Aruba ACDA cheat sheet

Design methodology order: requirements gathering, conceptual design, logical design, physical design, implementation, validation, optimization.

Requirement types: business (budget, timeline), functional (what the network must do), capacity (throughput, client counts), and constraint (regulatory, legacy).

Capacity planning formula: total throughput = active clients x per-client bandwidth x oversubscription factor.

Availability formula: A = MTBF / (MTBF + MTTR); 99.9% uptime allows about 8.76 hours of downtime per year.

Three-tier design = core, distribution, access; two-tier collapsed core removes distribution for smaller campuses.

Oversubscription ratio at access-to-distribution is commonly 20:1 for endpoints; distribution-to-core commonly 4:1.

Design validation uses a pilot or proof of concept before full rollout; baseline metrics are captured first.

Logical design covers VLANs, subnets, routing domains, and policy; physical design covers hardware, cabling, and placement.

Access layer provides PoE to endpoints; distribution layer aggregates access switches and enforces policy; core provides high-speed transport.

Spanning tree defaults to RSTP/MSTP; MSTP maps multiple VLANs to instances to reduce topology size.

Link aggregation (LACP) bundles up to 8 active links per group; member links must match speed, duplex, and VLAN config.

PoE budget: sum powered-device draw per port against switch PoE budget; 802.3at (PoE+) delivers up to 30 W per port, 802.3bt up to 90 W.

Multimode fiber for building risers and intra-campus; single-mode for long runs; Cat6A supports 10GBASE-T to 100 m.

VLAN design: one subnet per VLAN; avoid stretching VLANs across buildings; use routed distribution links instead of large L2 domains.

Redundant distribution pairs use MC-LAG or stacked switches for active-active forwarding with loop prevention.

Stacking/cabling design must account for oversubscription on uplinks and stack-port bandwidth between members.

Capacity-based AP count = concurrent clients / clients-per-AP target; coverage-based uses RF survey and -67 dBm cell edge for voice, -72 dBm for data.

2.4 GHz uses channels 1, 6, 11 only (non-overlapping); 5 GHz offers many non-overlapping channels and is preferred for capacity.

Co-channel interference is controlled by channel reuse planning and transmit power tuning; adjacent APs should be on different channels.

AP transmit power and client power should be balanced so clients associate with the nearest AP (avoid sticky clients).

High-density design: enable band steering, client load balancing, and 20/40/80 MHz channel widths tuned to density.

WLAN design considers RF obstacles: metal attenuates heavily, water absorbs 2.4 GHz, and drywall attenuates mildly.

Roaming requires overlapping coverage (typically 15-20% cell overlap) and consistent SSID/security across APs.

Controller-based vs controller-less (instant) design affects scalability, roaming domain size, and management model.

WAN options: MPLS (private, SLA-backed), internet VPN (cost-effective), dedicated fiber, and broadband/LTE for backup.

SD-WAN uses application-aware routing, policy-based path selection, and overlay tunnels over multiple transports.

Hub-and-spoke centralizes policy but adds latency; full mesh or partial mesh improves branch-to-branch paths.

Branch design often uses a single integrated branch device combining routing, firewall, and switching.

Bandwidth sizing: sum peak application demand per branch and add headroom (commonly 20-30%).

QoS markings must be preserved end-to-end; WAN edge maps DSCP to per-hop behavior and shapes to contracted rate.

Redundancy: dual WAN links with failover, dual CPE, and diverse carrier paths reduce single points of failure.

Latency-sensitive apps (voice, video) require jitter and latency budgets; measure RTT and jitter in design validation.

Defense in depth layers controls: edge firewall, segmentation, endpoint security, identity/AAA, and monitoring.

Zero Trust principles: least privilege, verify explicitly, assume breach; micro-segmentation limits lateral movement.

NAC (802.1X) authenticates devices/users before network access; MAB is a fallback for non-supplicant devices.

Role-based access control maps authenticated identity to VLAN or role via RADIUS attributes.

Guest networks should be isolated with captive portal, rate limiting, and no access to internal subnets.

Security zones: separate untrusted (internet), DMZ, internal, and management planes with policy between zones.

Wireless security: WPA2/WPA3-Enterprise uses 802.1X with RADIUS; WPA3 adds SAE and forward secrecy.

Management plane hardening: restrict admin access to management VLAN, use AAA, and disable unused services.

FCAPS model: Fault, Configuration, Accounting, Performance, Security management.

SNMPv3 provides authentication and encryption; avoid SNMPv1/v2c in production.

Syslog severity levels 0 (emergency) through 7 (debug); centralize logs to a syslog server or SIEM.

NetFlow/sFlow/IPFIX provide flow-level visibility for capacity and security analysis.

Monitoring design should define baselines, thresholds, alerting escalation, and retention periods.

NTP synchronization is required for accurate log correlation and certificate validation.

Management VLAN should be separate from user and guest traffic; out-of-band access aids recovery.

Metrics to monitor: interface utilization, error/discard rates, CPU/memory, PoE budget, client counts, and AP health.

