imported into Mist with correct scale and AP placement. Without floor maps, location accuracy degrades significantly.

7. **Expecting precise Wi-Fi location** -- Wi-Fi-based location provides 3-5 meter accuracy (zone-level). For sub-meter accuracy (asset tracking, wayfinding), BLE tags with vBLE are required.

8. **Cloud connectivity requirements** -- Mist requires outbound HTTPS (port 443) from APs to Mist cloud. Ensure firewall rules permit this. If internet fails, APs continue forwarding but lose management, monitoring, and Marvis AI.

## Reference Files

Load these when you need deep knowledge:
- `references/architecture.md` -- Mist AI cloud, Marvis AI/Minis, AP families, Mist Edge, Wired/WAN Assurance, SLEs, BLE/vBLE. Read for "how does X work" architecture questions.