Arista ACE-S Campus cheat sheet

Spanning Tree Protocol prevents Layer 2 loops by electing one root bridge per VLAN; lowest bridge ID wins, tie broken by lowest MAC address.

RSTP (802.1w) converges in seconds using edge (PortFast-like) ports and proposal/agreement handshakes; MSTP (802.1s) maps multiple VLANs to a single spanning-tree instance.

VLANs segment broadcast domains; 802.1Q tags add a 12-bit VLAN ID (1-4094 usable) to the Ethernet frame, and native VLAN traffic is sent untagged on a trunk.

Link aggregation (LACP 802.3ad) bundles member links into a port-channel; all members must match speed, duplex, and VLAN configuration.

First-hop redundancy: VRRP uses a virtual IP with an elected master; HSRP is Cisco-proprietary; both provide a shared default gateway for hosts.

PoE standards: 802.3af delivers up to 15.4 W per port, 802.3at (PoE+) up to 30 W, and 802.3bt up to 60 W (Type 3) or 90 W (Type 4) at the PSE.

IPv4 subnetting: usable hosts = 2^(host bits) - 2; a /24 yields 254 usable addresses, a /30 yields 2 (point-to-point links).

LLDP (802.1AB) is a vendor-neutral neighbor-discovery protocol; CDP is Cisco-proprietary and not typically used between Arista and third-party gear.

EOS is a single-image, Linux-based network OS; all daemons run in separate protected memory spaces, so one process failure does not crash the system.

Sysdb is the central state database that mediates configuration and state between EOS agents and protocol daemons.

Configuration modes: enable, configure terminal (global), and interface/router sub-modes; 'write memory' or 'copy running-config startup-config' persists config.

Show commands: 'show version', 'show interfaces status', 'show ip route', 'show running-config', 'show lldp neighbors', 'show mac address-table'.

Management access: console, SSH (management API), eAPI (JSON/XML over HTTPS), and SNMP; eAPI enables programmatic configuration and telemetry.

Multi-agent routing (MAR) lets EOS run multiple routing protocol instances (e.g., OSPFv2 and BGP) with per-agent FIB programming.

Event Monitor logs system events; 'show event-monitor' and 'show agent logs' aid troubleshooting; Zero Touch Provisioning (ZTP) automates initial config via DHCP and a config file URL.

Rollback: 'configure replace' or checkpoint/rollback features restore prior configurations; 'show boot-config' reveals the active software image.

CloudVision is Arista's management and telemetry platform; CloudVision Portal (CVP) provides a single pane for configuration, change control, and streaming telemetry.

CloudVision supports Change Control workflows: configlets are attached to containers, then changes are staged, reviewed, and executed as an atomic task with rollback.

Containers and configlets form a hierarchical, tag-driven configuration model; devices inherit configlets from their parent container.

CloudVision Studios provide intent-based, form-driven configuration (e.g., VLANs, ACLs, routing) that generates the underlying device config.

Streaming telemetry (OpenConfig/gNMI) pushes state to CloudVision at high frequency, unlike polling-based SNMP.

Arista eAPI and the CloudVision Resource APIs (REST) allow automation via Python (pyeapi, cvprac) and Ansible modules.

Zero Touch Provisioning (ZTP) bootstraps devices: DHCP option 66/67 delivers a script or config URL so devices self-provision on first boot.

CloudVision supports compliance auditing by comparing running config against intended configlets and flagging drift.

Arista campus portfolio: 720XP/720X series (fixed campus access), 750/755 series (modular campus), and 7050X/7060X for aggregation/spine roles.

Cognitive Campus refers to Arista's campus architecture combining wired and wireless with a unified EOS-based management plane and CloudVision oversight.

Cognitive Wi-Fi (formerly Mojo) integrates wireless access points managed through CloudVision, giving a single policy and telemetry view across wired and wireless.

The 720XP series provides multi-gigabit (mGig) copper ports, PoE, and stacking (MLAG or physical stacking via Spline) for campus access.

Arista uses MLAG (multi-chassis LAG) rather than traditional stacking for many designs, providing active-active forwarding and no single control-plane point.

Spline is Arista's stacking technology used on certain campus switches to create a single logical device from multiple physical units.

Campus switches run the same EOS software as data-center switches, enabling consistent automation, eAPI, and telemetry across the estate.

