Aruba CX 10000 Advanced flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

CX 10000 DPU

The embedded AMD Pensando Elba processor that performs stateful firewall, NAT, encryption, and flow telemetry inline for traffic steered to it by switch policy.

Inline service steering

The switch ASIC redirects flows matching a service policy to the DPU; non-matching flows are forwarded normally, so the DPU is not a mandatory hop.

CX 10000 form factor

A 1U top-of-rack switch with 48 SFP 10/25G ports and 6 QSFP 40/100G uplinks, plus an embedded DPU using internal ports.

ASIC versus DPU path

The Trident3-class ASIC forwards L2/L3 at line rate; the DPU handles stateful services. Separating them keeps forwarding performance independent of service load.

Candidate configuration

AOS-CX stages CLI changes in a candidate config that takes effect on commit; checkpoints and rollback allow reverting to saved states.

Dual-bank firmware

AOS-CX stores two firmware images; the inactive bank can be upgraded while the active bank runs, and boot system selects which image loads.

AOS-CX REST API

Every CLI object has a corresponding REST URI using the same object model, enabling automation equivalent to CLI configuration.

RBAC roles

AOS-CX authorizes users by role; admin is superuser, auditor is read-only, and roles can be assigned locally or via remote AAA.

VSX

Aruba's multi-chassis L2/L3 redundancy feature in which two switches share an ISL and keepalive to act as one logical device with active-active forwarding.

VSX active-gateway

Both VSX peers own the same anycast gateway IP and MAC, so either peer can route for the subnet without a standby path.

ARP suppression

The leaf answers ARP requests locally from the EVPN MAC/IP table instead of flooding them across the VXLAN overlay, reducing broadcast traffic.

LACP active mode

The interface actively sends LACPDUs to negotiate a link aggregation with the peer; required for dynamic multichassis LAG under VSX.

Stateful flow table

The DPU records each permitted flow's 5-tuple and state; return traffic matches the existing entry and does not require a reverse rule.

DPU NAT

Source and destination NAT are performed on the DPU; return traffic is statefully translated back without explicit reverse NAT rules.

DPU IPsec offload

Encryption and decryption for IPsec and MACsec run on the DPU, so tunnel processing does not consume switch ASIC forwarding resources.

First-hop enforcement

Policy is applied at the leaf switch where the workload connects, so east-west traffic is inspected without being routed to a central firewall.

EVPN Type 2 route

Advertises a MAC address with its associated IP and VNI, enabling MAC learning and ARP suppression across the VXLAN overlay.

EVPN Type 5 route

Advertises an IP prefix with a VNI, enabling symmetric IRB where the ingress leaf routes and encapsulates to the egress leaf.

Anycast gateway

Every leaf uses the same gateway IP and MAC for a subnet, so a workload can route optimally through its local leaf without tromboning.

VXLAN MTU overhead

VXLAN adds 50 bytes of encapsulation; the underlay must support at least 1600-byte frames to carry a standard 1500-byte inner frame.

Ethernet segment Type 4

An EVPN route that identifies a multihomed Ethernet segment and its designated forwarder, enabling all-active multihoming across leaves.

Micro-segmentation

Policy enforcement per workload identity rather than per subnet, using group tags or endpoint attributes matched in stateful rules at the leaf.

Default-deny baseline

The implicit final rule drops unmatched traffic; every permitted flow requires an explicit rule, and statefulness handles return traffic.

VRF isolation

Separate routing tables per tenant; routes cross VRFs only through explicit route-target import and export configuration.

Role-based segmentation

User-role or group tags assigned at the port or by 802.1X are matched in policy, so enforcement follows identity rather than IP address.

gNMI streaming telemetry

AOS-CX pushes counters and state to a collector at configured intervals using gNMI, replacing SNMP polling with near-real-time data.

IPFIX from DPU

Per-flow records exported by the DPU include the 5-tuple, byte and packet counts, and the policy action taken on the flow.

Audit versus event log

Audit logs record configuration changes with user identity; event logs record system and protocol events. They serve different troubleshooting purposes.

show tech

A diagnostic bundle collecting configuration, interface state, logs, and counters for support analysis; DPU diagnostics are gathered separately.

VSX keepalive

A dedicated path between VSX peers that detects peer failure; loss of keepalive while the ISL is up triggers split-brain protection.

DPU fail-open

Configurable per-policy behavior in which traffic steered to a failed DPU is forwarded without inspection rather than dropped.

EVPN troubleshooting order

Verify underlay loopback reachability, then VNI-to-VLAN mapping, then Type 2 route presence, then MTU before examining policy.