Aruba Switching Expert (Written) cheat sheet

Store-and-forward switches buffer the entire frame and verify FCS before forwarding; cut-through forwards after reading the destination MAC, so it can propagate errored frames.

A Layer 2 switch builds its MAC address table by learning source MACs per ingress port; unknown unicast, broadcast, and multicast frames are flooded to all ports in the VLAN.

Collision domains end at a switch port; broadcast domains end at a router or Layer 3 boundary.

Access port carries one untagged VLAN; trunk port carries multiple VLANs with 802.1Q tags (native VLAN untagged by default).

Campus design tiers: access (endpoint density, PoE), distribution (policy, inter-VLAN routing), core (high-speed transit); collapsed core merges distribution and core.

Oversubscription ratio = total downstream access bandwidth / uplink bandwidth; typical access-to-distribution design targets 20:1 or better.

Spanning a VLAN across many access switches enlarges the failure domain; keep VLANs local to a wiring closet where possible.

MTU mismatch causes silent drops for large frames; jumbo frames require consistent MTU on every Layer 2 hop and the routed path.

802.1Q inserts a 4-byte tag; TPID 0x8100, 3-bit PCP priority, 1-bit DEI, 12-bit VLAN ID (usable range 1-4094; 0 and 4095 reserved).

Native VLAN frames cross a trunk untagged; a native VLAN mismatch between two ends causes VLAN leaking and is flagged by CDP/LLDP-style checks.

VLAN 1 is the default VLAN on most switches and should not carry user traffic; management VLAN should be separate and unused elsewhere.

Allowed VLAN lists on a trunk filter which tagged VLANs pass; pruning reduces flooded traffic to switches that need the VLAN.

Voice VLAN separates IP phone traffic, often using LLDP-MED to advertise the voice VLAN and QoS policy to phones.

Private VLANs: promiscuous port reaches all; isolated ports reach only promiscuous; community ports reach each other and promiscuous.

GVRP/MVRP dynamically propagate VLAN registrations; static VLAN configuration is preferred for deterministic behavior.

A Layer 2 loop with no STP causes broadcast storms, MAC table instability, and duplicate frames within seconds.

Root bridge election: lowest bridge ID wins; bridge ID = bridge priority (default 32768, multiples of 4096) + system MAC.

802.1D port states: Blocking, Listening, Forwarding, Disabled; 802.1w (RSTP) uses Discarding, Learning, Forwarding.

RSTP port roles: Root, Designated, Alternate (backup for root), Backup (backup for designated); edge ports skip listening/learning.

Path cost is cumulative to root; lower root path cost wins for root port; ties broken by lowest sender bridge ID, then lowest port ID.

Convergence: 802.1D up to 30-50 s; RSTP sub-second to a few seconds; MSTP converges per instance.

MSTP maps VLANs to instances; region must match on name, revision, and VLAN-to-instance mapping or the switch forms a separate region.

BPDU Guard disables a port that receives BPDUs (protects edge ports); Root Guard blocks superior BPDUs to protect the root location.

Loop Guard prevents an alternate/root port from becoming designated when BPDUs stop arriving; it blocks the port instead of forwarding.

LACP (802.3ad) negotiates aggregation with LACPDUs; static/manual trunks skip negotiation and can blackhole on misconfiguration.

All member links in an aggregation must match speed, duplex, MTU, and VLAN membership; mismatches keep the link out of the bundle.

LACP modes: active (initiates), passive (responds); active-active or active-passive both form a bundle; passive-passive does not.

Load-balancing hash uses Layer 2/3/4 fields (src/dst MAC, IP, port); a single flow uses one link, so per-flow bandwidth is limited to one member.

An aggregation is one logical STP port; bundling links reduces STP topology and eliminates blocked redundant links.

Multi-chassis aggregation (MLAG/VSX-style) lets two switches share one logical bundle toward a server or downstream switch.

LACP fallback/static mode keeps a minimum number of links active if LACP negotiation fails, depending on platform support.

Redundant uplinks without aggregation rely on STP; with aggregation, use LACP plus a routing or MLAG design to avoid loops.

A stack presents one management IP and one control plane; member switches share a distributed forwarding plane.

Stack roles: commander/master (control), standby, and members; election is by priority then MAC.

