Aruba SD-WAN (ACSDP) flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Orchestrator role

Central management plane that holds intended configuration, provisions gateways, and pushes policy to devices. It does not forward user traffic, so data-plane forwarding continues if it is unreachable.

Branch Gateway function

Device at a branch that terminates underlay WAN links, builds overlay tunnels, and enforces routing and security policy, consolidating router and firewall roles into one appliance.

VPN Concentrator role

Hub-side device that aggregates many branch overlay tunnels and often hosts centralized breakout and policy enforcement for traffic that is not locally broken out.

Full mesh topology

Overlay design where every site holds a direct tunnel to every other site. It minimizes transit hops but tunnel count grows quadratically, limiting scale.

Hub-and-spoke topology

Overlay design where branches tunnel only to hub gateways and inter-branch traffic transits the hub. Simple to manage but adds latency and hub bandwidth load.

Active-standby gateway pair

High-availability arrangement using VRRP where one gateway forwards and the peer stands ready, requiring a dedicated redundancy link between the two devices.

Underlay WAN interface

Physical or logical interface facing the ISP, configured with address method (static, DHCP, PPPoE) and bandwidth values that feed path-selection scoring.

Overlay tunnel

IPsec-protected logical link between gateways that carries segmented traffic across the underlay. Endpoints must be mutually reachable, with NAT-T when NAT exists.

NAT traversal for tunnels

Mechanism encapsulating IPsec in UDP port 4500 so tunnels form when a gateway sits behind NAT. Blocking that port prevents tunnel establishment.

Health-check probe interval

Configured rate at which a gateway sends liveness probes over a tunnel. Combined with the failure threshold, it sets how quickly a dead path is detected.

Tunnel MTU overhead

IPsec encapsulation consumes roughly 50-70 bytes per packet. Underestimating it causes large-packet drops while small pings succeed, a classic fragmentation symptom.

Spoke-to-spoke via hub

Inter-branch traffic path where tunnels terminate at the hub and traffic is re-forwarded to the destination spoke, trading latency for fewer direct tunnels.

Business intent policy

Reusable policy object bundling application match, segmentation, security posture, and path preference, applied to sites or groups rather than configured per device.

Path quality metrics

Per-link measurements of latency, jitter, packet loss, and MOS used to score candidate paths. Threshold breaches mark a path degraded and trigger re-steering.

Best-path steering

Steering mode that sends a flow over the single highest-scoring qualifying link. Simple and efficient, but the flow moves when that link degrades.

Load-balance steering

Steering mode distributing flows across multiple qualifying links to use aggregate bandwidth. Per-flow stickiness keeps a single session on one path.

Flow replication

Steering mode sending duplicate copies of loss-sensitive traffic over multiple links so one copy survives loss. It consumes bandwidth proportional to link count.

Route preference order

Selection order for competing routes: longest prefix match first, then lowest administrative distance, then lowest metric. Overlay routes should not lose to underlay defaults.

Local internet breakout

Policy that sends SaaS and internet-destined traffic directly out the branch WAN instead of backhauling to the hub, reducing latency and hub bandwidth consumption.

Default business intent

Catch-all policy applied to traffic that matches no explicit application rule. It must be defined deliberately, since unrecognized flows land there.

First-match policy evaluation

Firewall and steering policies are read top-down and the first matching rule wins. A broad permit above a specific deny silently overrides the deny.

Segmentation with VRFs

Isolation technique placing user groups in separate routing tables or zones so inter-segment traffic is denied unless an explicit policy permits it.

Stateful firewall and asymmetry

Gateway flow tracking requires both directions to traverse the same device. Asymmetric routing across gateways breaks state and causes one-way drops.

Least privilege on orchestrator

Role-based access model granting operators only the permissions their duties require, separating monitoring roles from configuration and firmware roles.

IPsec tunnel authentication

Overlay tunnels authenticate peers with pre-shared keys or certificates. Keys must be rotated per policy, and mismatched keys are a common tunnel-down cause.

Guest segment breakout

Design where guest or IoT devices use local internet breakout with restrictive policy, keeping untrusted endpoints off the corporate overlay entirely.

Monitor-only policy testing

Deploying new segmentation or microsegmentation rules in a logging-only action first, so unintended matches are observed before enforcement blocks traffic.

Configuration scope inheritance

Devices inherit settings from group scope and can receive device-level overrides; the most specific scope wins. Out-of-band CLI edits may be overwritten on sync.

Zero-touch provisioning

Factory-default gateway discovers its orchestrator address, authenticates, and pulls its assigned configuration automatically, removing manual on-site setup.

Template variables

Placeholders in a shared configuration that are filled with per-site values such as WAN addresses, bandwidth, and subnets, letting one template serve many sites.

API token authentication

Automation accesses the orchestrator's REST API using a token. Bulk operations should be idempotent and validated in a lab group before production rollout.

Troubleshooting layer order

Diagnose in sequence: underlay reachability, tunnel state, routing, policy, then application. A failure at an earlier layer masks symptoms at later layers.