JNCIP-MistAI cheat sheet

Hierarchy is Organization → Sites → devices: an AP, switch, or gateway is claimed into the organization's inventory and then assigned to exactly one site.

Site-level fields include timezone, address, and country code; the country code sets the regulatory channel and transmit-power limits that APs at that site may use.

Standard roles: Super Admin (org-wide, including billing and admin management), Network Admin, Site Admin (assigned sites only), Observer (read-only), Helpdesk (client troubleshooting), Installer (claim and assign devices).

Subscriptions are per device and sold in 1, 3, 5, 7, and 10 year terms; a subscription code is claimed into the organization and then assigned to a specific device.

An unassigned subscription remains in organization inventory and can be moved to a replacement device after an RMA; removing a device does not consume the subscription.

Organization templates (WLAN, RF, switch, site) push configuration to bound sites; template-derived objects are read-only at the site until that site is unbound.

Admins are created at organization level; a site-scoped admin only sees explicitly assigned sites, and API tokens created by that admin inherit the same scope.

A claim code can be claimed into only one organization; the device then appears in that organization's inventory with a claim status and an assigned/unassigned site state.

Wireless SLEs are computed per site from classifiers - Coverage, Capacity, Roaming, Time to Connect, Throughput, and AP Health - each with a configurable target percentage.

Coverage failures are classified as weak signal, low SNR, or non-Wi-Fi interference; remediation is normally RF template power/channel planning or AP placement.

Time to Connect splits the join sequence into association, authentication (including 802.1X/EAP), DHCP, and DNS stages, so the drill-down shows which stage failed.

Throughput SLE compares achieved client throughput against what that client's capability should support, so a 1x1 phone is measured differently from a multi-stream laptop.

WLAN configuration covers SSID, security mode (WPA2/WPA3 Personal or Enterprise, OWE), VLAN assignment, authentication server, client isolation, and rate limiting.

WxLAN policies apply label-based allow/deny rules between user/device labels and resource labels, providing microsegmentation without redesigning VLANs.

An RF template holds channel and power plans, band steering, per-band radio settings, and minimum basic rates; a site is bound to a single RF template at a time.

Mist APs require only outbound HTTPS (443) to the Mist cloud; no on-premises controller is needed, and Mist Edge is added only for local traffic breakout or tunneling.

Wired Assurance is subscription-based per switch and exposes switch health, port statistics, and wired client experience through SLEs and Marvis.

Configuration is cloud-delivered: a factory-default Juniper switch whose serial is claimed in inventory performs ZTP, contacts Mist, and downloads its assigned configuration.

Organization-level switch templates define the full switch configuration (ports, VLANs, Virtual Chassis, routing); when a site is bound to a template, its switches are read-only locally.

Port profiles are reusable per-port settings (VLAN membership, PoE, speed/duplex, 802.1X) applied to selected ports or matched by rules such as LLDP neighbor type.

Virtual Chassis is defined in the switch template; the stack is managed as one logical device and member ports are addressed by member ID plus port number.

Wired 802.1X uses the switch as authenticator with RADIUS; Mist NAC can use the Mist cloud as the RADIUS/portal service or point at an external RADIUS server.

LLDP-derived neighbor data builds the wired topology and uplink/downlink relationships that Wired Assurance and Marvis use for root-cause analysis.

Marvis is Mist's AI-driven virtual network assistant; it answers natural-language questions using SLE classifiers, device events, client telemetry, and configuration data.

Marvis Actions is the prioritized issue list at organization or site scope; each action shows severity, affected scope, suspected root cause, and a remediation step.

Actions are grouped by category, for example offline APs or switches, DHCP failures, authentication failures, and VLAN or uplink misconfigurations.

Marvis Minis runs automated synthetic checks from APs and the cloud so DHCP, DNS, RADIUS, and WAN problems are detected before users report them.

Marvis conversations accept follow-up questions and return an explanation plus recommended next steps rather than a raw event dump.

Marvis Client is an endpoint agent (Windows, macOS, mobile) that streams client-side Wi-Fi telemetry to Marvis for problems the infrastructure cannot observe.

Marvis correlates wireless, wired, and WAN data when those devices are in the same organization, which is why organization scope matters for cross-domain troubleshooting.

Marvis features require the Marvis subscription; without it, SLEs and standard monitoring remain but the assistant and Marvis Actions are unavailable.

Mist REST base is https:///api/v1, for example api.gc1.mist.com, api.eu.mist.com, or api.ac2.mist.com; calls must target the region hosting the organization.

Authenticate with the header 'Authorization: Token '; tokens are created at organization or site scope and inherit the creating admin's role and privileges.

List endpoints accept limit (maximum 1000) and page parameters; responses include the results plus a total count so scripts can iterate large collections.

Mist 'search' endpoints take a POST body for server-side filtering and are preferred over downloading a full collection and filtering locally.

Mist returns HTTP 429 when rate limits are exceeded; clients should implement exponential backoff and caching instead of tight polling loops.

Webhooks are defined at organization or site level with a target URL and a topic list; site webhooks deliver that site's events only, organization webhooks deliver all sites' events.

Webhook topics include alarms, device-updowns, and audits; payloads are JSON POSTed to the configured HTTPS URL, and TLS certificate verification is controlled per webhook.

Third-party integration paths are webhooks (Slack, Teams, ServiceNow, or any HTTPS receiver), direct REST API polling, and Mist's built-in integration applications.