Platform selection rule: choose access switches by port count, PoE budget, and uplink speed; choose aggregation by uplink bandwidth and routing scale.

802.1X port-based access control authenticates supplicants via a RADIUS server; EAP exchanges occur between supplicant, authenticator (switch), and authentication server.

MAB (MAC Authentication Bypass) authenticates devices that lack an 802.1X supplicant by their MAC address against RADIUS.

RADIUS attributes returned on success can apply dynamic VLAN or downloadable ACLs (dACL) to the port.

DHCP snooping filters untrusted DHCP server messages; IP Source Guard binds source IP/MAC to the snooping table; Dynamic ARP Inspection validates ARP against that table.

Port security limits the number of learned MAC addresses per port and can restrict or shut down the port on violation.

Control Plane Policing (CoP) rate-limits traffic destined to the switch CPU to mitigate DoS against routing and management protocols.

ACLs: standard ACLs match source IP only; extended ACLs match source/destination, protocol, and ports; apply inbound on access ports to filter host traffic.

Storm control limits broadcast, multicast, and unknown-unicast rates on a port to prevent broadcast storms from saturating the segment.

Segmentation isolates traffic by VLAN (Layer 2), VRF (Layer 3 routing table separation), or overlay (VXLAN); each limits blast radius of faults and threats.

VRF-lite provides per-VRF routing tables on a single device; inter-VRF traffic requires route leaking or a firewall.

VXLAN encapsulates Layer 2 frames in UDP (port 4789) with a 24-bit VNI, enabling Layer 2 extension across a Layer 3 underlay.

Arista DANZ (Data Analyzer) mirrors traffic to analyzer ports; it supports mirroring to multiple destinations and can mirror to a tunnel for remote capture.

sFlow samples packet headers at a configured rate for traffic-flow visibility; it is lightweight and supported across EOS platforms.

Streaming telemetry (gNMI/OpenConfig) delivers high-resolution counters and state to CloudVision for real-time observability and alerting.

Tap aggregation and port mirroring (SPAN-like) feed IDS/IPS and packet-analysis tools without inline disruption.

Segmentation best practice: place IoT/guest devices on isolated VLANs/VRFs with ACLs restricting east-west traffic to only required flows.

Spanning Tree Protocol prevents Layer 2 loops by electing one root bridge per VLAN; lowest bridge ID wins, tie broken by lowest MAC address.

RSTP (802.1w) converges in seconds using edge (PortFast-like) ports and proposal/agreement handshakes; MSTP (802.1s) maps multiple VLANs to a single spanning-tree instance.

VLANs segment broadcast domains; 802.1Q tags add a 12-bit VLAN ID (1-4094 usable) to the Ethernet frame, and native VLAN traffic is sent untagged on a trunk.

Link aggregation (LACP 802.3ad) bundles member links into a port-channel; all members must match speed, duplex, and VLAN configuration.

First-hop redundancy: VRRP uses a virtual IP with an elected master; HSRP is Cisco-proprietary; both provide a shared default gateway for hosts.

PoE standards: 802.3af delivers up to 15.4 W per port, 802.3at (PoE+) up to 30 W, and 802.3bt up to 60 W (Type 3) or 90 W (Type 4) at the PSE.

IPv4 subnetting: usable hosts = 2^(host bits) - 2; a /24 yields 254 usable addresses, a /30 yields 2 (point-to-point links).

LLDP (802.1AB) is a vendor-neutral neighbor-discovery protocol; CDP is Cisco-proprietary and not typically used between Arista and third-party gear.

EOS is a single-image, Linux-based network OS; all daemons run in separate protected memory spaces, so one process failure does not crash the system.

Sysdb is the central state database that mediates configuration and state between EOS agents and protocol daemons.

Configuration modes: enable, configure terminal (global), and interface/router sub-modes; 'write memory' or 'copy running-config startup-config' persists config.

Show commands: 'show version', 'show interfaces status', 'show ip route', 'show running-config', 'show lldp neighbors', 'show mac address-table'.

Management access: console, SSH (management API), eAPI (JSON/XML over HTTPS), and SNMP; eAPI enables programmatic configuration and telemetry.

Multi-agent routing (MAR) lets EOS run multiple routing protocol instances (e.g., OSPFv2 and BGP) with per-agent FIB programming.

