Aruba ACSA key terms

A logical grouping of switch ports that forms its own broadcast domain, independent of physical location. Traffic between different VLANs requires a Layer 3 device or routing function.

A switch port configured to carry traffic for exactly one VLAN, typically used to connect end devices such as PCs, printers, or access points. Frames are sent untagged to the attached device.

A switch port that carries traffic for multiple VLANs simultaneously, normally between switches or to a router or hypervisor. Frames are tagged so the receiving device can tell which VLAN each belongs to.

The IEEE standard method for marking Ethernet frames with a VLAN identifier. A 4-byte tag is inserted into the frame header, letting a single link carry traffic for many VLANs.

The VLAN whose traffic is sent untagged on an 802.1Q trunk link. Both ends of the trunk must agree on the native VLAN, or frames may be misinterpreted or leak between VLANs.

The process of forwarding traffic between VLANs using a Layer 3 device, such as a router with subinterfaces or a multilayer switch with switched virtual interfaces. Each VLAN acts as a separate subnet.

A virtual Layer 3 interface on a switch that represents an entire VLAN and provides an IP address for routing and management. It serves as the gateway address for hosts in that VLAN.

A Layer 2 protocol that prevents switching loops by electing a root bridge and blocking redundant paths. Blocked links can be restored automatically if the active path fails.

The single switch elected as the logical center of a spanning tree. Election is based on the lowest bridge ID, which combines a configurable priority value and the switch MAC address.

A frame that switches running spanning tree exchange to share topology information, elect a root bridge, and detect loops. BPDUs are sent periodically and immediately upon topology changes.

The roles a spanning tree port moves through, such as blocking, listening, learning, and forwarding. These states control whether a port passes user traffic while the topology converges.

An evolution of spanning tree defined in IEEE 802.1w that converges much faster by using explicit handshake messages between neighboring switches instead of long timer-based waits.

An IEEE 802.1s standard that lets several VLANs be mapped to a smaller number of spanning tree instances, reducing the number of blocked links and allowing load sharing across paths.

The point at which all switches in a spanning tree or routing domain agree on a stable topology after a change. Faster convergence means shorter outages when a link or device fails.

Combining multiple physical links between two devices into one logical link to increase bandwidth and provide redundancy. If one member link fails, traffic continues over the remaining links.

An IEEE 802.3ad protocol that dynamically negotiates and monitors link aggregation between two devices, verifying that both ends agree on which physical links belong to the bundle.

The algorithm a link aggregation bundle uses to choose which member link carries a given frame, typically hashing on source and destination MAC or IP addresses and ports to spread traffic.

A database in a switch that maps learned source MAC addresses to the ports they were seen on. It lets the switch forward frames only out the correct port instead of flooding.

The process by which a switch records the source MAC address of each incoming frame along with its ingress port and VLAN. Entries age out after a period of inactivity.

Forwarding a frame out of every port in a VLAN except the one it arrived on, used when the destination MAC address is unknown, a broadcast, or a multicast address.

The set of devices that receive each other's broadcast frames. A VLAN defines a broadcast domain on a switch, and routers or Layer 3 interfaces separate one from another.

Aruba's modern network operating system for its CX series switches, featuring a centralized configuration database, a REST API, and a unified CLI for switching and routing features.

The operating system used on Aruba's legacy ProCurve-derived switch families, such as the 2930 and 5400 series. Its CLI and configuration model differ from ArubaOS-CX.

A saved snapshot of a switch's running configuration that can be compared against or rolled back to later. ArubaOS-CX supports checkpoints and rollback to recover from configuration errors.

The active set of settings currently in effect on a device. Changes take effect immediately but are lost on reload unless saved to the startup configuration.

A manually configured path that tells a router where to send traffic for a specific destination network. It does not adapt automatically to topology changes.

A route with destination 0.0.0.0/0 that matches any address not covered by a more specific route. It is commonly used to send unknown traffic toward an upstream router or internet link.

The list of known destination networks and the next hops or interfaces used to reach them. The router chooses the most specific matching entry when forwarding a packet.

The rule that a router forwards a packet using the routing table entry with the most specific, longest matching subnet mask when multiple routes match the destination address.

A value that ranks the trustworthiness of route sources when several protocols offer a path to the same destination. Lower values are preferred, so static routes usually beat learned routes.

The IP address a host sends traffic to when the destination is on a different subnet. On a switch it is usually the SVI or router interface for the host's VLAN.

A function that forwards DHCP requests from clients on one subnet to a DHCP server on another, inserting the client's gateway address so the server can assign an address from the correct pool.

A feature that limits which and how many MAC addresses may appear on a switch port, and defines an action such as alert or shutdown when a violation occurs. It helps block unauthorized devices.

An IEEE standard for port-based network access control in which a supplicant authenticates through the switch to a RADIUS server before the port grants normal network access.

A protocol used to centrally authenticate, authorize, and account for users or devices connecting to network equipment. Switches act as clients that forward credentials to a RADIUS server.

An encrypted protocol for remote command-line management of network devices. It replaces cleartext Telnet so that credentials and configuration commands cannot be read on the network.

A dedicated VLAN used only for administrative access to network devices, keeping management traffic separate from user data and limiting exposure of the switch's management interface.

A method of restricting what each logged-in administrator can see and change, based on assigned roles such as operator or administrator. It limits damage from mistakes or compromised accounts.

A protocol that synchronizes device clocks to a common time source. Accurate time is essential for consistent log timestamps, certificate validation, and correlating events across devices.

A standard protocol for sending event and error messages from network devices to a central logging server, where they can be stored, searched, and used for troubleshooting and auditing.

A protocol for monitoring and managing network devices by reading structured data such as interface counters and status, and by receiving asynchronous traps when events occur.