Aruba ACMA key terms

The ArubaOS 8 management plane that runs as a virtual appliance or hardware node and centrally configures, licenses, and monitors multiple Mobility Controllers. It replaces the older master-controller role in hierarchical deployments.

An ArubaOS device that terminates AP tunnels, enforces firewall policies and roles, and handles client authentication and roaming. It sits at the control plane of a controller-based WLAN, either standalone or managed by a Mobility Conductor.

An Aruba access point that runs its own ArubaOS Instant software, forming a self-organizing cluster where one AP is elected conductor to share configuration. No dedicated controller is needed unless the cluster is later converted to controller-managed mode.

Aruba's cloud-based management platform that onboards, configures, monitors, and troubleshoots Instant APs, controllers, switches, and gateways through a single dashboard, with AI-powered insights and per-device subscription licensing.

A security and services appliance, formerly called a branch gateway or VPN concentrator, that terminates site-to-site and remote-access tunnels, provides firewall and routing, and can act as a Mobility Controller for small branches.

A group of Mobility Controllers configured to share client state so a wireless client can roam across them without re-authenticating. Clusters support hitless failover and can be Layer 2 or Layer 3.

The IEEE amendment that improves efficiency in dense environments using OFDMA, uplink and downlink MU-MIMO, 1024-QAM, and target wake time. It works in both 2.4 GHz and 5 GHz, and Wi-Fi 6E extends it to 6 GHz.

Orthogonal frequency-division multiple access, an 802.11ax feature that splits a channel into resource units so multiple clients transmit or receive in the same time window, cutting overhead and latency in high-density WLANs.

Multi-user MIMO lets an AP use multiple spatial streams to serve several clients simultaneously in the same channel. Downlink MU-MIMO arrived with 802.11ac; 802.11ax adds uplink MU-MIMO.

Dynamic Frequency Selection is a regulatory requirement in the 5 GHz band where radios must detect radar pulses and vacate the channel within a set time. It unlocks extra channels but can cause unexpected channel changes.

Received Signal Strength Indicator, a relative measure in dBm of how strongly a client hears an AP, or vice versa. Higher, less-negative values mean better signal; typical design targets range from about -65 to -70 dBm.

Signal-to-noise ratio, the difference in dB between the received signal and the noise floor. It predicts achievable data rates better than RSSI alone; roughly 25 dB or more is needed for high MCS rates.

Interference that occurs when multiple APs or clients transmit on the same channel and overlap in coverage, forcing contention and reducing airtime. Good channel planning minimizes it by reusing channels only where coverage does not overlap.

Equivalent Isotropically Radiated Power, the total power an AP effectively radiates, calculated as transmit power plus antenna gain minus cable loss. Regulatory limits cap EIRP, and matching it across APs helps roaming.

Combining adjacent 20 MHz channels into 40, 80, or 160 MHz widths to raise throughput. Wider channels carry more data but consume more spectrum and invite interference, so they are usually reserved for 5 GHz and 6 GHz.

An ArubaOS configuration object that binds an SSID profile, a virtual AP profile, and an AAA profile to a specific AP group, producing one broadcast WLAN. A single AP radio can carry many virtual APs.

The configuration profile that defines the network name (ESSID), whether it is hidden, and the encryption and authentication suite used by a WLAN, such as WPA3-Enterprise with AES-CCMP.

A named collection of Aruba access points that share the same configuration profiles, such as regulatory domain, virtual APs, and radio settings. Profiles are bound to groups rather than to individual APs.

The ArubaOS profile that ties together the authentication methods for a WLAN, including the 802.1X authentication profile, MAC authentication profile, and the server group used to reach RADIUS or LDAP servers.

An ordered list of external authentication servers, such as RADIUS, TACACS+, or LDAP, that a controller tries in sequence, with failover behavior defined. AAA profiles reference a server group to validate client credentials.

An IEEE port-based access control standard in which a supplicant authenticates to a RADIUS server through the AP or controller, acting as the authenticator, before being granted network access and a user role.

An 802.1X EAP method using X.509 certificates on both client and server, giving strong mutual authentication with no password. It requires a PKI to issue and manage client certificates.

Simultaneous Authentication of Equals, the WPA3-Personal key exchange that replaces WPA2's PSK handshake. It provides forward secrecy and resists offline dictionary attacks on captured handshakes.

Opportunistic Wireless Encryption, defined in Wi-Fi Enhanced Open, encrypts open-network traffic per client without credentials. It protects guest and public Wi-Fi from passive eavesdropping while keeping onboarding simple.

A web page that intercepts a client's first HTTP or HTTPS request and requires authentication, acceptance of terms, or payment before granting access. ArubaOS supports internal and external captive portal servers with role assignment.

A named set of permissions, VLAN assignment, and firewall policies applied to a client after authentication or provisioning. Roles determine what traffic a client may send and are often derived from server attributes.

An ordered set of permit or deny rules that filter traffic for a user role, matching on source, destination, service, and application. Policies are stateful and enforced at the controller or gateway.

Remote Authentication Dial-In User Service, the AAA protocol used to authenticate wireless clients, authorize their roles, and return attributes such as VLAN or role name to the controller or AP.

Fast BSS Transition, an amendment that lets a client pre-authenticate with a target AP before roaming, cutting handoff times for latency-sensitive traffic such as voice. It can use over-the-air or over-the-DS key exchange.

Two roaming-assistance amendments: 802.11k lets the AP send neighbor reports so clients know which APs to scan, and 802.11v provides BSS transition management frames steering clients to better APs.

Aruba's client steering feature that continuously collects client RF data and moves sticky or suboptimal clients to better APs and bands, improving overall WLAN performance without disconnecting clients unnecessarily.

Adaptive Radio Management, Aruba's radio resource feature that automatically selects channel and transmit power for each AP, adapting to interference, coverage gaps, and regulatory constraints.

A technique that encourages dual-band clients to associate on 5 GHz or 6 GHz rather than the crowded 2.4 GHz band, typically by suppressing probe responses on 2.4 GHz or delaying them.

A client that stays associated with its original AP even as signal quality degrades, rather than roaming to a closer AP. It hurts throughput for the client and wastes airtime for everyone on that AP.

A roaming optimization that lets a client reuse a previously derived pairwise master key when reassociating to a controller or AP that shares the key cache, skipping a full 802.1X exchange.

Aruba's wireless intrusion detection and prevention feature. It classifies nearby APs and clients as valid, rogue, or interfering, and can contain rogue devices by sending deauthentication frames.

The use of a dedicated or hybrid radio to sweep the RF spectrum and identify non-802.11 interferers such as microwave ovens, cordless phones, or Bluetooth, plotted by amplitude, frequency, and time.