Aruba ACMP cheat sheet

Coverage targets at cell edge: -67 dBm RSSI with 25 dB SNR for voice; -72 dBm RSSI with 20 dB SNR for data-only. Where voice is required, design to the voice target.

EIRP (dBm) = AP transmit power (dBm) + antenna gain (dBi) - cable and connector loss (dB). The result must not exceed the regulatory maximum for the band and channel width.

2.4 GHz uses only channels 1, 6 and 11 at 20 MHz. 5 GHz provides about 25 non-overlapping 20 MHz channels in the US; an 80 MHz channel consumes four of them.

Free space path loss: FSPL(dB) = 20log10(d_km) + 20log10(f_MHz) + 32.44. Each doubling of distance adds roughly 6 dB of loss.

Capacity rule: estimate concurrent clients and per-client throughput, then divide by usable airtime. More APs at lower power raise capacity; higher power raises coverage but also co-channel interference.

Plan 15-20% overlap between adjacent cells to support roaming. In 2.4 GHz keep co-channel reuse at roughly 3-4 cell radii; 5 GHz tolerates tighter reuse.

ARM assigns channel and transmit power automatically. Constrain it with min/max power and an allowed channel list in the arm-profile so it cannot over-power or under-cover the design.

6 GHz (Wi-Fi 6E) offers 59 20-MHz channels in the US, carries no legacy clients, needs 6 GHz-capable APs and clients, and uses preferred scanning channels (PSC) to speed discovery.

AP master discovery methods: static master address stored in AP flash, DHCP option 43, DNS name 'aruba-master', and ADP multicast/broadcast. A factory AP tries these when it boots without a configured controller.

ArubaOS 8 hierarchy: /mm (Mobility Master) -> /md (managed device) -> /node. Configuration set at a higher node is inherited unless overridden at a lower node.

A working WLAN needs three bindings on the AP group: an ssid-profile (SSID name, encryption), an aaa-profile (authentication and roles), and a virtual-ap (VLAN, forwarding mode, band).

Forwarding modes: tunnel (GRE to the controller, centralized policy), bridge (local VLAN on the AP), and split-tunnel (bridge local traffic, tunnel corporate traffic).

CPSec (Control Plane Security) must be enabled and the AP whitelisted before the AP can join; auto-cert provision issues the AP certificate on first join.

AP modes are access, monitor (dedicated air monitor), spectrum monitor, and hybrid. Air monitor and spectrum features require the RF Protect license.

Licensing: one AP license per AP, PEF licenses per concurrent client for role-based firewalling, RF Protect for WIDS and spectrum analysis.

Zero-touch provisioning sequence: DHCP address, controller discovery, image download, configuration download, then the AP appears as Up in 'show ap database'.

Role precedence, highest first: server-derived (Aruba-User-Role) -> 802.1X-derived -> MAC-auth-derived -> initial role -> default role.

RADIUS VSAs: Aruba-User-Role (string) sets the client role, Aruba-User-Vlan (integer) sets the VLAN; both are returned in the Access-Accept.

PEF applies stateful role-based ACLs per client session. The license is counted per concurrent client, not per AP.

WPA2-Enterprise is 802.1X with AES-CCMP; WPA3-Enterprise adds a 192-bit mode; OWE encrypts open networks per client; large PSK deployments should use MPSK rather than one shared key.

Captive portal: unauthenticated clients sit in the initial role (typically 'logon' or 'guest'), which permits only DHCP, DNS and the portal; successful login moves them to the post-authentication role.

CoA and Disconnect messages (RFC 5176) let the RADIUS server change a client's role or end its session without waiting for reauthentication.

MAC authentication uses the MAC address as both username and password; it is commonly paired with 802.1X as a fallback for devices that cannot run a supplicant.

L2 roaming requires both APs to be in the same VLAN and subnet so the client keeps its IP. L3 roaming needs a home agent that anchors the original subnet and tunnels traffic to the foreign controller.

VRRP: master and backup share a virtual IP; the higher priority wins and preemption is configurable. Verify state with 'show vrrp'.

ArubaOS 8 cluster: active-active members synchronize AP and client state so an AP can re-home to a standby member if its active controller fails.

AP fast failover keeps the AP and its clients connected across a controller failure by re-homing the AP to a standby controller; validate it with a deliberate controller reboot.

Master redundancy: the standby master synchronizes configuration and databases from the active master; VRRP on the master pair provides a virtual master IP that APs and managed devices follow.

802.11r (Fast BSS Transition), OKC and PMK caching shorten roaming by avoiding a full 802.1X exchange on each handoff; enable them in the 802.11k/v/r profiles where clients support them.

Client Match and band steering move capable clients to 5 GHz, reducing 2.4 GHz airtime pressure and improving roaming behavior.

'show ap database' lists AP name, IP, group, model, status and flags; it is the first command when an AP is reported missing.

'show user' and 'show station-table' list client MAC, IP, role, VLAN, AP and authentication state.

'show datapath session' shows active flows with source, destination and flags; it confirms whether the role ACL is permitting or dropping client traffic.

'show ap arm rf-summary' reports per-radio channel, transmit power, noise floor and channel changes; use it to detect ARM flapping.

'show ap debug client-table' gives per-client PHY rates, retries and RSSI, which is how sticky clients and low-rate connections are diagnosed.

'packet-capture' on the AP or controller writes a pcap file; capturing on both sides of a GRE tunnel localizes where traffic is dropped.

'show log system', 'show log all' and 'show tech-support' collect logs and a full diagnostic bundle for escalation.

AirWave and Aruba Central provide historical RF, client and availability data; the controller CLI shows only current state.