diff --git a/roles/aruba/defaults/main.yml b/roles/aruba/defaults/main.yml
index 0b4071d..8533a55 100644
--- a/roles/aruba/defaults/main.yml
+++ b/roles/aruba/defaults/main.yml
@@ -4,6 +4,7 @@ aruba__vlans: {}
 aruba__interfaces: {}
 aruba__default_gateways: []
 aruba__ssh_enabled: False
+aruba__rest_enabled: True
 aruba__loop_protect_disable_timer: 30
 aruba__loop_protect_tx_interval: 3
 ...
diff --git a/roles/aruba/templates/config.j2 b/roles/aruba/templates/config.j2
index be62f83..642e644 100644
--- a/roles/aruba/templates/config.j2
+++ b/roles/aruba/templates/config.j2
@@ -66,9 +66,12 @@ no ip ssh
 {% endif %}
 
 no telnet-server
+
+{% if aruba__rest_enabled %}
 ; FIXME: ssl
 web-management plaintext
 rest-interface
+{% endif %}
 
 {%
 set loop_protect =