Aruba CX 10000 Advanced key terms

Aruba's top-of-rack data center switch that pairs a conventional switching ASIC with an embedded programmable DPU, so network and security services run inside the switch itself rather than on separate appliances.

A programmable data processing unit embedded in the CX 10000 that executes stateful firewall, NAT, encryption, and telemetry functions in hardware, offloading those services from servers and from the switch ASIC.

The specific DPU silicon family used in the CX 10000, providing programmable packet processing and crypto acceleration for distributed services.

The main forwarding chip in the CX 10000 that handles standard Layer 2 and Layer 3 forwarding at high port density, separate from the DPU that handles security and telemetry processing.

The forwarding path where packets are actually moved and, on the CX 10000, where DPU-based services such as firewall inspection are applied inline to traffic.

The software layer that runs routing protocols, builds forwarding tables, and manages device state; on AOS-CX it is separated from forwarding so that policy enforcement does not slow normal traffic handling.

Aruba's modern network operating system with a modular, database-driven design, REST API access, and a consistent CLI across switching platforms including the CX 10000.

A staged copy of the running configuration that an administrator edits and then commits, allowing changes to be validated and applied atomically rather than line by line.

A named snapshot of the AOS-CX configuration and state that can be used to roll back after a failed change or to compare configurations over time.

The act of restoring a device to a previously saved checkpoint or configuration version, used to recover quickly from misconfiguration during maintenance windows.

AOS-CX's programmatic HTTPS interface that exposes configuration, state, and telemetry data as JSON resources, enabling automation and integration with orchestration tools.

An automation framework commonly used with AOS-CX to push consistent configuration and policy across many switches through modules and playbooks rather than manual CLI entry.

Aruba's virtual switching extension, in which two peer switches keep independent control planes but synchronize key state and use multi-chassis link aggregation for resilient Layer 2 and Layer 3 connectivity.

Multi-chassis link aggregation, a technique that lets a server or downstream switch dual-home to two peer switches using one logical bundle, providing link redundancy without spanning tree blocking.

The inter-switch link that connects the two VSX peers, carrying synchronization traffic and, when needed, data traffic between them.

Ethernet VPN, a BGP control-plane family that distributes MAC and IP reachability information for Layer 2 and Layer 3 services across a data center fabric, replacing flood-and-learn behavior.

A tunneling encapsulation that carries Layer 2 frames inside UDP packets across a routed underlay, allowing large numbers of isolated segments to span a data center fabric.

VXLAN tunnel endpoint, the device that encapsulates and decapsulates VXLAN traffic, mapping local segments to VNIs and forwarding frames across the IP underlay.

VXLAN network identifier, a 24-bit value that labels a VXLAN segment and keeps tenant or service traffic isolated across the shared fabric.

An EVPN route that advertises a MAC address together with its IP binding, enabling the fabric to learn endpoints and forward Layer 2 and Layer 3 traffic without flooding.

An EVPN route that advertises IP prefix reachability, supporting Layer 3 routing between subnets across the fabric without requiring a dedicated Layer 2 stretch.

The CX 10000 design in which firewall, NAT, and telemetry functions run on the DPU at each switch, placing policy close to workloads instead of backhauling traffic to a central appliance.

A policy engine that tracks connection state so return traffic is automatically permitted and only flows matching defined rules are allowed, enforced on the CX 10000 by the DPU.

A security approach that applies fine-grained policy between individual workloads or groups rather than only at network boundaries, limiting lateral movement inside a data center.

An ordered set of rules that defines which sources may reach which destinations on which services, and what action to take, applied to traffic by the DPU or the switch.

The location in the path where a security policy is actually applied, which on the CX 10000 is the embedded DPU processing traffic inline at the switch.

Network address translation, a function the DPU can perform to rewrite addresses and ports for traffic crossing between segments, often used to connect overlapping or private address spaces.

A suite of protocols that encrypts and authenticates IP traffic between endpoints; the CX 10000 DPU can terminate encrypted tunnels so traffic is protected in transit across untrusted links.

A Layer 2 security standard that encrypts and integrity-checks frames on a point-to-point Ethernet link, protecting hop-by-hop traffic between switches or between a switch and a host.

Streaming of device and flow data from the switch to collectors, giving continuous visibility into traffic and health rather than relying on periodic polling.

A flow export standard that summarizes traffic as records with addresses, ports, and counters, used on the CX 10000 to report on flows observed or processed by the DPU.

A packet-sampling telemetry protocol that provides scalable traffic visibility by exporting sampled headers and interface counters to a collector.

Aruba's configuration management application that validates and pushes consistent configuration across groups of switches, reducing drift and manual error in large deployments.

A logical Layer 2 broadcast domain that isolates traffic within a switch or across trunked links, forming the basis for segmenting users, servers, and services.

Switch virtual interface, a logical Layer 3 interface associated with a VLAN that provides the default gateway and routing point for hosts in that segment.

Forwarding of traffic between separate VLANs using Layer 3 interfaces or SVIs on the switch, which is where policy can be applied before traffic leaves the device.

A link-state interior gateway protocol used to build routing tables within an underlay or campus domain, commonly deployed alongside BGP in data center designs.

A path-vector routing protocol that carries EVPN address families in the data center fabric and exchanges routes between autonomous systems or fabric tiers.

The physical IP network of links and routing that connects fabric devices, providing reachability between VTEPs so overlay tunnels can be established.

The logical network built on top of the underlay, such as VXLAN segments carrying tenant traffic, which is independent of the physical topology beneath it.