Aruba ACSP cheat sheet

A three-tier campus design separates access, aggregation/distribution, and core; a collapsed-core design combines aggregation and core in one redundant pair.

In AOS-CX, the management interface is a separate out-of-band interface in the management VRF; data-plane routing uses the default VRF unless configured otherwise.

Zero-touch provisioning requires the switch to obtain management reachability and a provisioning source via DHCP, Aruba Central, or a local USB configuration.

AOS-CX supports standalone, VSF-stacked, and VSX-paired deployment models; VSF shares one control plane, while VSX keeps two control planes.

Access ports carry a single untagged VLAN; uplinks toward distribution normally carry tagged VLAN trunks or LAGs.

PoE budget planning sums powered-device class maximums per port and must not exceed the switch or power-supply budget.

LLDP is enabled by default on AOS-CX and is used for neighbor discovery, voice VLAN advertisement, and topology validation.

Configuration checkpoints capture a running configuration snapshot that can be restored after a failed change.

Firmware consistency across stack or VSX members is a deployment prerequisite for predictable failover.

VLAN 1 is the default VLAN; ports are members of VLAN 1 until reassigned.

An access port sends frames untagged in one data VLAN; a trunk port carries multiple VLANs with 802.1Q tags.

AOS-CX trunk configuration uses 'vlan trunk native ' for the untagged VLAN and 'vlan trunk allowed ' for tagged VLANs.

The native VLAN must match on both ends of an 802.1Q trunk; a mismatch causes untagged frames to land in different VLANs.

MAC learning builds the Layer 2 forwarding table per VLAN; unknown unicast, broadcast, and multicast are flooded within the VLAN.

The default MAC aging time on AOS-CX is 300 seconds; a learned entry is refreshed when the source MAC is seen again.

Voice VLAN configuration uses LLDP-MED or a VLAN tag policy so an IP phone can place voice traffic in a separate VLAN.

IGMP snooping constrains IPv4 multicast forwarding to interested ports and requires a querier in the VLAN.

Commands 'show vlan', 'show mac-address-table', and 'show interface trunk' verify VLAN membership, MAC learning, and trunk state.

STP root election chooses the lowest bridge ID, which is bridge priority followed by system MAC address; priority values step in increments of 4096.

RSTP port roles are root, designated, alternate, and backup; port states are discarding, learning, and forwarding.

A root port is the lowest-cost path to the root bridge; ties are broken by lowest sender bridge ID, then lowest sender port ID.

MSTP maps VLANs to instances; all VLANs belong to instance 0 (CIST) unless explicitly mapped.

MSTP region members must share the same region name, revision number, and VLAN-to-instance mapping.

An edge port with BPDU guard enabled is shut down if it receives a BPDU, preventing an unauthorized switch from joining the topology.

Root guard blocks superior BPDUs on a designated port and keeps the current root bridge stable.

Loop guard prevents a blocked port from moving to forwarding when BPDUs stop arriving; it is used on non-designated ports.

Commands 'show spanning-tree' and 'show spanning-tree mst' display root, port roles, states, and topology-change counters.

A LAG bundles multiple physical links into one logical link; member ports must have identical speed, duplex, MTU, and VLAN/trunk settings.

Static LAGs do not negotiate; dynamic LAGs use LACP with active or passive mode, and at least one side must be active.

LACP determines active members by system priority, system MAC, port priority, and port number; lower values are preferred.

LAG hashing distributes frames by a configurable hash of Layer 2, Layer 3, and Layer 4 fields; a single flow normally uses one member link.

AOS-CX LAG configuration creates 'interface lag ', sets 'lacp mode active', then adds member interfaces.

A multi-chassis LAG spans two switches and lets both switches forward for the same LAG, providing active-active redundancy.

VSX implements multi-chassis LAG on Aruba AOS-CX with an inter-switch link, a keepalive path, and synchronized VSX LAG configuration.

Commands 'show lag' and 'show lacp interfaces' verify LAG membership, LACP state, and member link health.

An SVI is created with 'interface vlan ' and an IP address; it provides Layer 3 routing for that VLAN.

