Aruba Data Center Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Spine-leaf topology

A fabric where every leaf switch connects to every spine switch and leaves never connect to each other, so any two hosts are at most two hops apart with ECMP.

Oversubscription ratio

Downlink bandwidth divided by uplink bandwidth at a tier. A 3:1 ratio means hosts can demand three times the bandwidth available toward the spine under full load.

VSX

Aruba Virtual Switching Extension: two AOS-CX switches with independent control planes, an inter-switch link for data, and an out-of-band keepalive that detects split-brain conditions.

East-west traffic

Server-to-server traffic inside the data center. It dominates modern fabrics, which is why routing is pushed to the leaf and Layer 2 domains are kept small.

AOS-CX configuration database

A single shared data store that every AOS-CX daemon reads and writes, keeping CLI, REST, and web UI views consistent and making configuration commits atomic.

Checkpoint and rollback

AOS-CX snapshots of the running configuration saved under a name. Rollback restores a snapshot, and the automatic checkpoint captures the configuration present at boot.

NAE agent

Network Analytics Engine script written in Python and executed on the switch; it monitors time-series state, evaluates rules, and triggers alerts, CLI actions, or webhooks.

Zero Touch Provisioning

An unconfigured switch obtains an address by DHCP, then downloads its software image and startup configuration from servers specified in DHCP options 66 and 67.

BGP best path order

Weight, local preference, locally originated, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, lowest IGP metric, oldest route, lowest router ID.

VXLAN MTU overhead

Encapsulation adds 50 bytes: outer IP 20, UDP 8, VXLAN 8, inner Ethernet 14. The underlay must carry at least 1600 bytes, with 9000 jumbo preferred.

VTEP loopback

A /32 loopback address on each switch used as the source and destination of VXLAN tunnels; it must be continuously reachable through the routed underlay.

BFD

Bidirectional Forwarding Detection: a lightweight hello protocol that detects path failure in milliseconds, independent of routing protocol hold timers such as OSPF or BGP.

VNI

24-bit VXLAN Network Identifier carried in the 8-byte VXLAN header. It labels a Layer 2 or Layer 3 segment and allows roughly 16 million distinct segments.

EVPN route type 2

MAC/IP advertisement route. It distributes a host MAC and optionally its IP address, enabling ARP and ND suppression and MAC learning across the fabric.

EVPN route type 3

Inclusive Multicast Ethernet Tag route. It advertises which VTEPs join a VNI, building the flood list used for broadcast, unknown unicast, and multicast frames.

Anycast gateway

The same virtual IP and virtual MAC configured on every VTEP for a subnet, giving each host a local default gateway that survives workload mobility.

Tenant VRF

A separate routing table per tenant. It lets tenants reuse identical IP subnets without conflict and confines their routing information to their own table.

Route target

BGP extended community attached to EVPN routes. Import and export policies match route targets, which controls which VRFs and tenants exchange prefixes.

L3 VNI

A VNI dedicated to a VRF for inter-subnet routing in symmetric IRB. Routed traffic carries this VNI and a router MAC between VTEPs.

ESI multihoming

Ethernet Segment Identifier used in EVPN to attach one server to two or more leaf switches in an all-active or single-active group without using MLAG.

Dynamic Segmentation

Aruba method that assigns a role to a user or device after 802.1X or MAC authentication and enforces role-based policy at the switch port.

Group Based Policy

Policy enforcement where a group policy ID, carried in the frame or VXLAN header, selects the ACL applied, so policy follows the workload across the fabric.

Control Plane Policing

Classifies and rate-limits traffic destined to the switch CPU, protecting routing and management protocols from floods and denial-of-service attacks.

DHCP snooping

A Layer 2 security feature that builds a trusted binding of port, MAC, and IP from DHCP exchanges and drops DHCP offers arriving on untrusted ports.

AOS-CX REST API

HTTPS and JSON interface under /rest/v10.04/. A POST to /login returns a session cookie used for subsequent GET, PUT, and POST configuration calls.

Ansible AOS-CX collection

arubanetworks.aoscx modules that manage VLANs, interfaces, VSX, and EVPN over REST or SSH, enabling idempotent, repeatable configuration across many switches.

NetEdit versus Central

NetEdit is on-premises software for multi-device configuration and compliance; Aruba Central is the cloud service adding monitoring, assurance, and group-based provisioning.

Idempotency

Property of automation where applying the same template repeatedly yields the same end state, so re-running a playbook causes no unintended changes.

MTU black hole

Symptom where small pings succeed but large packets or bulk transfers fail, because the VXLAN underlay cannot carry the extra 50 bytes of encapsulation.

gNMI streaming telemetry

Model-driven streaming protocol that pushes counters and state from the switch to a collector continuously, instead of polling device data with SNMP.

Mirroring session

AOS-CX configuration that copies traffic from source ports, VLANs, or an ACL to a destination port for packet capture and protocol analysis.

VSX split-brain

Condition where the inter-switch link fails but both peers stay up. If the keepalive still reaches the peer, the secondary disables its VSX links; otherwise it takes over.