Aruba ACSA study plan
Aruba ACSA · Give each week a clear focus.
8 weeks · About 6 hours per week
Switching fundamentals (ArubaOS-CX/ArubaOS-Switch) & VLANs and Layer 2 technologies
Describe how an ArubaOS-CX switch forwards frames differently from an ArubaOS-Switch, using the terms control plane, data plane, and forwarding table
Configure a management IP, hostname, and admin credentials on a simulated ArubaOS-CX switch and confirm reachability via SSH
Build a 3-VLAN topology on a single switch, assign access ports to each VLAN, and verify with show vlan and show mac-address-table
Explain the difference between tagged and untagged ports and predict the effect of a misconfigured uplink on inter-switch traffic
Your checkpoint
A working single-switch lab with three VLANs, saved config, and a one-page note mapping each command used to the OS it belongs to (CX vs. Switch)
VLANs and Layer 2 technologies & Spanning tree and link aggregation
Configure 802.1Q trunk links between two switches and validate VLAN propagation with show interfaces trunk or the CX equivalent
Trace a frame from an access port to a trunked uplink and identify where the tag is added and stripped
Explain the role of the native/untagged VLAN and describe what happens when native VLANs mismatch across a trunk
Configure voice VLAN and LLDP-MED behavior on an access port
Your checkpoint
Two-switch trunked topology where a host on VLAN 10 on switch A pings a host on VLAN 10 on switch B, with captured show command output proving the trunk is passing all VLANs
Spanning tree and link aggregation
Describe the STP/RSTP/MSTP election process: root bridge, root port, designated port, blocked port
Predict the port states and roles in a three-switch triangle before configuring, then verify with show spanning-tree
Configure MSTP with two instances and map VLANs to each instance
Identify and remediate a deliberate loop by enabling loop protection or BPDU guard and confirming the port is disabled
Your checkpoint
A three-switch triangle lab with MSTP configured, plus a written prediction-vs-actual table of port roles before and after removing a link
Spanning tree and link aggregation & IP routing fundamentals and Layer 3 services
Explain LACP active vs. passive modes and when a static (manual) aggregation is appropriate
Configure a two-member LACP bundle between two switches and verify member state with show lacp or show interfaces lag
Configure an SVI on each switch and confirm that a routed LAG carries traffic across the link
Diagnose a LAG that fails to form and document the root cause (mode mismatch, speed mismatch, or STP conflict)
Your checkpoint
A functioning LACP bundle carrying routed traffic between two switches, with a troubleshooting log of at least one intentionally broken configuration and its fix
IP routing fundamentals and Layer 3 services
Explain how a router builds a forwarding table from directly connected, static, and dynamic sources
Configure static routes and a default route on ArubaOS-CX and verify with show ip route
Configure OSPF in a single area across three routers and confirm adjacency with show ip ospf neighbors
Explain the difference between an SVI and a routed port and choose the correct one for a given topology
Your checkpoint
A three-router OSPF lab where every loopback is reachable from every other router, with the routing table output pasted into a summary sheet
IP routing fundamentals and Layer 3 services & Network security and device management
Configure DHCP relay (helper address) on an SVI and verify a client on a remote VLAN receives an address
Configure a management VLAN and restrict management access to that VLAN only
Explain the purpose of ARP and configure dynamic ARP inspection or ARP protection on an access VLAN
Describe how first-hop redundancy (VRRP) provides a resilient gateway and configure it between two routers
Your checkpoint
A lab where a client on a non-management VLAN gets DHCP via relay, cannot reach the management interface, and fails over to a backup gateway when the primary is shut down
Network security and device management
Configure local user roles and RADIUS/TACACS+ authentication for switch management access
Configure port security or MAC limiting on an access port and trigger a violation to observe the action
Explain 802.1X port-based authentication flow (supplicant, authenticator, authentication server) and configure a basic authenticator port
Apply a management ACL and confirm unauthorized source addresses are dropped
Your checkpoint
A hardened switch config with AAA, port security, and a management ACL, plus a test matrix showing each control blocking the intended traffic
Switching fundamentals (ArubaOS-CX/ArubaOS-Switch) & VLANs and Layer 2 technologies & Spanning tree and link aggregation & IP routing fundamentals and Layer 3 services & Network security and device management
Rebuild the full lab topology from a blank config in under 90 minutes without notes
Diagnose three injected faults (a trunk native VLAN mismatch, a LAG mode mismatch, and a missing OSPF network statement) from symptoms alone
Explain, in writing, how a frame travels from an access port through a trunk, across a LAG, and is routed by an SVI to a remote subnet
Review every missed practice question and write a corrected one-sentence rule for each
Your checkpoint
A timed full-topology rebuild with a scored fault-isolation log (3 of 3 faults diagnosed within 30 minutes total)
Milestones
Week 2: Can explain and demonstrate tagged vs. untagged frames across a trunk without referring to notes
Week 4: Can predict STP port roles in a triangle and correctly form an LACP bundle on the first attempt
Week 6: Can route between three subnets via OSPF and deliver DHCP to a remote VLAN through relay
Week 8: Full-topology rebuild completed within 90 minutes with all three injected faults isolated