Aruba Data Center Professional common mistakes
Aruba Data Center Professional · Understand the traps and how to avoid them.
Treating the VXLAN VNI as if it were the VLAN ID, and assuming one global VLAN-to-VNI mapping must exist on every VTEP.
Candidates carry over VLAN-centric thinking; VLANs are locally significant (12-bit) while VNIs are globally significant (24-bit), so the same VLAN number can map to different VNIs on different switches.
What to do instead
Build an explicit per-VTEP mapping table (for example, local VLAN 10 maps to VNI 10010) and verify it with show commands such as show vxlan vni and show vlan. State the 24-bit VNI versus 12-bit VLAN distinction before answering any design question.
Troubleshooting EVPN overlay failures by checking only Type 2 MAC/IP routes, then concluding BUM traffic should work.
Type 2 routes advertise known unicast MAC/IP bindings, but BUM replication depends on Type 3 Inclusive Multicast Ethernet Tag routes (and Type 5 for IP prefix routing). Candidates memorize Type 2 and ignore the rest.
What to do instead
Create a route-type reference table: Type 2 for MAC/IP, Type 3 for IMET/BUM, Type 5 for IP prefix. When a VNI has no BUM connectivity, explicitly verify Type 3 routes exist for that VNI on every VTEP.
Designing a routed underlay without unique loopback addresses or without advertising those loopbacks into the IGP/BGP.
The VXLAN VTEP source address is typically a loopback; if the loopback is not reachable across the fabric, tunnels fail even though the physical links and IGP adjacencies appear up.
What to do instead
Assign a unique loopback per switch, advertise it in the underlay routing protocol, and validate end-to-end reachability with ping and traceroute sourced from the loopback before configuring VXLAN.
Applying ArubaOS-Switch (ProVision) CLI syntax such as tagged/untagged port commands on an AOS-CX switch.
Many candidates have prior HPE/Aruba campus switching experience and default to the legacy CLI, which uses different VLAN membership and trunk commands.
What to do instead
Practice the CX model: create the VLAN, enter the interface context, then use vlan access or vlan trunk allowed. Verify with show vlan port and show running-config interface rather than relying on remembered ProVision commands.
Assuming an ACL is stateful or that a role-based policy automatically permits return traffic.
ACLs on CX switches are stateless and directional; role-based policies are applied at enforcement points but do not create a state table by themselves. Candidates confuse them with firewall behavior.
What to do instead
For any ACL question, identify direction and whether return traffic needs a matching rule. Use stateful features where the platform supports them, or configure both directions explicitly, and describe where the policy is enforced (port, SVI, or user role).
Creating a VRF for tenant isolation but not attaching it to the SVI or interface, so traffic remains in the default routing table.
A VRF is a separate routing table; it does nothing until interfaces and routes are bound to it. Candidates equate creating the VRF with completing the isolation.
What to do instead
Always pair VRF creation with vrf attach on the relevant SVI or routed port, then verify with show ip route vrf and show vrf. Explicitly state that route leaking between VRFs requires deliberate configuration.
Hardcoding device credentials and management IPs directly into automation playbooks or scripts instead of using inventory variables and a secrets store.
Lab scripts are often written quickly with literal values, and candidates reuse that pattern in exam scenarios about production automation.
What to do instead
Use inventory groups and host_vars for addressing, and a vault or external secret store for credentials. For AOS-CX REST automation, describe token-based authentication and avoid embedding passwords in clear text.
Diagnosing intermittent congestion or microbursts using SNMP polling at multi-minute intervals.
SNMP polling is too coarse to observe sub-second queue spikes, so candidates conclude the network is healthy when buffers are actually overflowing briefly.
What to do instead
Use streaming telemetry or sFlow with high-resolution timestamps and inspect per-queue buffer and drop counters. Distinguish polling-based monitoring from event-driven telemetry when choosing a troubleshooting tool.
Sizing a spine-leaf fabric around north-south traffic and ignoring east-west oversubscription between leaves.
Candidates apply three-tier campus thinking, where most traffic exits the network, to data center designs where server-to-server traffic dominates.
What to do instead
Compute per-leaf uplink oversubscription and fabric bisection bandwidth from expected east-west flows. Justify spine count and link speed using east-west traffic ratios rather than only uplink-to-core capacity.
Deploying VSX while omitting the inter-switch link or keepalive, or configuring active-gateway with different virtual MACs on the two peers.
VSX is often conflated with traditional stacking or generic MLAG, so candidates forget that VSX requires both an ISL and a separate keepalive path, and that active-gateway requires a shared virtual MAC.
What to do instead
Configure the ISL as a LACP multichassis link, place the keepalive on a separate path such as the management network, verify with show vsx status, and set the identical active-gateway MAC on both peers.