Aruba Comware Advanced cheat sheet
Aruba Comware Advanced · Keep the key ideas within reach.
Comware System Architecture and Device Management
Comware V7 separates control plane, data plane, and management plane; each runs as independent processes on the Comware microkernel.
Multi-context (MDC) partitions a single physical device into up to 4 independent contexts, each with its own interfaces, routing tables, and admin login.
Configuration is organized in a two-level hierarchy: system view (system-view) and interface/user views; commit is immediate per command, unlike Junos candidate config.
startup.cfg is loaded at boot; save writes the running config to startup.cfg; a saved config can be rolled back with configuration replace file.
IRF member IDs range 1-4 (default 1); priority 1-32 with higher winning the master election; MAD detects split-brain via LACP, BFD, or ARP.
Display commands: display current-configuration, display saved-configuration, display version, display device, display diagnostic-information.
Comware file operations use the filesystem commands dir, copy, delete, and tftp/ftp get/put; the startup file is set with startup saved-configuration.
Password recovery requires console access at boot to enter the BootWare menu and skip the startup config, then reset the password and reboot.
Advanced VLAN, Link Aggregation, and Spanning Tree Configuration
Access ports carry one untagged VLAN; trunk ports carry multiple VLANs tagged; hybrid ports allow both tagged and untagged VLANs per port.
GVRP dynamically propagates VLAN registration; MVRP (802.1ak) is the MRP-based replacement and is configured under interface and globally.
QinQ (802.1ad) tunnels customer VLANs inside a service VLAN; port-based QinQ and flexible QinQ with TPID match are supported.
Link aggregation modes: static (manual) and dynamic (LACP 802.3ad); member ports must share speed, duplex, and MTU; max 8 active members per group.
LACP system priority (1-65535, lower wins) and port priority determine which links become Selected vs Standby.
STP modes on Comware: STP, RSTP, PVST, and MSTP; MSTP is default in V7 and maps VLANs to instances via instance and region configuration.
MSTP region name, revision level, and VLAN-to-instance mapping must match on all region members; region boundary is detected by configuration digest.
STP timers: Hello 2s, Forward Delay 15s, Max Age 20s; edge ports (stp edged-port) skip learning and forwarding delay.
IP Routing Protocols (OSPF, BGP, IS-IS, RIP)
OSPF cost = reference bandwidth (default 100 Mbps) / interface bandwidth; adjust with bandwidth-reference under ospf view.
OSPF area types: stub blocks Type 5 LSAs, NSSA blocks Type 5 but allows Type 7; totally stubby and totally NSSA also block Type 3.
OSPF neighbor states: Down, Init, 2-Way, ExStart, Exchange, Loading, Full; stuck in ExStart indicates MTU mismatch.
BGP path selection order: weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, lowest router ID.
BGP peer types: iBGP (same AS) requires full mesh or route reflector; eBGP uses directly connected peers by default (multihop for non-direct).
IS-IS levels: L1 intra-area, L2 backbone, L1/L2 default; NET address format is area ID plus system ID plus NSEL (00).
RIP uses hop count (max 15) with split horizon, poison reverse, and triggered updates; RIPv2 supports VLSM and multicast 224.0.0.9.
Route redistribution requires a route-policy or filter to prevent loops; default metric must be set for each redistributed protocol.
IP Multicast and IPv6 Deployment
IPv6 address is 128 bits; global unicast 2000::/3, link-local fe80::/10, multicast ff00::/8, loopback ::1/128.
NDP replaces ARP: NS/NA for address resolution, RS/RA for router discovery; RA carries prefix, MTU, and default router info.
SLAAC uses RA prefix plus EUI-64 or stable-privacy interface ID; DHCPv6 can supply additional options (stateful or stateless).
Multicast group ranges: 224.0.0.0/24 local link, 224.0.1.0/24 internetwork control, 239.0.0.0/8 admin scoped; IPv6 ff00::/8.