OSPFv2 is enabled per interface with an 'ip ospf area ' command rather than a global network statement.

OSPF router ID selection prefers a manually configured ID, then the highest loopback address, then the highest active interface address.

OSPF cost equals reference bandwidth divided by interface bandwidth; the default reference bandwidth is 100 Mbps.

On broadcast networks, OSPF elects a DR and BDR by highest interface priority, then highest router ID; priority 0 never becomes DR.

Default OSPF hello/dead intervals are 10/40 seconds on broadcast and point-to-point links and 30/120 seconds on NBMA.

A passive interface advertises the connected network but sends no OSPF hellos on that interface.

Equal-cost OSPF routes install as ECMP; 'show ip ospf neighbor' and 'show ip route ospf' verify adjacency and routes.

VSF stacks multiple physical switches into one logical switch with a single management IP and a shared control plane.

VSF uses member priorities and MAC addresses to elect a conductor; other members act as standby or line-card members.

VSX pairs two AOS-CX switches with independent control planes and a common data path for active-active multi-chassis LAGs.

VSX requires an inter-switch link for data and synchronization and a separate keepalive path for peer liveness.

VSX LAGs use LACP and must be configured with the same LAG ID and member links on both peers.

VSX configuration synchronization can be enabled per feature with 'vsx-sync' to keep VLAN, ACL, and LAG settings consistent.

Commands 'show vsf status' and 'show vsx status' verify member roles, ISL/keepalive health, and configuration synchronization.

VSF is suited to a single wiring closet with one logical stack; VSX is suited to a redundant pair with independent forwarding and control planes.

An ACL is evaluated top-down and stops at the first match; an implicit deny drops unmatched traffic at the end.

Standard ACLs match source IP only; extended ACLs match source, destination, protocol, and Layer 4 ports.

AOS-CX applies an ACL to an interface with 'apply access-list ip in' or 'out'; direction is relative to the interface.

Port security limits the number of source MAC addresses per port; violation actions include protect, restrict, and shutdown.

802.1X uses EAPOL between supplicant and authenticator and RADIUS between authenticator and authentication server.

RADIUS authentication uses UDP 1812 and accounting uses UDP 1813; the client and server must share the same secret.

MAB authenticates devices that cannot run 802.1X by using the device MAC address as the RADIUS username and password.

DHCP snooping blocks rogue DHCP servers by trusting only selected ports; dynamic ARP inspection validates ARP against the snooping binding table.

RADIUS CoA lets the server change a port's VLAN or reauthenticate a session without waiting for a new EAPOL exchange.

NetEdit is an on-premises AOS-CX management application that plans, validates, and deploys configuration changes across devices.

NAE runs Python-based agents that monitor time-series data and can trigger alerts or corrective actions when conditions match.

The AOS-CX REST API uses HTTPS and returns JSON; access requires authentication and, for state-changing calls, a CSRF token.

REST API URIs are versioned, for example /rest/v10.04/system/vlans; the version must match the switch firmware.

SNMPv3 adds authentication and privacy; SNMPv1/v2c use community strings and are less secure.

Syslog, NTP, and sFlow provide centralized event logging, time synchronization, and traffic sampling.

Configuration checkpoints and rollback restore a prior running configuration after an unsuccessful change.

'show running-config', 'show events', and 'show tech' are core CLI sources for configuration and diagnostic data.

'show interface' reports link state, speed, duplex, MTU, and counters; rising CRC or alignment errors point to cabling or duplex issues.

'show lldp neighbor' confirms physical neighbor, port, and VLAN information on a point-to-point link.

'show mac-address-table' and 'show arp' verify Layer 2 learning and Layer 3 address resolution.

Port mirroring copies traffic from a source interface or VLAN to a destination interface for packet analysis.

A broadcast storm with MAC flapping suggests a Layer 2 loop; check STP state, edge ports, and LAG consistency.

'show vsf status' and 'show vsx status' isolate stacking or MC-LAG failover problems.

'show tech' collects a bundled support file with logs, configuration, and command output for escalation.

Ping and traceroute test reachability and path; a ping failure can still occur when ICMP is filtered by an ACL.