Design methodology order: requirements gathering, conceptual design, logical design, physical design, implementation, validation, optimization.

Requirement types: business (budget, timeline), functional (what the network must do), capacity (throughput, client counts), and constraint (regulatory, legacy).

Capacity planning formula: total throughput = active clients x per-client bandwidth x oversubscription factor.

Availability formula: A = MTBF / (MTBF + MTTR); 99.9% uptime allows about 8.76 hours of downtime per year.

Three-tier design = core, distribution, access; two-tier collapsed core removes distribution for smaller campuses.

Oversubscription ratio at access-to-distribution is commonly 20:1 for endpoints; distribution-to-core commonly 4:1.

Design validation uses a pilot or proof of concept before full rollout; baseline metrics are captured first.

Logical design covers VLANs, subnets, routing domains, and policy; physical design covers hardware, cabling, and placement.

Access layer provides PoE to endpoints; distribution layer aggregates access switches and enforces policy; core provides high-speed transport.

Spanning tree defaults to RSTP/MSTP; MSTP maps multiple VLANs to instances to reduce topology size.

Link aggregation (LACP) bundles up to 8 active links per group; member links must match speed, duplex, and VLAN config.

PoE budget: sum powered-device draw per port against switch PoE budget; 802.3at (PoE+) delivers up to 30 W per port, 802.3bt up to 90 W.

Multimode fiber for building risers and intra-campus; single-mode for long runs; Cat6A supports 10GBASE-T to 100 m.

VLAN design: one subnet per VLAN; avoid stretching VLANs across buildings; use routed distribution links instead of large L2 domains.

Redundant distribution pairs use MC-LAG or stacked switches for active-active forwarding with loop prevention.

Stacking/cabling design must account for oversubscription on uplinks and stack-port bandwidth between members.

Capacity-based AP count = concurrent clients / clients-per-AP target; coverage-based uses RF survey and -67 dBm cell edge for voice, -72 dBm for data.

2.4 GHz uses channels 1, 6, 11 only (non-overlapping); 5 GHz offers many non-overlapping channels and is preferred for capacity.

Co-channel interference is controlled by channel reuse planning and transmit power tuning; adjacent APs should be on different channels.

AP transmit power and client power should be balanced so clients associate with the nearest AP (avoid sticky clients).

High-density design: enable band steering, client load balancing, and 20/40/80 MHz channel widths tuned to density.

WLAN design considers RF obstacles: metal attenuates heavily, water absorbs 2.4 GHz, and drywall attenuates mildly.

Roaming requires overlapping coverage (typically 15-20% cell overlap) and consistent SSID/security across APs.

Controller-based vs controller-less (instant) design affects scalability, roaming domain size, and management model.

WAN options: MPLS (private, SLA-backed), internet VPN (cost-effective), dedicated fiber, and broadband/LTE for backup.

SD-WAN uses application-aware routing, policy-based path selection, and overlay tunnels over multiple transports.

Hub-and-spoke centralizes policy but adds latency; full mesh or partial mesh improves branch-to-branch paths.

Branch design often uses a single integrated branch device combining routing, firewall, and switching.

Bandwidth sizing: sum peak application demand per branch and add headroom (commonly 20-30%).

QoS markings must be preserved end-to-end; WAN edge maps DSCP to per-hop behavior and shapes to contracted rate.

Redundancy: dual WAN links with failover, dual CPE, and diverse carrier paths reduce single points of failure.

Latency-sensitive apps (voice, video) require jitter and latency budgets; measure RTT and jitter in design validation.

Defense in depth layers controls: edge firewall, segmentation, endpoint security, identity/AAA, and monitoring.

Zero Trust principles: least privilege, verify explicitly, assume breach; micro-segmentation limits lateral movement.

NAC (802.1X) authenticates devices/users before network access; MAB is a fallback for non-supplicant devices.

Role-based access control maps authenticated identity to VLAN or role via RADIUS attributes.

Guest networks should be isolated with captive portal, rate limiting, and no access to internal subnets.

Security zones: separate untrusted (internet), DMZ, internal, and management planes with policy between zones.

Wireless security: WPA2/WPA3-Enterprise uses 802.1X with RADIUS; WPA3 adds SAE and forward secrecy.

Management plane hardening: restrict admin access to management VLAN, use AAA, and disable unused services.

FCAPS model: Fault, Configuration, Accounting, Performance, Security management.

SNMPv3 provides authentication and encryption; avoid SNMPv1/v2c in production.

Syslog severity levels 0 (emergency) through 7 (debug); centralize logs to a syslog server or SIEM.

NetFlow/sFlow/IPFIX provide flow-level visibility for capacity and security analysis.

Monitoring design should define baselines, thresholds, alerting escalation, and retention periods.

NTP synchronization is required for accurate log correlation and certificate validation.

Management VLAN should be separate from user and guest traffic; out-of-band access aids recovery.

Metrics to monitor: interface utilization, error/discard rates, CPU/memory, PoE budget, client counts, and AP health.