Stack cabling is typically a ring for redundancy; a broken ring can split the stack into independent fragments if split detection is not configured.

Stack split (brain split) can create duplicate IPs and loops; configure split detection and redundant management paths.

Firmware must match across members; a mismatch can prevent a member from joining or cause an unstable stack.

Virtual switching (e.g., VSX/MLAG pairs) keeps separate control planes but synchronizes forwarding state, avoiding single-control-plane risk.

Stack ports have finite bandwidth; oversubscribing stack links between members causes inter-member traffic to bottleneck.

Adding a member with a different model may be restricted by mixed-stacking rules; verify supported combinations before deployment.

An SVI is a logical Layer 3 interface bound to a VLAN; it needs an IP address and the VLAN must be active with at least one up port (platform-dependent).

Inter-VLAN routing options: router-on-a-stick (subinterfaces on a trunk), SVIs on a multilayer switch, or routed ports.

Longest-prefix match wins in the routing table; administrative distance breaks ties between protocols; metric breaks ties within a protocol.

Static route default AD is 1; connected is 0; OSPF is 110; eBGP is 20; iBGP is 200 (Cisco-style values; verify platform defaults).

OSPF: neighbors must match area, hello/dead timers, network type, and authentication; DR/BDR elected on broadcast networks.

DHCP relay (helper address) forwards client broadcasts to a server; the relayed packet carries the gateway IP so the server can pick the pool.

ARP resolves IPv4 to MAC within a subnet; proxy ARP answers for hosts that believe a remote host is local.

VRRP/HSRP provide a virtual gateway IP and MAC; priority and preemption determine the active router.

Port security limits learned MACs per port; violation actions are protect (drop), restrict (drop and log), and shutdown.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS); EAPoL carries authentication between supplicant and switch.

MAB (MAC Authentication Bypass) authenticates devices that lack an 802.1X supplicant by their MAC against RADIUS.

DHCP snooping trusts only designated uplink ports; untrusted ports cannot offer DHCP; the binding table feeds Dynamic ARP Inspection.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table to block ARP spoofing.

IP Source Guard filters traffic by source IP/MAC binding, preventing address spoofing on access ports.

Storm control rate-limits broadcast, multicast, or unknown unicast; exceeding the threshold can drop or shut the port.

Management plane hardening: SSH instead of Telnet, AAA with RADIUS/TACACS+, ACLs on management VLAN, and disable unused services.

IPv4 multicast range 224.0.0.0/4; 224.0.0.0/24 is link-local and never forwarded by routers.

IGMP snooping lets a switch forward multicast only to ports that joined the group; without it, multicast floods like broadcast.

PIM-SM uses a rendezvous point; PIM-DM floods then prunes; IGMPv2/v3 differ in leave and source-specific join support.

QoS pipeline: classification, marking (DSCP 6-bit / CoS 3-bit), queuing, scheduling, and congestion avoidance.

DSCP per-hop behaviors: EF (46) for voice, AF classes with drop precedence, CS values for class selectors; default is 0 (best effort).

Trust boundaries: trust DSCP/CoS at the access edge only for known devices; re-mark untrusted traffic at the boundary.

Weighted random early detection (WRED) drops packets before queue overflow to signal TCP senders; tail drop waits until the queue is full.

Shaping buffers and delays excess traffic; policing drops or remarks excess traffic immediately.

Interface counters: runts (<64 bytes), giants (>MTU), CRC errors (physical/cable), late collisions (duplex mismatch), and input/output discards.

Duplex mismatch symptom: late collisions, FCS errors, and poor throughput on one side; verify both ends and avoid hardcoding one side.

Show commands to sequence: interface status, MAC table, ARP, VLAN/trunk status, STP topology, then routing table.

Syslog severity 0 (emergency) to 7 (debug); SNMP traps and RMON provide event and statistics collection.

Port mirroring (SPAN) copies traffic to a monitor port; a remote mirror (RSPAN) carries mirrored traffic in a dedicated VLAN.

LLDP/CDP reveal neighbor identity, port, and capabilities; mismatched native VLAN or MTU often shows here first.

Configuration management: save running config to startup, keep backups, and use version control or a config server for rollback.

NTP synchronization is required for accurate log correlation and for time-based ACLs or certificates.

