Mist Cloud Architecture
Juniper Mist is a microservices-based cloud platform running on AWS that manages Wi-Fi, wired, WAN, and location services. Every AP, switch, and SSR device establishes a secure WebSocket (TLS 1.2+) connection to the Mist cloud on TCP 443. Configuration, telemetry, and Marvis AI inference all happen via this persistent connection.
Core Services
- Wi-Fi Assurance
- Wired Assurance
- WAN Assurance
- Marvis Virtual Network Assistant
- Premium Analytics
- User Engagement / Asset Visibility
Cloud Regions
- Global (api.mist.com)
- EMEA (api.eu.mist.com)
- APAC (api.ac5.mist.com)
- GovCloud (api.gc1.mist.com)
- Data sovereignty controlled per org
Organization → Site Hierarchy
A Mist Organization (Org) is the top-level tenant. Under the Org you have Sites (physical locations), and under each site you have devices (APs, switches, gateways) and clients.
Organization: "Acme Corp"
├─ Templates (WLAN / RF / Switch / WAN Edge)
├─ Site Groups (HQ, Retail, Branch)
├─ Sites
│ ├─ Site: HQ-London
│ │ ├─ APs, Switches, SSR/SRX
│ │ ├─ Site Variables
│ │ └─ WLANs (site-level override)
│ └─ Site: Retail-NYC-042
└─ Admins / RBAC / API Tokens
Templates & Inheritance
WLAN Template
Defines SSIDs, security, VLANs, RADIUS servers. Applied to Site Groups or individual Sites. Site-level overrides merge with the template.
RF Template
Radio band settings, channel widths (20/40/80/160 MHz), min/max power, DFS exclusions, country regulatory codes.
Switch Template
Port profiles, VLAN definitions, authentication policies, NTP/Syslog/SNMP, IP config, RADIUS for 802.1X.
WAN Edge Template
Applied to SSR or SRX devices. Defines applications, traffic-steering, SLA policies, secure overlay, service policies.
Site Variables (Jinja-style)
Site variables let one template drive many sites. Reference them in template fields as {{VARIABLE_NAME}}.
{
"SITE_VLAN_DATA": "100",
"SITE_VLAN_VOICE": "200",
"SITE_VLAN_GUEST": "300",
"SITE_RADIUS_PRIMARY": "10.10.5.10",
"SITE_RADIUS_SECRET": "{{vault:radius_secret}}",
"SITE_NTP": "time.acme.corp",
"SITE_DNS": "8.8.8.8,1.1.1.1"
}
RBAC: Admin Roles
| Role | Scope | Permissions |
|---|
| Super User | Org | Full admin of the Org incl. billing/admins |
| Network Admin | Org or Site | Configure, deploy, modify; cannot add admins |
| Observer | Org or Site | Read-only monitoring and reports |
| Helpdesk | Site | Client actions (reconnect, view), no config |
| Installer | Site | Claim/onboard APs, assign locations on floorplan |
Labels
Labels are tags used in WxLAN policies, analytics filters, Marvis queries, and reporting. Types include:
- Client Labels (MAC, Radius username, PSK name, user group from IDP)
- Resource Labels (hostname, IP range, app-name, GBP tag, AD group)
- Asset Labels (BLE asset name, named AP, Zone)
- Custom Labels (free-text for WxLAN matching)
Webhooks & Alerts
{
"url": "https://siem.acme.corp/mist/events",
"secret": "changeme-shared-secret",
"enabled": true,
"topics": [
"device-events",
"alarms",
"audits",
"client-join",
"client-sessions",
"location"
],
"verify_cert": true
}
HMAC-SHA256 is included in the X-Mist-Signature-v2 header; verify before accepting payloads.
API Tokens & Basic Calls
Create API tokens under My Account → API Tokens (user scope) or Org → API Tokens (org scope). Token goes in the Authorization header.
# List sites in an org
curl -s https://api.mist.com/api/v1/orgs/$ORG_ID/sites \
-H "Authorization: Token $MIST_TOKEN" | jq .
# Get site stats
curl -s https://api.mist.com/api/v1/sites/$SITE_ID/stats \
-H "Authorization: Token $MIST_TOKEN"
# Create WLAN on a site
curl -X POST https://api.mist.com/api/v1/sites/$SITE_ID/wlans \
-H "Authorization: Token $MIST_TOKEN" \
-H "Content-Type: application/json" \
-d '{"ssid":"Corp","auth":{"type":"eap","eap_reauth":false},
"vlan_ids":[100],"enabled":true}'
Python (mistapi SDK)
import mistapi
from mistapi.api.v1.orgs import sites as orgs_sites
apisession = mistapi.APISession(
host="api.mist.com",
apitoken="YOUR_TOKEN"
)
apisession.login()
org_id = "c0ffee00-dead-beef-0000-112233445566"
resp = orgs_sites.listOrgSites(apisession, org_id)
for site in resp.data:
print(site["id"], site["name"])
Org-Level Settings Reference
| Setting | Where | Purpose |
|---|
| Password Policy | Organization → Settings | Length, complexity, expiry for admins |
| 2FA / SSO | Organization → Settings → SSO | SAML 2.0 with Azure AD, Okta, Google, Ping |
| Audit Logs | Organization → Audit Logs | All admin actions, streamable to SIEM |
| API Rate Limits | 5000 requests / hour (token) | 429 on exceed — use pagination |
| Session Timeout | Organization → Settings | Admin UI idle timeout (default 60 min) |
| Device Claim Email | Organization → Settings | Notifies on new claim / onboarding |
SSO / SAML Federation
Federate admin login with your IDP. Mist acts as SP, IDP supplies role via SAML attribute.
{
"idp_type": "saml",
"nameid_format": "email",
"idp_sso_url": "https://login.microsoftonline.com/TENANT/saml2",
"idp_cert": "-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----",
"role_attr_from": "Role",
"role_attr_extraction": "mist-${role}",
"role_mappings": {
"mist-admin": "admin",
"mist-helpdesk": "helpdesk",
"mist-observer": "observer"
}
}
Mist Edge
Mist Edge is an on-prem appliance (x86 or VM) that terminates mGRE tunnels from APs. It is used for:
- Tunneling user traffic back to a DC (classic WLC replacement)
- Anchor VLANs across L3 boundaries
- DHCP/DNS relay and policy enforcement at the edge
- 802.1X proxy / RadSec termination
WLAN config snippet (tunneled SSID):
{
"ssid": "Corp-Tunneled",
"vlan_ids": [210],
"auth": {"type":"eap"},
"mist_edges": ["edge-cluster-hq"],
"tunnel_protocol": "mgre"
}