Aruba Data Center Professional cheat sheet

Spine-leaf rule: every leaf uplinks to every spine; there are no leaf-to-leaf or spine-to-spine links, so any host pair is at most two hops apart and all uplinks carry traffic simultaneously via ECMP.

Oversubscription ratio = sum of downlink (host-facing) bandwidth ÷ sum of uplink (fabric-facing) bandwidth at a tier; 1:1 at the spine tier, typically 2:1 to 4:1 at the leaf tier.

Typical Aruba scale-unit mapping: 8400, 9300, or 10000 as spine; 6300, 6400, 8320, or 8360 as top-of-rack leaf.

East-west (server-to-server) traffic dominates; routing is pushed to the leaf so Layer 2 domains stay small, ARP tables stay bounded, and ECMP remains available.

VSX pairs two AOS-CX switches that keep independent control planes, exchange data over an inter-switch link (ISL), and use an out-of-band keepalive to distinguish a failed peer from a failed ISL.

VSX active-gateway configures a shared virtual IP and virtual MAC on both peers, so both forward routed traffic for the subnet at the same time.

The underlay must carry at least 1600 bytes of MTU because VXLAN adds 50 bytes; 9000-byte jumbo is the normal data center setting end to end.

Physical design: dual A/B power feeds and PDUs, redundant leaf pairs on diverse fiber paths, and rack power/cooling budgeted before leaf density is chosen.

AOS-CX is a Linux-based, database-centric NOS: all daemons read and write one configuration database, so CLI, REST, and Web UI views stay consistent and a commit is atomic.

Management and programmability interfaces: CLI, Web UI, REST over HTTPS/JSON, NETCONF/RESTCONF (YANG), SNMP, and Ansible collections.

checkpoint create <name> snapshots the running configuration; checkpoint auto holds a rolling boot-time copy; checkpoint rollback <name> restores a snapshot.

VSX configuration objects: VSX system MAC, inter-switch link, and keepalive; verify with show vsx status, show vsx config-consistency, and show vsx brief.

vsx-sync propagates VLANs, VRFs, ACLs, and classifier policies from the primary to the secondary peer, keeping the pair configuration-consistent.

ZTP flow: an unconfigured switch gets an address by DHCP, is pointed at servers by DHCP options 66/67 (or vendor options), then downloads image and startup configuration.

NAE agents are on-box Python scripts backed by a time-series database; rules evaluate monitored expressions and fire actions such as syslog, CLI, or webhook calls.

Platform families: 6300 and 6400 (1U top-of-rack), 8320 and 8360 (higher-density 1U), 8400 (modular chassis), 9300 and 10000 (high-density spine/data center aggregation).

Underlay options are OSPF, IS-IS, or eBGP; eBGP is common at scale because each leaf and spine can own a unique ASN, keeping failure and policy domains local.

Each switch needs a /32 loopback that serves as the VTEP source and destination; point-to-point fabric links typically use /31 or /30 addressing.

BGP best-path order: weight, local preference, locally originated, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric, oldest route, lowest router ID.

ECMP hashing on AOS-CX uses Layer 3 and Layer 4 fields by default; show ip route displays the installed multipath set and the configured maximum paths.

BFD provides sub-second failure detection independent of OSPF or BGP hold timers, and is enabled per neighbor or per interface in the routing protocol context.

Encapsulation overhead is 50 bytes: outer IPv4 20 + UDP 8 + VXLAN 8 + inner Ethernet 14; add this to the largest inner frame when sizing underlay MTU.

VXLAN traffic must be routed symmetrically - the return path must reach the same VTEP pair - so policy and metric design should keep forward and reverse paths congruent.

VXLAN header is 8 bytes, carries a 24-bit VNI (about 16 million segments), and uses UDP destination port 4789 by default.

A VTEP is identified by a loopback IP address and configured as an NVE interface; the VNI-to-VLAN mapping is local to each VTEP.

EVPN is carried in MP-BGP with AFI 25 (L2VPN) and SAFI 70 (EVPN); the control plane replaces flood-and-learn for MAC and IP reachability.

Route types: 1 = Ethernet Auto-Discovery, 2 = MAC/IP advertisement, 3 = Inclusive Multicast Ethernet Tag, 4 = Ethernet Segment, 5 = IP Prefix.

Type 2 with an IP address enables ARP and ND suppression: remote hosts resolve from the control plane instead of flooding ARP across the fabric.

Type 3 (IMET) builds the BUM flood list per VNI; BUM replication is either head-end ingress replication or underlay multicast.

