Aruba Campus Access Architect (HPE7-A11) cheat sheet

Aruba ESP layers: infrastructure (AOS-CX switches, APs), orchestration (Central/ArubaOS 8), and AIOps/analytics (Central AI Insights, UXI).

Hierarchy tiers: core (routing, EVPN/VXLAN border), aggregation/distribution (policy, gateways), access (PoE, AP uplinks); collapsed core is valid for small campuses.

Campus design rule: keep Layer 2 domains small; place Layer 3 gateways at the aggregation layer or use EVPN-VXLAN distributed anycast gateways at access.

Oversubscription guidance: about 1:1 to 1:4 at access-to-aggregation, and 1:4 to 1:8 at aggregation-to-core for general campus traffic.

AOS-CX VSX pairs share a control plane via ISL and use active-active multichassis LAGs; VSF is a stack of up to 10 members with one control plane.

PoE budget planning: sum device class draw (802.3af 15.4 W, at 30 W, bt up to 90 W) and compare with switch PoE budget minus reserve for AP and camera peak.

RF design starting points: -67 dBm RSSI for voice, -72 dBm for data, SNR of 25 dB for voice and 20 dB for data, and 15-20 percent cell overlap for roaming.

Use 5 GHz and 6 GHz as primary capacity bands; 2.4 GHz is reserved for legacy and IoT with 1/6/11 non-overlapping channels.

AOS-CX VLAN creation: vlan 10 then name users; assign ports with interface 1/1/1 then vlan access 10 or vlan trunk allowed 10,20.

VSX LAG requires a multichassis LAG interface (interface lag 100 multi-chassis) referenced by both peers, plus an ISL LAG carrying the VSX synchronization.

Aruba AP onboarding order: DHCP, DNS, then discovery of the controller or Central via Activate, DHCP option 43, or ADDRESS environment settings.

AOS 8 cluster AP termination modes: L2 (AP and controller in the same VLAN) and L3 (AP tunnels to controller across routed networks); L3 needs AP MTU headroom for GRE.

Wi-Fi 6E adds the 6 GHz band with 59 channels of 20 MHz (or 29 of 40 MHz, 14 of 80 MHz); APs need 6E-capable radios and PSE power for 6 GHz.

ClientMatch steers clients to the best AP and band; band steering pushes dual-band clients to 5 GHz, and 802.11k/v/r assist fast roaming.

AOS-CX uplink redundancy: use LACP LAGs to two upstream switches where MLAG/VSX is unavailable, and enable loop protect on edge access ports.

PoE standards on AOS-CX: poe-allocate-by class or usage, poe-priority critical, and LLDP power negotiation for Class 4 and higher devices.

Aruba role-based access: user roles derive from 802.1X (server-derived attributes), MAC-based rules, or device fingerprint; roles map to role-based ACLs enforced at the gateway or controller.

Dynamic Segmentation tunnels user or IoT traffic in GRE from access switch (AOS-CX with PAPI/UBT) to a gateway cluster, applying policy at the tunnel endpoint.

ClearPass policy flow: service, then authentication method, then role mapping, then enforcement profile (VLAN, role, downloadable ACL, or tunnel attributes).

802.1X deployment: use EAP-TLS for managed devices; configure MAC authentication fallback with profiling for IoT; enable RADIUS accounting for CoA-based reauthorization.

AOS-CX port security commands: aaa authentication port-access dot1x authenticator, mac-auth, and port-access onboarding-method precedence dot1x mac-auth.

RADIUS CoA (RFC 5176) lets ClearPass change a session's role or VLAN without reauthentication; the NAD must permit inbound CoA on port 3799.

WPA3-Enterprise uses 192-bit Suite-B cryptography; WPA3-Personal replaces PSK with SAE, mitigating offline dictionary attacks.

Segmentation tiers: VLAN plus ACL (basic), role-based ACL (dynamic), and VXLAN plus stateful firewall or EVPN distributed policy (large-scale zero trust).

Aruba Central manages AOS-CX, AOS 8/10 APs, and gateways via cloud; ArubaOS 8 uses Mobility Master plus controllers, and AOS-CX supports on-prem NAE and NetEdit.

Central groups define configuration scope; templates (CLI or GUI) and variables push device config; a device inherits group settings unless overridden locally.

AOS-CX REST API: https://<switch>/rest/v10.xx/system with a login token from /rest/v10.xx/login; use JSON bodies for PUT/POST to configure or read state.

NETCONF/RESTCONF on AOS-CX uses YANG models; enable with https-server rest access-mode read-write and netconf in the management interface context.

Ansible and Python (pyaoscx, requests) automate AOS-CX; Aruba Central supports webhooks and streaming telemetry to external collectors.

NAE (Network Analytics Engine) scripts run on AOS-CX and trigger alerts or actions when a monitored condition (for example, CRC errors or CPU) crosses a threshold.

SNMPv3 with authPriv is the baseline for polling; syslog severity levels run 0 (emergency) to 7 (debug); NTP sync is required for accurate correlation.

Aruba UXI sensors and Central AIOps provide synthetic testing and baselining; use them to detect client experience degradation before user tickets.

VSX split-brain prevention uses the ISL plus a separate keepalive path; if both fail, the secondary suspends its VSX interfaces to avoid duplicate gateways.

VSF failover: the standby member takes over if the commander fails; a stack split causes both fragments to become active unless loop protect or MAD is configured.

AOS 8 controller redundancy: an AP can terminate on a standby controller; N+1 provides spare capacity, and dual-link L2/L3 redundancy supports hitless failover.

AOS-CX high availability for gateways: VRRP (RFC 5798) with preemption and a tracked uplink; EVPN anycast gateway offers active-active first hop without VRRP.

Wireless troubleshooting order: verify AP power and uplink, then DHCP and DNS reachability, then RADIUS reachability (port 1812/1813), then RF (channel, noise, retries).

Common AOS-CX diagnostics: show interface, show interface error, show lldp neighbor, show vsx status, show ip route, and show running-config.

RADIUS failures: check shared secret mismatch, certificate validity and time, NAS client definition, and CoA reachability; test with show aaa authentication or radtest.

MTU and fragmentation break GRE tunnels and IPsec; set tunnel MTU below the path MTU and enable TCP MSS clamping on the gateway.

Migrations: run parallel legacy and new networks, migrate APs in waves by building, and use ClearPass for consistent policy during the transition.

AOS 8 to AOS 10 migration: AOS 10 is gateway and Central managed; APs move to a Central group, and gateways replace controller-based tunnel termination.

ClearPass integrations: Microsoft Intune and Entra ID (device compliance and identity), MDM onboarding, and endpoint profiling via DHCP, MAC OUI, and LLDP.

Aruba Central integrations: SIEM via syslog or streaming, ITSM via webhooks, and identity via SAML SSO for administrator access.

Firmware lifecycle: use AOS-CX long-support releases for production, validate in a lab, and stage upgrades with VSX/VSF rolling upgrade where supported.

Licensing model: Central subscription tiers (Foundation, Advanced) and AOS-CX switch licensing (for example, Foundation and Advanced) gate features such as NAE and API access.

Operational runbooks: back up configurations before change, use NetEdit or Central templates for bulk changes, and maintain a rollback plan with checkpoint and rollback commands.

DNS, NTP, and certificates are foundational: expired AP or controller certificates break onboarding and 802.1X; monitor expiry and rotate before the deadline.