Store-and-forward switches buffer the entire frame and verify FCS before forwarding; cut-through forwards after reading the destination MAC, so it can propagate errored frames.

A Layer 2 switch builds its MAC address table by learning source MACs per ingress port; unknown unicast, broadcast, and multicast frames are flooded to all ports in the VLAN.

Collision domains end at a switch port; broadcast domains end at a router or Layer 3 boundary.

Access port carries one untagged VLAN; trunk port carries multiple VLANs with 802.1Q tags (native VLAN untagged by default).

Campus design tiers: access (endpoint density, PoE), distribution (policy, inter-VLAN routing), core (high-speed transit); collapsed core merges distribution and core.

Oversubscription ratio = total downstream access bandwidth / uplink bandwidth; typical access-to-distribution design targets 20:1 or better.

Spanning a VLAN across many access switches enlarges the failure domain; keep VLANs local to a wiring closet where possible.

MTU mismatch causes silent drops for large frames; jumbo frames require consistent MTU on every Layer 2 hop and the routed path.

802.1Q inserts a 4-byte tag; TPID 0x8100, 3-bit PCP priority, 1-bit DEI, 12-bit VLAN ID (usable range 1-4094; 0 and 4095 reserved).

Native VLAN frames cross a trunk untagged; a native VLAN mismatch between two ends causes VLAN leaking and is flagged by CDP/LLDP-style checks.

VLAN 1 is the default VLAN on most switches and should not carry user traffic; management VLAN should be separate and unused elsewhere.

Allowed VLAN lists on a trunk filter which tagged VLANs pass; pruning reduces flooded traffic to switches that need the VLAN.

Voice VLAN separates IP phone traffic, often using LLDP-MED to advertise the voice VLAN and QoS policy to phones.

Private VLANs: promiscuous port reaches all; isolated ports reach only promiscuous; community ports reach each other and promiscuous.

GVRP/MVRP dynamically propagate VLAN registrations; static VLAN configuration is preferred for deterministic behavior.

A Layer 2 loop with no STP causes broadcast storms, MAC table instability, and duplicate frames within seconds.

Root bridge election: lowest bridge ID wins; bridge ID = bridge priority (default 32768, multiples of 4096) + system MAC.

802.1D port states: Blocking, Listening, Forwarding, Disabled; 802.1w (RSTP) uses Discarding, Learning, Forwarding.

RSTP port roles: Root, Designated, Alternate (backup for root), Backup (backup for designated); edge ports skip listening/learning.

Path cost is cumulative to root; lower root path cost wins for root port; ties broken by lowest sender bridge ID, then lowest port ID.

Convergence: 802.1D up to 30-50 s; RSTP sub-second to a few seconds; MSTP converges per instance.

MSTP maps VLANs to instances; region must match on name, revision, and VLAN-to-instance mapping or the switch forms a separate region.

BPDU Guard disables a port that receives BPDUs (protects edge ports); Root Guard blocks superior BPDUs to protect the root location.

Loop Guard prevents an alternate/root port from becoming designated when BPDUs stop arriving; it blocks the port instead of forwarding.

LACP (802.3ad) negotiates aggregation with LACPDUs; static/manual trunks skip negotiation and can blackhole on misconfiguration.

All member links in an aggregation must match speed, duplex, MTU, and VLAN membership; mismatches keep the link out of the bundle.

LACP modes: active (initiates), passive (responds); active-active or active-passive both form a bundle; passive-passive does not.

Load-balancing hash uses Layer 2/3/4 fields (src/dst MAC, IP, port); a single flow uses one link, so per-flow bandwidth is limited to one member.

An aggregation is one logical STP port; bundling links reduces STP topology and eliminates blocked redundant links.

Multi-chassis aggregation (MLAG/VSX-style) lets two switches share one logical bundle toward a server or downstream switch.

LACP fallback/static mode keeps a minimum number of links active if LACP negotiation fails, depending on platform support.

Redundant uplinks without aggregation rely on STP; with aggregation, use LACP plus a routing or MLAG design to avoid loops.

A stack presents one management IP and one control plane; member switches share a distributed forwarding plane.

Stack roles: commander/master (control), standby, and members; election is by priority then MAC.

Stack cabling is typically a ring for redundancy; a broken ring can split the stack into independent fragments if split detection is not configured.

