Aruba Architect Expert (Written) cheat sheet

Design hierarchy: access → distribution → core, with collapsed-core valid for small sites where core and distribution functions share hardware.

Use the PPDIOO-style lifecycle (prepare, plan, design, implement, operate, optimize) as the ordering for design deliverables and sign-off gates.

Capacity rule: size uplinks so peak utilization stays below ~70% of link capacity; oversubscription ratios are expressed as access-to-uplink (e.g., 20:1 access edge, 4:1 distribution).

Availability: redundant paths plus device redundancy; MTBF/MTTR drive availability, and dual-homed designs remove single points of failure at each tier.

Requirements capture order: business goals → technical requirements → traffic flows → topology → device selection → validation.

For wireless, the RF design (AP count, channel plan, coverage/capacity targets) precedes the logical WLAN design and controller sizing.

Document baseline traffic flows and applications per site type before choosing overlay, underlay, or routing protocol.

Design validation uses pilot/lab testing and post-implementation verification against the documented requirements.

PoE budget: total switch PoE watts must cover AP and device draw with headroom; PoE (802.3af) 15.4 W, PoE+ (802.3at) 30 W, PoE++ (802.3bt) up to 60/90 W at the PSE.

Wi-Fi 6 uses both 2.4 GHz and 5 GHz; 6 GHz (Wi-Fi 6E) adds 1200 MHz of spectrum and requires 6E-capable APs and clients.

Channel planning: 2.4 GHz uses 1/6/11 (20 MHz); 5 GHz favors 20/40 MHz with DFS channels available; 80 MHz is generally avoided in high-density designs.

Coverage target is typically -67 dBm RSSI for voice/data at the cell edge; SNR of 25 dB or better supports higher MCS rates.

High-density rule: design for capacity (clients per AP, throughput per client) rather than coverage; use band steering and minimum data rates to push clients to 5/6 GHz.

Branch designs commonly use a single collapsed-core stack plus WAN uplink; local survivability may require a local gateway or redundant WAN.

AP uplinks at 1 GbE may bottleneck Wi-Fi 6; multi-gig (2.5/5 GbE) uplinks are used where AP throughput exceeds 1 Gbps.

Guest and IoT SSIDs are isolated via VLANs and role-based policies, not just separate SSIDs.

Spine-leaf: every leaf connects to every spine (full mesh), spines do not connect to each other; scale is achieved by adding leaves or spines.

Overlay vs underlay: VXLAN provides Layer 2/3 overlay over a Layer 3 IP underlay; EVPN serves as the control plane for VXLAN.

Oversubscription in the DC is expressed as leaf-to-spine ratio; east-west traffic dominates, so designs favor low oversubscription (e.g., 3:1 or better).

WAN options: MPLS, internet VPN, and SD-WAN; SD-WAN uses application-aware policies and multiple transports with per-path SLA selection.

Edge design must account for NAT, firewall state, and DDoS scrubbing placement relative to the WAN aggregation.

Data center redundancy uses MLAG/VSX or EVPN multihoming for dual-homed servers; avoid spanning tree where possible.

MTU: VXLAN adds 50 bytes of overhead; underlay must support jumbo frames (typically 9000 MTU) to avoid fragmentation.

Branch-to-DC traffic should be classified and steered by application; local internet breakout reduces backhaul for SaaS.

Segmentation models: VLAN-based, role-based (user/device identity), and micro-segmentation (per-workload policy).

Zero Trust principles: verify explicitly, least privilege, assume breach; policy is enforced close to the workload, not only at the perimeter.

802.1X with EAP-TLS or PEAP provides port-based authentication; MAB is a fallback for devices that cannot supplicate.

Dynamic segmentation assigns a role after authentication, and role-based ACLs or group policies enforce east-west restrictions.

RADIUS and TACACS+ differ: RADIUS for network access (802.1X), TACACS+ for device administration with per-command authorization.

Guest networks require captive portal plus client isolation; IoT devices should be placed in a restricted segment with limited egress.

Firewall policy design: default deny, explicit allow with logging, and periodic rule review; stateful inspection tracks flows.

Encryption: WPA3/SAE replaces WPA2-PSK; 802.1X with TLS protects credentials; management plane access should be encrypted (SSH/HTTPS).

REST APIs use HTTP methods: GET (read), POST (create), PUT/PATCH (update), DELETE (remove); status codes 2xx success, 4xx client error, 5xx server error.

Idempotency: repeating an operation yields the same end state; declarative automation (desired state) is idempotent, imperative scripts are not.

Configuration management tools (Ansible, Terraform) use declarative templates; templates plus variables enable consistent multi-site deployment.

NETCONF/YANG and RESTCONF provide model-driven programmatic configuration; SNMP is used for monitoring, not ideal for config.

Orchestration coordinates multi-device workflows; automation executes single tasks; orchestration depends on automation primitives.

Secrets management: never hard-code credentials; use vaults or environment variables, and rotate API tokens.

CI/CD for network changes: version control → validation/linting → lab test → staged rollout → rollback plan.

Webhooks and streaming telemetry push events; polling APIs on short intervals increases controller load.

SNMP traps are event-driven; polling is interval-based; both complement streaming telemetry for real-time visibility.

Syslog severity levels 0 (emergency) through 7 (debug); production should typically log at 4-6 to control volume.

Baseline metrics: interface utilization, error/discard counters, latency, jitter, packet loss, and AP client counts.

SLA thresholds: voice typically requires <150 ms one-way latency, <30 ms jitter, and <1% loss.

NetFlow/IPFIX/sFlow provide flow-level traffic analytics for capacity and security anomaly detection.

Wireless assurance uses client experience metrics (onboarding time, DHCP/AAA success, roaming time, retries) rather than AP uptime alone.

Alert design: threshold-based vs anomaly-based; suppress flapping and deduplicate correlated alarms.

Retention and sampling: high-rate telemetry needs aggregation and retention policies to remain useful and affordable.

Lifecycle stages: plan/design → deploy → operate → optimize → retire; each stage has distinct validation and documentation outputs.

Migration sequencing: assess current state → design target → pilot → phased cutover → decommission; rollback criteria defined before cutover.

End-of-life planning uses vendor EOL/EOS notices; budget cycles typically require lead time of 12-18 months for refresh.

Risk management: identify dependencies, maintenance windows, and change-control approvals before migration.

Operational cost drivers include licensing/subscription models, support contracts, power/cooling, and staff training.

Change management uses CAB approval and documented backout plans; post-change verification confirms service restoration.

Capacity forecasting uses historical growth trends and business projections to time hardware and WAN upgrades.

Documentation as-built diagrams, IP plans, and configuration backups are part of lifecycle governance and audit readiness.