Anycast gateway configures one virtual IP and virtual MAC for a subnet on every VTEP, so every host has a local default gateway and keeps it after migration.

Symmetric IRB uses an L2 VNI per VLAN plus an L3 VNI per VRF; inter-subnet packets are encapsulated with the L3 VNI and a router MAC.

EVPN multihoming with an ESI replaces MLAG/VSX for server dual-homing and supports all-active forwarding across the peer leaves.

One VRF per tenant and one L3 VNI per VRF; identical /24 subnets across tenants are legal because each VRF holds a separate routing table.

VLAN IDs are locally significant while VNIs are fabric-wide, so the same segment can be VLAN 10 on one leaf and VLAN 20 on another, both mapped to the same VNI.

Route targets control isolation: a unique RT per tenant prevents leaking, while a shared RT on an extranet VRF permits selective prefix exchange between tenants.

Symmetric IRB keeps tenant routing inside its own VRF and advertises only host (/32) and subnet prefixes with EVPN type 5.

Isolation levels available: physical (separate switches), L2 logical (VLAN/VNI), L3 logical (VRF), and policy (role-based or group-based ACLs).

A border leaf or data center gateway owns north-south routing and inter-tenant/inter-fabric policy, peering to the WAN router or firewall.

VRF, VNI, and MAC scale limits are platform- and release-specific; check the AOS-CX release notes before sizing a tenant design.

Segmentation primitives on AOS-CX: VLANs, VRFs, port ACLs, classifier policies, and role/group-based policies enforced at the port or tunnel endpoint.

Aruba Dynamic Segmentation assigns a role after 802.1X, MAC authentication, or captive portal (typically via ClearPass); the role maps to a policy applied at the switch port.

Group Based Policy carries a group policy ID, in the frame or the VXLAN-GBP tag, so the enforced ACL follows the workload across VTEPs.

CX 10000 with a Pensando DPU enforces stateful distributed firewall policy at the leaf, giving east-west microsegmentation without tromboning to a central firewall.

CoPP classifies and rate-limits traffic destined to the CPU, protecting routing and management protocols; control-plane ACLs additionally filter who may reach the switch.

Layer 2 hardening set: DHCP snooping, dynamic ARP inspection, IP source guard, port security, BPDU guard, and root guard.

Management plane: SSHv2 only, TACACS+ or RADIUS authentication with local fallback, role-based CLI authorization, and HTTPS/REST restricted to the management VRF.

Classifier policies match on L2/L3/L4 fields and apply per-class permit, deny, rate-limit, or mirror actions; ACLs are evaluated inbound on the interface.

AOS-CX REST base path is https:///rest/v10.04/; POST to /login returns a session cookie that authorizes later GET, PUT, POST, and DELETE calls.

The arubanetworks.aoscx Ansible collection provides modules for VLANs, interfaces, VSX, EVPN, and system settings over REST or SSH.

The pyaoscx Python library wraps the same REST API and can also run on-box, so switches can be scripted locally without an external orchestrator.

ZTP sources: DHCP options 66/67 for image and configuration file servers, Aruba Central activation, or a USB drive with the configuration.

NetEdit is on-premises multi-device configuration and compliance software; Aruba Central is the cloud service adding monitoring, assurance, and group-based provisioning.

Idempotent templates plus checkpoint/rollback form the safety net: re-running a playbook converges to the same state and a bad push is reverted by checkpoint rollback.

Model-driven automation uses NETCONF/RESTCONF with YANG models, while gNMI provides streaming telemetry to external collectors.

NAE agents store monitored state in an on-box time-series database; inspect with show analytics agent and act through syslog, CLI, webhook, or shell actions.

Core CLI triage: show interface, show interface counters errors, show lldp neighbor, show ip route, show bgp evpn summary, show evpn mac-ip, show vxlan.

VSX checks: show vsx status confirms ISL, keepalive, and config sync; show vsx config-consistency lists drifted objects between peers.

Common EVPN faults: VLAN-to-VNI mismatch, route-target mismatch, MTU too small (small pings pass, large packets drop), missing type 3 (BUM fails), or a down BGP neighbor.

MTU black hole signature: ICMP echo with default payload succeeds while bulk transfer or large-packet ping with DF set fails across the tunnel.

Telemetry paths: gNMI streaming subscriptions, sFlow or IPFIX export, and SNMP traps forwarded to a collector for correlation.

Packet capture uses a mirroring session with a source port, VLAN, or ACL and a destination port cabled to an analysis host.