Architecture, Deployment, and Licensing
Domain 1 tests how the ExtremeCloud IQ Site Engine (XIQ-SE) suite is assembled, what each component does, how traffic reaches the server, and which licence unlocks which feature.
One server, several licensed applications
- XIQ-SE is the on-premises management platform (successor to Extreme Management Center). The Management Center core handles discovery, inventory, configuration, topology, alarms and reporting.
- Optional applications run on the same appliance and are enabled by licence: Extreme Control (NAC/RADIUS), Extreme Analytics (flow-based visibility), Extreme AirDefense (wireless IPS and rogue detection), plus fabric provisioning tools.
- You scale by sizing the appliance and, for resilience, pairing two servers in HA - not by installing each application on its own VM.
Deployment shapes and prerequisites
- Delivered as OVA/qcow2/VHD for VMware ESXi, Hyper-V or KVM, or as an Extreme hardware appliance. Sizing follows managed devices, concurrent endpoints and flow rate.
- Give the server a static IP and resolvable FQDN, working DNS, NTP and the correct time zone. Devices, APs and controllers call home by name or address; DHCP addressing breaks onboarding and certificates.
- Operators use either the browser UI (HTTPS 443) or the thick client, which connects on 8443 and must match the server release.
Ports the exam expects
- SNMP 161 (polling) and 162 (traps), syslog 514, SSH 22 / Telnet 23 for CLI, RADIUS 1812/1813 with CoA 3799 for Control, TACACS+ 49, LDAP 389/636, SMTP 25 for alarm mail.
- Flow exports for Analytics arrive over NetFlow/IPFIX/sFlow (commonly 2055/9995/6343).
Licensing logic
- A base server licence covers the platform; add-on entitlements unlock and scale features: device licences per managed device (third-party devices always need one), Control licences per concurrent endpoint, AirDefense per protected AP, Analytics by flow source and rate.
- Licences are installed from the administration area and bind to the server identity, so a rebuilt host needs re-hosting. A missing licence greys out a module rather than breaking the install.
Worked example
A design has 60 Extreme switches, 120 APs, and 1,500 staff who may authenticate with 400 online at peak. You need 60 device licences, 120 AirDefense entitlements if WIPS is required, and 400 Control endpoint licences - concurrency, not headcount. Analytics is added only if flow export exists; without it, no licence level produces traffic charts.
Traps that cost marks
- Equating total users with Control endpoint licensing.
- Forgetting device licences for third-party switches.
- Assuming AirDefense ships with the base platform.
- Deploying on DHCP or with NTP unset.
- Running a newer thick client against an older server.