PIM modes: PIM-DM (flood and prune) and PIM-SM (rendezvous point, shared then shortest-path tree); PIM-SSM uses (S,G) directly.
IGMPv2 supports querier election and leave; IGMPv3 adds source-specific filtering; MLD is the IPv6 equivalent.
RP discovery: static, BSR (bootstrap router), or Anycast-RP; BSR uses candidate-RP and candidate-BSR advertisements.
MPLS and Advanced WAN/VPN Technologies
MPLS label stack: outer transport label, inner service label; LSR swaps outer label, LER pushes or pops.
LDP distributes labels for IGP-learned prefixes; PHP (penultimate hop popping) removes the outer label at the penultimate hop.
L3VPN uses VRF per customer, MP-BGP VPNv4/VPNv6 address family, and route targets for import/export control.
RD (route distinguisher) makes overlapping customer prefixes unique; RT (route target) controls VRF import/export of routes.
MPLS TE uses RSVP-TE signaling with CSPF path computation; constraints include bandwidth, affinity, and explicit path.
GRE and IPsec tunnels provide overlay connectivity; IPsec uses IKE for key exchange and ESP/AH for data protection.
VPLS provides L2 multipoint via pseudowires signaled by LDP or BGP; PWE3 defines single-hop pseudowire encapsulation.
Network Security, ACLs, and AAA
ACL types: basic (source IP only), advanced (source/dest IP, protocol, port), Ethernet (MAC), and user-defined; applied inbound or outbound per interface.
ACL rule order matters; first match wins; default action is permit unless a deny rule is added; use rule 0 to place a rule first.
AAA uses RADIUS (UDP 1812 auth/1813 acct) or TACACS+ (TCP 49); HWTACACS is Huawei/Comware-specific with full command authorization.
AAA domains bind authentication, authorization, and accounting schemes; apply to line (console/VTY) via authentication-mode.
Port security limits MAC addresses per port; sticky MAC, MAC-move detection, and intrusion protection actions (protect, restrict, shutdown).
802.1X uses EAPoL between supplicant and authenticator, RADIUS between authenticator and server; MAC authentication is an alternative.
IP Source Guard and DHCP snooping prevent spoofing; dynamic ARP inspection validates ARP against the snooping table.
High Availability, IRF, and Resiliency
IRF combines up to 4 (V7) or 9 devices into one logical unit; master elected by priority (higher wins), then MAC, then uptime.
IRF ports are logical interfaces bundling physical ports; members must be directly connected in a ring or chain topology.
MAD (multi-active detection) modes: LACP-MAD, BFD-MAD, ARP-MAD; on split, losing side keeps interfaces down to prevent dual-active.
VRRP: master owns virtual IP and MAC; priority 1-254 (higher wins), 255 owner; preempt enabled by default on Comware.
VRRP tracking reduces priority when an uplink fails, triggering failover; track interface or track nqa.
BFD provides sub-second failure detection for OSPF, BGP, static routes, and VRRP; configured with bfd min-transmit-interval and min-receive-interval.
Smart Link and RRPP are ring redundancy alternatives to STP for faster convergence in L2 topologies.
QoS, Traffic Management, and Monitoring
QoS pipeline: classification (ACL, CAR, class-map), marking (DSCP/802.1p), queuing (SP, WRR, WFQ, SP+WRR), and congestion avoidance (WRED).
DSCP uses 6 bits (0-63); 802.1p uses 3 bits (0-7); trust modes: untrust, dot1p, dscp, and auto.
GTS shapes outbound traffic to a rate; CAR polices inbound/outbound with committed and peak rates; both use token bucket.
Queue scheduling: SP starves lower queues; WRR assigns weights; SP+WRR combines strict priority for voice with weighted for data.
WRED drops packets probabilistically based on queue depth and DSCP to avoid tail-drop TCP global synchronization.
Monitoring: NQA probes (ICMP, TCP, UDP, HTTP) measure latency/jitter; sFlow and NetStream export flow statistics.
Port mirroring (local or remote via RSPAN) copies traffic to a monitor port; ACL-based mirroring is also supported.
