Aruba Switching Associate cheat sheet

ArubaOS-Switch CLI has three privilege contexts: Operator (>), Manager (#), and Global Configuration (config)#; use 'configure terminal' to reach config mode.

Interface naming convention: type slot/port, e.g., 'interface 1/1/1' for GigabitEthernet port 1 on slot 1; VLAN interfaces use 'vlan '.

'show running-config' displays active configuration in RAM; 'show startup-config' displays the saved configuration; 'write memory' copies running to startup.

'show interfaces brief' lists all ports with link state, speed, and VLAN membership; 'show interfaces ' gives counters and duplex detail.

Save/restore workflow: 'copy running-config startup-config' persists changes; 'erase startup-config' plus 'reload' returns the switch to factory defaults.

Factory default management access: console is always available; the dedicated out-of-band management port uses DHCP by default on many ArubaOS-Switch platforms.

'show version' reports firmware image, uptime, and serial number; 'show flash' lists stored image files and free space.

Password recovery and image selection are done from the ROM monitor (Main Menu) at boot; 'show system-information' confirms boot image and MAC address.

A VLAN is a broadcast domain; ports in the same VLAN share a broadcast frame; inter-VLAN traffic requires a router or Layer 3 switch.

Access port: carries exactly one untagged VLAN ('untagged vlan '). Trunk port: carries multiple VLANs tagged ('tagged vlan ') plus one untagged native VLAN.

802.1Q tag adds 4 bytes, inserting a 12-bit VLAN ID (range 1-4094); VLAN 1 is the default and cannot be deleted.

MAC address table learning: source MAC is learned on ingress port; unknown destination MACs are flooded within the VLAN. 'show mac-address' displays the table.

'show vlan' lists VLAN IDs, names, and member ports; 'show vlan port ' shows a port's tagged/untagged membership.

Link Aggregation (LACP) bundles up to 8 active links into one logical trunk; member ports must match speed, duplex, and VLAN configuration.

GVRP/MVRP propagate VLAN membership dynamically; static VLAN configuration is preferred for deterministic topologies.

Jumbo frames require MTU configuration on both the switch and the end device; mismatched MTU causes silent drops on large frames.

STP prevents Layer 2 loops by electing one root bridge per topology; lowest bridge ID (priority + MAC) wins; default priority is 32768.

Port roles: Root (best path to root), Designated (forwarding on a segment), and Alternate/Blocking (loop prevention).

Port states: Blocking, Listening, Learning, Forwarding, Disabled; convergence with classic 802.1D takes 30-50 seconds.

RSTP (802.1w) converges in seconds using edge ports and proposal/agreement; MSTP (802.1s) maps multiple VLANs to instances for load balancing.

Path cost is cumulative; lower cost wins. Root port selection: lowest root path cost, then lowest sender bridge ID, then lowest port ID.

'spanning-tree' enables STP globally; 'spanning-tree priority ' sets bridge priority in multiples of 4096.

LACP modes: Active (initiates), Passive (responds); both ends Active or one Active/one Passive forms a bundle. Static trunking requires matching manual config.

'show spanning-tree' displays root bridge, port roles, and states; 'show lacp' verifies member link aggregation status.

Layer 3 switch routing requires IP routing enabled globally and an IP address on each VLAN interface (SVI).

Static route syntax: 'ip route '; default route uses 0.0.0.0/0.

Connected routes are added automatically when an SVI has an IP; administrative distance: connected=0, static=1, OSPF=110, RIP=120.

'show ip route' displays the routing table; 'show ip interface brief' confirms SVI status and addresses.

Port security limits learned MACs per port; violation actions include protect (drop), restrict (drop+log), and shutdown.

DHCP snooping blocks rogue DHCP servers by trusting only uplink ports; dynamic ARP inspection validates ARP against the DHCP snooping binding table.

802.1X port-based authentication uses a RADIUS server as authenticator backend; unauthenticated ports remain in an unauthorized VLAN.

Management hardening: disable Telnet, enable SSH, set strong local credentials, and restrict management access with ACLs on the management VLAN.