Design methodology order: requirements gathering, conceptual design, logical design, physical design, implementation, validation, optimization.

Requirement types: business (budget, timeline), functional (what the network must do), capacity (throughput, client counts), and constraint (regulatory, legacy).

Capacity planning formula: total throughput = active clients x per-client bandwidth x oversubscription factor.

Availability formula: A = MTBF / (MTBF + MTTR); 99.9% uptime allows about 8.76 hours of downtime per year.

Three-tier design = core, distribution, access; two-tier collapsed core removes distribution for smaller campuses.

Oversubscription ratio at access-to-distribution is commonly 20:1 for endpoints; distribution-to-core commonly 4:1.

Design validation uses a pilot or proof of concept before full rollout; baseline metrics are captured first.

Logical design covers VLANs, subnets, routing domains, and policy; physical design covers hardware, cabling, and placement.

Access layer provides PoE to endpoints; distribution layer aggregates access switches and enforces policy; core provides high-speed transport.

Spanning tree defaults to RSTP/MSTP; MSTP maps multiple VLANs to instances to reduce topology size.

Link aggregation (LACP) bundles up to 8 active links per group; member links must match speed, duplex, and VLAN config.

PoE budget: sum powered-device draw per port against switch PoE budget; 802.3at (PoE+) delivers up to 30 W per port, 802.3bt up to 90 W.

Multimode fiber for building risers and intra-campus; single-mode for long runs; Cat6A supports 10GBASE-T to 100 m.

VLAN design: one subnet per VLAN; avoid stretching VLANs across buildings; use routed distribution links instead of large L2 domains.

Redundant distribution pairs use MC-LAG or stacked switches for active-active forwarding with loop prevention.

Stacking/cabling design must account for oversubscription on uplinks and stack-port bandwidth between members.

Capacity-based AP count = concurrent clients / clients-per-AP target; coverage-based uses RF survey and -67 dBm cell edge for voice, -72 dBm for data.

2.4 GHz uses channels 1, 6, 11 only (non-overlapping); 5 GHz offers many non-overlapping channels and is preferred for capacity.

Co-channel interference is controlled by channel reuse planning and transmit power tuning; adjacent APs should be on different channels.

AP transmit power and client power should be balanced so clients associate with the nearest AP (avoid sticky clients).

High-density design: enable band steering, client load balancing, and 20/40/80 MHz channel widths tuned to density.

WLAN design considers RF obstacles: metal attenuates heavily, water absorbs 2.4 GHz, and drywall attenuates mildly.

Roaming requires overlapping coverage (typically 15-20% cell overlap) and consistent SSID/security across APs.

Controller-based vs controller-less (instant) design affects scalability, roaming domain size, and management model.

WAN options: MPLS (private, SLA-backed), internet VPN (cost-effective), dedicated fiber, and broadband/LTE for backup.

SD-WAN uses application-aware routing, policy-based path selection, and overlay tunnels over multiple transports.

Hub-and-spoke centralizes policy but adds latency; full mesh or partial mesh improves branch-to-branch paths.

Branch design often uses a single integrated branch device combining routing, firewall, and switching.

Bandwidth sizing: sum peak application demand per branch and add headroom (commonly 20-30%).

QoS markings must be preserved end-to-end; WAN edge maps DSCP to per-hop behavior and shapes to contracted rate.

Redundancy: dual WAN links with failover, dual CPE, and diverse carrier paths reduce single points of failure.

Latency-sensitive apps (voice, video) require jitter and latency budgets; measure RTT and jitter in design validation.

Defense in depth layers controls: edge firewall, segmentation, endpoint security, identity/AAA, and monitoring.

Zero Trust principles: least privilege, verify explicitly, assume breach; micro-segmentation limits lateral movement.

NAC (802.1X) authenticates devices/users before network access; MAB is a fallback for non-supplicant devices.

Role-based access control maps authenticated identity to VLAN or role via RADIUS attributes.

Guest networks should be isolated with captive portal, rate limiting, and no access to internal subnets.

Security zones: separate untrusted (internet), DMZ, internal, and management planes with policy between zones.

Wireless security: WPA2/WPA3-Enterprise uses 802.1X with RADIUS; WPA3 adds SAE and forward secrecy.

Management plane hardening: restrict admin access to management VLAN, use AAA, and disable unused services.

FCAPS model: Fault, Configuration, Accounting, Performance, Security management.

SNMPv3 provides authentication and encryption; avoid SNMPv1/v2c in production.

Syslog severity levels 0 (emergency) through 7 (debug); centralize logs to a syslog server or SIEM.

NetFlow/sFlow/IPFIX provide flow-level visibility for capacity and security analysis.

Monitoring design should define baselines, thresholds, alerting escalation, and retention periods.

NTP synchronization is required for accurate log correlation and certificate validation.

Management VLAN should be separate from user and guest traffic; out-of-band access aids recovery.

Metrics to monitor: interface utilization, error/discard rates, CPU/memory, PoE budget, client counts, and AP health.