Aruba ACMA cheat sheet

Mobility Master (MM) is the ArubaOS 8 management and configuration layer; Mobility Controllers (MC) terminate AP tunnels and forward client traffic.

In a standalone controller deployment there is no MM; one controller acts as master and the remaining controllers are locals in a master-local hierarchy.

An Instant AP (IAP) cluster elects one member as virtual controller; the VC holds cluster configuration and is not a dedicated hardware appliance.

Aruba Central is a cloud management platform for Instant, ArubaOS 8, and ArubaOS 10 devices, providing configuration, monitoring, firmware, and AIOps.

ArubaOS 10 removes the Mobility Master: APs are managed by Central and tunnel client traffic to Aruba gateways that enforce policy and forwarding.

Aruba gateways (7000 and 9000 series) run ArubaOS and provide stateful firewall, VPN, and role-based policy enforcement for wireless traffic.

A Mobility Controller cluster shares a virtual IP and provides L2/L3 mobility, AP fast failover, and stateful client failover across members.

Aruba Wi-Fi 6E APs (630/650 series) support the 6 GHz band; Wi-Fi 7 APs (730 series) add wider channels and multi-link operation.

802.11b uses 2.4 GHz DSSS at 1, 2, 5.5, and 11 Mbps; 802.11a at 5 GHz and 802.11g at 2.4 GHz use OFDM up to 54 Mbps.

802.11n (Wi-Fi 4) adds MIMO, 40 MHz channels, and short guard interval; 4 spatial streams at 40 MHz yield a 600 Mbps PHY rate.

802.11ac (Wi-Fi 5) is 5 GHz only with 80/160 MHz channels, downlink MU-MIMO, and 256-QAM; 802.11ax adds OFDMA and uplink MU-MIMO.

802.11ax (Wi-Fi 6) operates in 2.4 and 5 GHz with 1024-QAM; Wi-Fi 6E extends the same amendment into the 6 GHz band.

802.11i defines RSN/WPA2 with CCMP/AES; 802.11w adds management frame protection (PMF), which WPA3 requires.

802.11k supplies neighbor reports, 802.11v supplies BSS transition management, and 802.11r supplies fast BSS transition for roaming.

802.11e/WMM defines EDCA access categories: voice, video, best effort, and background.

The default beacon interval is 100 ms; 802.11 frames are classified as management, control, or data.

In North America the only non-overlapping 20 MHz 2.4 GHz channels are 1, 6, and 11; each channel is 5 MHz wide with 25 MHz separation between reuse points.

5 GHz UNII-1 (36-48) and UNII-3 (149-165) are non-DFS; UNII-2 (52-64) and UNII-2e (100-144) require DFS radar detection.

6 GHz in the US provides 59 non-overlapping 20 MHz channels (1-233) with no DFS; preferred scanning channels simplify discovery.

FSPL(dB) = 32.44 + 20log10(f in MHz) + 20log10(d in km); free-space path loss rises 6 dB each time distance doubles.

A +3 dB change doubles transmit power and a -3 dB change halves it; a 6 dB reduction roughly halves free-space range.

EIRP (dBm) = AP transmit power (dBm) + antenna gain (dBi) - cable and connector loss (dB).

SNR (dB) = received signal (dBm) - noise floor (dBm); 25 dB supports voice, 20 dB supports data, and below 10 dB is unreliable.

Co-channel interference comes from cells on the same channel; adjacent-channel interference comes from partially overlapping channels.

DFS requires a 60-second channel availability check and a 30-minute non-occupancy period after radar is detected.

An SSID profile defines the network name and security mode (open, WPA2-PSK, WPA2-Enterprise, WPA3); a virtual AP profile binds SSID, AAA, and VLAN.

An AP group is a logical container that applies virtual APs, RF profiles, and regulatory settings to all member APs.

An AAA profile defines authentication methods (802.1X, MAC, PSK), the RADIUS server group, and the initial and final user roles.

A user role is a named set of firewall policies, VLAN assignment, and session parameters applied to a client before or after authentication.

The initial role is assigned before authentication and typically permits only DHCP, DNS, and captive portal traffic.

VLAN assignment can come from the virtual AP, the user role, or a RADIUS server (server-derived VLAN); role-based assignment takes precedence where configured.

RF profiles (dot11a/dot11g radio, ARM, regulatory domain) control channel, transmit power, and scanning behavior for an AP group.

A virtual AP must be bound to an AP group to be broadcast; the same SSID profile can be reused across multiple groups.

WPA2-Personal uses a pre-shared key with CCMP/AES; WPA2-Enterprise uses 802.1X/EAP with a RADIUS authentication server.

WPA3-Personal replaces the PSK handshake with SAE (Simultaneous Authentication of Equals), which resists offline dictionary attacks.

WPA3-Enterprise optionally uses 192-bit security with GCMP-256 and SHA-384, and it mandates PMF (802.11w).

802.1X roles are supplicant (client), authenticator (AP or controller), and authentication server (RADIUS); EAP runs between supplicant and server.

Common EAP methods are PEAP-MSCHAPv2 for password authentication, EAP-TLS for certificates, and EAP-TTLS for tunneled credentials.

Captive portal places the client in a pre-auth logon role until web authentication succeeds, then assigns a post-auth role.

Aruba firewall policies attach to user roles and can match IP address, protocol, port, application, and aliases to allow or deny traffic.

RADIUS Change of Authorization (CoA) lets the server change a client role or disconnect it without a new 802.1X authentication.

Layer 2 roaming keeps the client on the same VLAN and subnet; Layer 3 roaming crosses subnets and uses mobility tunnels to preserve the client IP address.

802.11r fast BSS transition reduces reauthentication delay; 802.11k neighbor reports and 802.11v BSS transition help clients choose a target AP.

Aruba ClientMatch steers clients to better APs and bands, mitigates sticky clients, and balances load across radios.

Design targets: -65 dBm or better for voice, -70 dBm for data, and -75 dBm as a practical minimum for stable connectivity.

Disabling low 2.4 GHz rates (1, 2, 5.5, 11 Mbps) shrinks coverage cells and reduces airtime consumed by management and beacon frames.

ARM dynamically assigns channel and transmit power per radio based on interference, noise, and channel utilization.

Use 20 MHz channels in high-density areas; 40/80 MHz channels raise peak throughput but reduce the number of non-overlapping channels.

Band steering moves dual-band clients to 5 or 6 GHz, and per-radio client limits prevent excessive association counts.

CLI commands: show ap database, show ap active, show station table, show user-table, show datapath session, and show log all.

Aruba Central provides dashboards, alerts, client insights, and AIOps for Instant, ArubaOS 8, and ArubaOS 10 networks.

Association failures point to RF, SSID, or security mismatch; authentication failures point to RADIUS, certificate, or credential problems.

DHCP failures after successful association usually indicate VLAN or DHCP helper misconfiguration rather than a wireless fault.

Packet capture can run on the AP in monitor mode or on the controller; inspect 802.11 management, EAP, and DHCP exchanges.

High retry rates with low SNR indicate RF problems; high retry rates with good SNR suggest co-channel interference or excessive client load.

show ap arm rf-summary and show ap monitor stats display channel, power, noise, and interference per radio.

show tech-support bundles configuration and logs for TAC; enable debug commands only briefly to avoid CPU impact.