Aruba Switching Professional cheat sheet

VLANs segment broadcast domains; 802.1Q trunk tags frames with a 12-bit VLAN ID (1–4094).

STP (802.1D) prevents loops by electing a root bridge (lowest bridge ID) and placing non-designated ports in blocking state; RSTP (802.1w) converges faster with alternate/backup port roles.

Link aggregation (LACP 802.3ad) bundles multiple links into one logical link, increasing bandwidth and redundancy; all member ports must have identical speed, duplex, and VLAN configuration.

A router forwards packets between subnets using a routing table; directly connected routes have administrative distance 0, static routes default AD 1, OSPF AD 110.

OSPF uses link-state advertisements and Dijkstra's SPF algorithm; cost is calculated as reference bandwidth (100 Mbps) divided by interface bandwidth.

Wireless LANs use CSMA/CA with optional RTS/CTS to avoid collisions; 802.11 management frames include beacons (advertise SSID), probes, and authentication/association requests.

Roaming between APs with the same SSID allows client mobility; 802.11r enables fast BSS transition to reduce reauthentication delay.

PoE (802.3af/at) delivers power over Ethernet cables; 802.3af provides up to 15.4W per port, 802.3at (PoE+) up to 30W.

Frequency and wavelength are inversely related: λ = c / f, where c ≈ 3×10^8 m/s; 2.4 GHz has ~12.5 cm wavelength, 5 GHz ~6 cm.

Higher frequency bands (5 GHz) have smaller coverage but more non-overlapping channels; 2.4 GHz has only 3 non-overlapping channels (1, 6, 11).

Signal strength is measured in dBm; 0 dBm = 1 mW, 10 dBm = 10 mW, 20 dBm = 100 mW; +3 dB doubles power, -3 dB halves it.

Free-space path loss increases with distance and frequency; doubling distance adds ~6 dB loss (inverse square law).

SNR (signal-to-noise ratio) is the difference in dB between signal and noise; higher SNR yields better throughput and reliability.

Channel width affects throughput and spectral efficiency: 20 MHz is narrow and robust; 40/80 MHz increases throughput but reduces available channels and increases interference.

MIMO uses multiple antennas to increase throughput (spatial multiplexing) or improve reliability (spatial diversity); 802.11n supports up to 4 spatial streams.

Interference sources include co-channel (same channel) and adjacent-channel (overlapping) APs, plus non-Wi-Fi devices (microwaves, Bluetooth); use spectrum analysis to identify.

WPA2 uses AES-CCMP encryption; WPA3 uses SAE (Simultaneous Authentication of Equals) for stronger password-based authentication and forward secrecy.

802.1X authentication involves three roles: supplicant (client), authenticator (switch/AP), and authentication server (RADIUS); EAP carries authentication messages.

RADIUS uses shared secret and UDP ports 1812 (authentication) and 1813 (accounting); it centralizes AAA for network access.

MAC authentication (MAB) is a fallback for devices that cannot run 802.1X supplicant; it is vulnerable to MAC spoofing and should be combined with other controls.

Port security limits the number of MAC addresses per switch port; violation actions include protect, restrict, and shutdown.

DHCP snooping filters untrusted DHCP messages and builds a binding table; it prevents rogue DHCP servers and is often paired with dynamic ARP inspection (DAI).

IPsec provides confidentiality, integrity, and authentication at Layer 3; it uses AH (integrity) and ESP (encryption), with IKE for key exchange.

Role-based access control (RBAC) assigns permissions based on user roles; in Aruba ClearPass, roles can be derived from AD groups or attributes.

A switch learns MAC addresses by inspecting source MAC of incoming frames and populates the MAC address table; unknown unicast frames are flooded to all ports in the VLAN.

Spanning Tree Protocol (STP) prevents Layer 2 loops; PortFast (edge port) bypasses listening/learning states for access ports connected to end devices.

Link aggregation (LACP) requires both sides to be configured; use active/passive modes; verify with show commands like 'show lacp interfaces'.

VLAN trunking (802.1Q) carries multiple VLANs over one link; native VLAN frames are untagged; ensure native VLAN matches on both ends to avoid VLAN hopping.

Routing between VLANs requires a Layer 3 device (router or Layer 3 switch) with an interface per VLAN (SVI) or subinterfaces on a router.

Wireless client connectivity requires successful probe, authentication, association, and (if used) 802.1X/EAP exchange; failures can be diagnosed with client debug or AP logs.

PoE negotiation: 802.3af/at uses LLDP or CDP to negotiate power; if detection fails, check cable and power budget.

Troubleshooting connectivity: use ping (ICMP), traceroute, and show commands (show interfaces, show arp, show mac-address-table) to isolate Layer 1/2/3 issues.

SNMP uses UDP port 161 for agent queries and 162 for traps; SNMPv3 adds authentication and encryption (authPriv).

Syslog severity levels range from 0 (emergency) to 7 (debug); lower numbers are more severe; configure logging server and trap level appropriately.

RMON (Remote Monitoring) provides standardized statistics and alarms; groups include statistics, history, alarm, and event.

NetFlow/sFlow provide flow-level traffic visibility; sFlow samples packets and is supported on Aruba switches for traffic analysis.

NTP (Network Time Protocol) synchronizes device clocks; accurate time is critical for log correlation and certificate validation.

Port mirroring (SPAN) copies traffic from one or more ports to a monitoring port for analysis with protocol analyzers.

LLDP (802.1AB) and CDP discover neighbor devices; LLDP-MED extends to VoIP and PoE devices; use 'show lldp neighbors' to map topology.

Wireless monitoring: use Aruba AirWave or Central for AP health, client count, channel utilization, and rogue AP detection; enable ARM (Adaptive Radio Management) for dynamic channel/power optimization.