Troubleshooting and Operations
Ping and tracert support source interface and VPN-instance options; extended ping tests size, count, and DF bit.
display interface shows errors (CRC, giants, runts), duplex mismatch, and link state; display transceiver shows optical diagnostics.
display logbuffer and display trapbuffer show system events; info-center configures log levels (0 emergency to 7 debugging).
Debugging commands (debugging ip packet, debugging ospf) are CPU-intensive; use terminal monitor and terminal debugging to view output.
display diagnostic-information collects a bundle of show output for TAC; display cpu-usage and display memory show resource pressure.
Packet capture via capture-packet on an interface writes to a local file for offline analysis.
display arp, display mac-address, and display ip routing-table verify L2/L3 forwarding; display fib shows the hardware forwarding table.
Comware System Architecture and Device Management
Comware V7 uses a modular multi-process architecture; services can be independently restarted without full device reboot.
MDC (multi-context) allocation requires the mdc command, resource assignment, and mdc start; up to 4 contexts supported.
BootWare menu (Ctrl+B at boot) provides password recovery, file management, and image upgrade options.
Configuration rollback uses configuration replace file with a saved archive; configuration archive enables automatic checkpoints.
IRF member priority default is 1; higher priority wins master election; member ID must be unique 1-4.
Display commands: display current-configuration, display saved-configuration, display version, display device, display diagnostic-information.
The startup config is set with startup saved-configuration; a missing file causes the device to boot with defaults.
Advanced VLAN, Link Aggregation, and Spanning Tree Configuration
Hybrid ports allow per-VLAN tagged or untagged tagging; trunk ports are a special case of hybrid with all VLANs tagged.
QinQ adds an outer service VLAN tag; TPID can be changed per port to match provider requirements.
Link aggregation requires member ports to share speed, duplex, and MTU; max 8 active members per group.
LACP system priority (lower wins) and port priority determine Selected vs Standby links.
MSTP maps VLANs to instances; region name, revision, and mapping must match across all members.
STP timers: Hello 2s, Forward Delay 15s, Max Age 20s; edge ports skip learning and forwarding delay.
GVRP dynamically registers VLANs; MVRP (802.1ak) is the MRP replacement for GVRP.
IP Routing Protocols (OSPF, BGP, IS-IS, RIP)
OSPF cost = reference bandwidth / interface bandwidth; adjust with bandwidth-reference under ospf view.
OSPF stub blocks Type 5 LSAs; NSSA blocks Type 5 but allows Type 7; totally stubby also blocks Type 3.
OSPF neighbor stuck in ExStart indicates MTU mismatch; stuck in 2-Way indicates DR election or priority 0.
BGP path selection: weight, local preference, locally originated, AS path length, origin, MED, eBGP over iBGP, lowest router ID.
iBGP requires full mesh or route reflector; eBGP uses directly connected peers by default (multihop for non-direct).
IS-IS NET address = area ID + system ID + NSEL (00); L1 intra-area, L2 backbone, L1/L2 default.
RIP max hop count 15; RIPv2 supports VLSM and multicast 224.0.0.9; split horizon and poison reverse prevent loops.
IP Multicast and IPv6 Deployment
IPv6 global unicast 2000::/3, link-local fe80::/10, multicast ff00::/8, loopback ::1/128.
NDP replaces ARP: NS/NA for address resolution, RS/RA for router discovery; RA carries prefix, MTU, and default router.
SLAAC uses RA prefix plus EUI-64 or stable-privacy interface ID; DHCPv6 supplies additional options.
Multicast group ranges: 224.0.0.0/24 local link, 224.0.1.0/24 internetwork control, 239.0.0.0/8 admin scoped.
PIM-DM floods and prunes; PIM-SM uses a rendezvous point; PIM-SSM uses (S,G) directly.
IGMPv2 supports querier election and leave; IGMPv3 adds source-specific filtering; MLD is the IPv6 equivalent.