Stack split (brain split) can create duplicate IPs and loops; configure split detection and redundant management paths.

Firmware must match across members; a mismatch can prevent a member from joining or cause an unstable stack.

Virtual switching (e.g., VSX/MLAG pairs) keeps separate control planes but synchronizes forwarding state, avoiding single-control-plane risk.

Stack ports have finite bandwidth; oversubscribing stack links between members causes inter-member traffic to bottleneck.

Adding a member with a different model may be restricted by mixed-stacking rules; verify supported combinations before deployment.

An SVI is a logical Layer 3 interface bound to a VLAN; it needs an IP address and the VLAN must be active with at least one up port (platform-dependent).

Inter-VLAN routing options: router-on-a-stick (subinterfaces on a trunk), SVIs on a multilayer switch, or routed ports.

Longest-prefix match wins in the routing table; administrative distance breaks ties between protocols; metric breaks ties within a protocol.

Static route default AD is 1; connected is 0; OSPF is 110; eBGP is 20; iBGP is 200 (Cisco-style values; verify platform defaults).

OSPF: neighbors must match area, hello/dead timers, network type, and authentication; DR/BDR elected on broadcast networks.

DHCP relay (helper address) forwards client broadcasts to a server; the relayed packet carries the gateway IP so the server can pick the pool.

ARP resolves IPv4 to MAC within a subnet; proxy ARP answers for hosts that believe a remote host is local.

VRRP/HSRP provide a virtual gateway IP and MAC; priority and preemption determine the active router.

Port security limits learned MACs per port; violation actions are protect (drop), restrict (drop and log), and shutdown.

802.1X roles: supplicant, authenticator (switch), authentication server (RADIUS); EAPoL carries authentication between supplicant and switch.

MAB (MAC Authentication Bypass) authenticates devices that lack an 802.1X supplicant by their MAC against RADIUS.

DHCP snooping trusts only designated uplink ports; untrusted ports cannot offer DHCP; the binding table feeds Dynamic ARP Inspection.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table to block ARP spoofing.

IP Source Guard filters traffic by source IP/MAC binding, preventing address spoofing on access ports.

Storm control rate-limits broadcast, multicast, or unknown unicast; exceeding the threshold can drop or shut the port.

Management plane hardening: SSH instead of Telnet, AAA with RADIUS/TACACS+, ACLs on management VLAN, and disable unused services.

IPv4 multicast range 224.0.0.0/4; 224.0.0.0/24 is link-local and never forwarded by routers.

IGMP snooping lets a switch forward multicast only to ports that joined the group; without it, multicast floods like broadcast.

PIM-SM uses a rendezvous point; PIM-DM floods then prunes; IGMPv2/v3 differ in leave and source-specific join support.

QoS pipeline: classification, marking (DSCP 6-bit / CoS 3-bit), queuing, scheduling, and congestion avoidance.

DSCP per-hop behaviors: EF (46) for voice, AF classes with drop precedence, CS values for class selectors; default is 0 (best effort).

Trust boundaries: trust DSCP/CoS at the access edge only for known devices; re-mark untrusted traffic at the boundary.

Weighted random early detection (WRED) drops packets before queue overflow to signal TCP senders; tail drop waits until the queue is full.

Shaping buffers and delays excess traffic; policing drops or remarks excess traffic immediately.

Interface counters: runts (<64 bytes), giants (>MTU), CRC errors (physical/cable), late collisions (duplex mismatch), and input/output discards.

Duplex mismatch symptom: late collisions, FCS errors, and poor throughput on one side; verify both ends and avoid hardcoding one side.

Show commands to sequence: interface status, MAC table, ARP, VLAN/trunk status, STP topology, then routing table.

Syslog severity 0 (emergency) to 7 (debug); SNMP traps and RMON provide event and statistics collection.

Port mirroring (SPAN) copies traffic to a monitor port; a remote mirror (RSPAN) carries mirrored traffic in a dedicated VLAN.

LLDP/CDP reveal neighbor identity, port, and capabilities; mismatched native VLAN or MTU often shows here first.

Configuration management: save running config to startup, keep backups, and use version control or a config server for rollback.

NTP synchronization is required for accurate log correlation and for time-based ACLs or certificates.