Event Monitor logs system events; 'show event-monitor' and 'show agent logs' aid troubleshooting; Zero Touch Provisioning (ZTP) automates initial config via DHCP and a config file URL.

Rollback: 'configure replace' or checkpoint/rollback features restore prior configurations; 'show boot-config' reveals the active software image.

CloudVision is Arista's management and telemetry platform; CloudVision Portal (CVP) provides a single pane for configuration, change control, and streaming telemetry.

CloudVision supports Change Control workflows: configlets are attached to containers, then changes are staged, reviewed, and executed as an atomic task with rollback.

Containers and configlets form a hierarchical, tag-driven configuration model; devices inherit configlets from their parent container.

CloudVision Studios provide intent-based, form-driven configuration (e.g., VLANs, ACLs, routing) that generates the underlying device config.

Streaming telemetry (OpenConfig/gNMI) pushes state to CloudVision at high frequency, unlike polling-based SNMP.

Arista eAPI and the CloudVision Resource APIs (REST) allow automation via Python (pyeapi, cvprac) and Ansible modules.

Zero Touch Provisioning (ZTP) bootstraps devices: DHCP option 66/67 delivers a script or config URL so devices self-provision on first boot.

CloudVision supports compliance auditing by comparing running config against intended configlets and flagging drift.

Arista campus portfolio: 720XP/720X series (fixed campus access), 750/755 series (modular campus), and 7050X/7060X for aggregation/spine roles.

Cognitive Campus refers to Arista's campus architecture combining wired and wireless with a unified EOS-based management plane and CloudVision oversight.

Cognitive Wi-Fi (formerly Mojo) integrates wireless access points managed through CloudVision, giving a single policy and telemetry view across wired and wireless.

The 720XP series provides multi-gigabit (mGig) copper ports, PoE, and stacking (MLAG or physical stacking via Spline) for campus access.

Arista uses MLAG (multi-chassis LAG) rather than traditional stacking for many designs, providing active-active forwarding and no single control-plane point.

Spline is Arista's stacking technology used on certain campus switches to create a single logical device from multiple physical units.

Campus switches run the same EOS software as data-center switches, enabling consistent automation, eAPI, and telemetry across the estate.

Platform selection rule: choose access switches by port count, PoE budget, and uplink speed; choose aggregation by uplink bandwidth and routing scale.

802.1X port-based access control authenticates supplicants via a RADIUS server; EAP exchanges occur between supplicant, authenticator (switch), and authentication server.

MAB (MAC Authentication Bypass) authenticates devices that lack an 802.1X supplicant by their MAC address against RADIUS.

RADIUS attributes returned on success can apply dynamic VLAN or downloadable ACLs (dACL) to the port.

DHCP snooping filters untrusted DHCP server messages; IP Source Guard binds source IP/MAC to the snooping table; Dynamic ARP Inspection validates ARP against that table.

Port security limits the number of learned MAC addresses per port and can restrict or shut down the port on violation.

Control Plane Policing (CoP) rate-limits traffic destined to the switch CPU to mitigate DoS against routing and management protocols.

ACLs: standard ACLs match source IP only; extended ACLs match source/destination, protocol, and ports; apply inbound on access ports to filter host traffic.

Storm control limits broadcast, multicast, and unknown-unicast rates on a port to prevent broadcast storms from saturating the segment.

Segmentation isolates traffic by VLAN (Layer 2), VRF (Layer 3 routing table separation), or overlay (VXLAN); each limits blast radius of faults and threats.

VRF-lite provides per-VRF routing tables on a single device; inter-VRF traffic requires route leaking or a firewall.

VXLAN encapsulates Layer 2 frames in UDP (port 4789) with a 24-bit VNI, enabling Layer 2 extension across a Layer 3 underlay.

Arista DANZ (Data Analyzer) mirrors traffic to analyzer ports; it supports mirroring to multiple destinations and can mirror to a tunnel for remote capture.

sFlow samples packet headers at a configured rate for traffic-flow visibility; it is lightweight and supported across EOS platforms.

Streaming telemetry (gNMI/OpenConfig) delivers high-resolution counters and state to CloudVision for real-time observability and alerting.

Tap aggregation and port mirroring (SPAN-like) feed IDS/IPS and packet-analysis tools without inline disruption.

Segmentation best practice: place IoT/guest devices on isolated VLANs/VRFs with ACLs restricting east-west traffic to only required flows.