RP discovery: static, BSR, or Anycast-RP; BSR uses candidate-RP and candidate-BSR advertisements.
MPLS and Advanced WAN/VPN Technologies
MPLS label stack: outer transport label, inner service label; LSR swaps outer label, LER pushes or pops.
LDP distributes labels for IGP-learned prefixes; PHP removes the outer label at the penultimate hop.
L3VPN uses VRF per customer, MP-BGP VPNv4/VPNv6, and route targets for import/export control.
RD makes overlapping customer prefixes unique; RT controls VRF import/export of routes.
MPLS TE uses RSVP-TE with CSPF; constraints include bandwidth, affinity, and explicit path.
GRE and IPsec tunnels provide overlay connectivity; IPsec uses IKE for key exchange and ESP/AH for data protection.
VPLS provides L2 multipoint via pseudowires signaled by LDP or BGP; PWE3 defines single-hop pseudowire encapsulation.
Network Security, ACLs, and AAA
ACL types: basic (source IP), advanced (source/dest IP, protocol, port), Ethernet (MAC), and user-defined; applied inbound or outbound.
ACL rule order matters; first match wins; default action is permit unless a deny rule is added.
AAA uses RADIUS (UDP 1812/1813) or TACACS+ (TCP 49); HWTACACS provides full command authorization.
AAA domains bind authentication, authorization, and accounting schemes; apply to line via authentication-mode.
Port security limits MAC addresses per port; sticky MAC, MAC-move detection, and intrusion protection actions (protect, restrict, shutdown).
802.1X uses EAPoL between supplicant and authenticator, RADIUS between authenticator and server.
IP Source Guard and DHCP snooping prevent spoofing; dynamic ARP inspection validates ARP against the snooping table.
High Availability, IRF, and Resiliency
IRF combines up to 4 (V7) devices into one logical unit; master elected by priority, then MAC, then uptime.
IRF ports are logical interfaces bundling physical ports; members connect in ring or chain topology.
MAD modes: LACP-MAD, BFD-MAD, ARP-MAD; on split, losing side keeps interfaces down to prevent dual-active.
VRRP: master owns virtual IP and MAC; priority 1-254 (higher wins), 255 owner; preempt enabled by default.
VRRP tracking reduces priority when an uplink fails, triggering failover.
BFD provides sub-second failure detection for OSPF, BGP, static routes, and VRRP.
Smart Link and RRPP are ring redundancy alternatives to STP for faster convergence.
QoS, Traffic Management, and Monitoring
QoS pipeline: classification (ACL, CAR, class-map), marking (DSCP/802.1p), queuing (SP, WRR, WFQ, SP+WRR), congestion avoidance (WRED).
DSCP uses 6 bits (0-63); 802.1p uses 3 bits (0-7); trust modes: untrust, dot1p, dscp, auto.
GTS shapes outbound traffic; CAR polices with committed and peak rates using token bucket.
SP starves lower queues; WRR assigns weights; SP+WRR combines strict priority for voice with weighted for data.
WRED drops probabilistically based on queue depth and DSCP to avoid tail-drop TCP global synchronization.
NQA probes (ICMP, TCP, UDP, HTTP) measure latency/jitter; sFlow and NetStream export flow statistics.
Port mirroring (local or remote via RSPAN) copies traffic to a monitor port; ACL-based mirroring is supported.
Troubleshooting and Operations
Ping and tracert support source interface and VPN-instance options; extended ping tests size, count, and DF bit.
display interface shows CRC, giants, runts, duplex mismatch, and link state; display transceiver shows optical diagnostics.
display logbuffer and display trapbuffer show system events; info-center log levels 0 (emergency) to 7 (debugging).
debugging commands are CPU-intensive; use terminal monitor and terminal debugging to view output.
display diagnostic-information collects a bundle of show output for TAC; display cpu-usage and display memory show resource pressure.
capture-packet on an interface writes to a local file for offline analysis.
display arp, display mac-address, display ip routing-table verify L2/L3 forwarding; display fib shows the hardware forwarding table.