Aruba ACSA cheat sheet
Aruba ACSA · Keep the key ideas within reach.
Switching Fundamentals (ArubaOS-CX / ArubaOS-Switch)
ArubaOS-CX uses a daemon-based architecture (e.g., switchd, hmmd, vrfmgrd) with a centralized configuration database; ArubaOS-Switch uses a monolithic config file model.
CLI context differs: ArubaOS-CX enters interface context with 'interface 1/1/1' (member/slot/port); ArubaOS-Switch uses 'interface 1' or 'interface A1' on fixed platforms.
ArubaOS-CX config workflow: 'config terminal' → commands → 'end' writes candidate to running config; 'write memory' or 'copy running-config startup-config' persists it.
Show commands are platform-specific: ArubaOS-CX uses 'show interface brief', 'show running-config'; ArubaOS-Switch uses 'show interfaces brief', 'show config'.
ArubaOS-CX supports 'show vlan', 'show mac-address-table', and 'show arp' under operator (>) or manager (#) privilege levels.
Port naming on CX stackables is member/slot/port; a 4-member stack addresses ports as 1/1/1 through 4/1/28 (example), and 'show system' lists members.
ArubaOS-CX VSX requires ISL (inter-switch link) plus keepalive; ArubaOS-Switch stacking uses backplane/stacking ports with a Commander/Member model.
Interface speed/duplex: 'speed auto' and 'duplex auto' are defaults; hard-set both ends when disabling autonegotiation to avoid duplex mismatch.
VLANs and Layer 2 Technologies
VLAN ID range is 1–4094; VLAN 1 is the default and cannot be deleted; VLANs 1002–1005 are reserved on some platforms.
Access port carries one untagged VLAN; trunk/802.1Q port tags multiple VLANs and uses a native (untagged) VLAN, default VLAN 1.
ArubaOS-CX: 'vlan 10' then 'interface 1/1/1' → 'no routing' → 'vlan access 10' for access; 'vlan trunk allowed 10,20' for trunk.
ArubaOS-Switch: 'vlan 10' → 'untagged 1-24' for access; 'tagged 25-26' for trunk uplinks.
MAC address table entries age out (default 300 seconds on ArubaOS-CX); 'show mac-address-table' verifies learning per VLAN/port.
Voice VLAN / LLDP-MED can auto-assign a VLAN to IP phones; QoS trust and VLAN tagging are pushed via LLDP.
GVRP/MVRP propagate VLANs dynamically; disable on edge ports to prevent VLAN leakage.
Jumbo frames require MTU configuration (default 1500); set consistently on all L2/L3 hops to avoid drops.
Spanning Tree and Link Aggregation
STP root election: lowest bridge ID (priority + MAC) wins; default priority 32768, tune with 'spanning-tree priority' in multiples of 4096.
RSTP (802.1w) converges in sub-second to seconds; MSTP (802.1s) maps VLANs to instances for load balancing.
ArubaOS-CX enables MSTP by default; ArubaOS-Switch default is MSTP on newer platforms, RSTP/STP configurable via 'spanning-tree mode'.
Port roles: Root, Designated, Alternate, Backup; port states: Discarding, Learning, Forwarding (RSTP/MSTP).
Edge/PortFast: 'spanning-tree port-type admin-edge' (CX) or 'spanning-tree admin-edge-port' (ArubaOS-Switch) skips listening/learning on access ports.
BPDU protection: 'spanning-tree bpdu-protection' err-disables edge ports that receive BPDUs.
LACP (802.3ad): 'interface lag 1' → 'lacp mode active' on CX; 'trunk 1-2 lacp' on ArubaOS-Switch. Member links must match speed/duplex/VLAN config.
LAG load-balancing hash is configurable (L2/L3/L4); verify with 'show lacp interfaces' or 'show port-access lacp'.
IP Routing Fundamentals and Layer 3 Services
Enable routing globally with 'ip routing' (CX) or 'ip routing' (ArubaOS-Switch); SVIs are created by assigning an IP to a VLAN interface.
ArubaOS-CX: 'interface vlan 10' → 'ip address 10.0.0.1/24'; ArubaOS-Switch: 'vlan 10' → 'ip address 10.0.0.1 255.255.255.0'.
Static route syntax: 'ip route 0.0.0.0/0 10.0.0.254' (CX) or 'ip route 0.0.0.0 0.0.0.0 10.0.0.254' (ArubaOS-Switch).
OSPF: 'router ospf 1' → 'area 0' → 'network 10.0.0.0/24 area 0'; verify with 'show ip ospf neighbor' and 'show ip route'.
DHCP relay: 'ip helper-address ' on the SVI forwards broadcasts to the DHCP server.
VRRP/HSRP provide first-hop redundancy; VRRP uses virtual IP + priority (default 100), higher priority becomes Master.
ARP table: 'show arp' (CX) or 'show arp' (ArubaOS-Switch); proxy ARP is enabled by default on many interfaces.
Verify connectivity with 'ping', 'traceroute', and 'show ip route' to confirm the longest-prefix match is installed.
Network Security and Device Management
Management access: SSH (TCP 22), HTTPS (TCP 443), Telnet (TCP 23, disable); restrict via 'ip authorized-managers' or ACLs on the management VRF.
AAA: 'aaa authentication login default local' or RADIUS/TACACS+; RADIUS for 802.1X, TACACS+ for command accounting.
802.1X port-based auth: 'aaa authentication port-access dot1x authenticator' (CX) with RADIUS server; MAB for devices that cannot supplicate.
Port security limits learned MACs per port; violation actions include protect, restrict, and shutdown.
DHCP snooping + dynamic ARP inspection + IP source guard mitigate spoofing; trusted uplink ports must be explicitly configured.
Role-based access: ArubaOS-CX uses local users with roles (administrator/operator) and RBAC; ArubaOS-Switch uses privilege levels (operator/manager).
Firmware/backup: 'copy running-config startup-config', 'copy startup-config tftp://...' and 'copy flash tftp://...' preserve config and images.
NTP and syslog: 'ntp server ' and 'logging ' centralize time and event records for audit.