Aruba Campus Access Architect (HPE7-A11) key terms

A design approach that defines how wired and wireless access layers connect users and devices to the campus network, covering topology, redundancy, security zones, and management boundaries.

A three-tier hierarchical design in which access switches connect endpoints, distribution switches aggregate and enforce policy, and core switches provide high-speed transit between network blocks.

A two-tier topology where distribution and core functions are combined on the same switches, reducing cost and hops in smaller campuses while retaining redundancy and policy control.

A design pattern where the physical or routed underlay carries traffic between devices, and a logical overlay such as a tunnel fabric provides consistent policy and mobility across that underlay.

Combining multiple physical switches into a single logical device with one management address, shared configuration, and redundant links, simplifying operations and improving access-layer resilience.

A virtual switching extension that pairs two switches into a redundant logical pair, synchronizing control-plane state while keeping both data planes active for faster failover and multichassis link aggregation.

A link aggregation group whose member links terminate on two separate switches, so a downstream device keeps connectivity if one uplink switch fails.

Bonding multiple physical links into one logical channel to increase bandwidth and provide redundancy, with traffic distributed across members by a hash of frame or flow fields.

A standards-based protocol that negotiates and monitors link aggregation groups between peers, detecting misconfigurations and removing failed member links from the bundle.

The total power a switch can supply to powered devices across its ports, which must be planned against per-port class requirements and cable losses to avoid overcommitment.

An extension of link-layer discovery for media endpoints that exchanges capabilities such as power requirements, network policy, and voice VLAN assignment between switches and attached devices.

The process of discovering, registering, and configuring access points with correct firmware, controller or gateway association, and radio settings so they can serve clients.

A tunneling protocol used between access points and a wireless controller or gateway to carry control messages and optionally client data traffic across the network.

Two forwarding models for wireless traffic: tunnel mode sends client data to a central gateway for policy enforcement, while bridge mode forwards traffic locally at the access point.

Designing channel assignments, transmit power, and access point placement to deliver adequate coverage and capacity while minimizing co-channel interference in the wireless cell layout.

Setting radio channels and transmit levels per access point so neighboring cells avoid overlapping frequencies and coverage remains balanced across the coverage area.

A technique that encourages dual-band capable clients to associate on the less congested 5 GHz or 6 GHz band instead of the 2.4 GHz band.

A wireless feature that continuously evaluates client-to-radio associations and steers clients toward better access points or bands to improve roaming and throughput.

The process by which a wireless client moves its association from one access point to another while maintaining its session and IP addressing across the campus.

A group of controllers or gateways that share client state so wireless clients can roam between access points managed by different members without losing connectivity.

Assigning network permissions according to a user or device role determined at authentication, rather than by static port or VLAN membership, so policy follows the identity.

Placing users and devices into distinct virtual networks or policy groups based on identity and context, isolating traffic without requiring separate physical infrastructure per group.

A port-based authentication standard in which a supplicant proves its identity to an authenticator, which then permits or restricts network access via a RADIUS decision.

A protocol used by network access devices to send authentication, authorization, and accounting requests to a central server that returns accept or reject decisions and attributes.

An authentication framework carried inside 802.1X exchanges that supports methods such as certificate-based or credential-based authentication between supplicant and server.

Granting network access based on a device's hardware address, often used for headless devices that cannot run supplicant software, typically combined with other checks.

A web-based login page that intercepts client traffic until the user authenticates or accepts terms, commonly used for guest access with limited network permissions.

A segregated network segment for visitors that provides internet access while blocking reachability to internal resources, often with bandwidth and session limits.

A logical Layer 2 broadcast domain created on switches so devices on different segments are isolated from each other without separate physical cabling.

A switch interface that carries traffic for multiple VLANs using tags, typically connecting switches or connecting a switch to a virtualized host or access point.

A switch interface assigned to a single VLAN that forwards untagged frames to an attached endpoint such as a workstation, printer, or camera.

Assigning clients to VLANs from a defined pool so that users with the same role are spread across subnets, reducing broadcast domain size and IP exhaustion.

A switch feature that inspects DHCP messages, trusts only authorized server ports, and builds a binding table used to block rogue servers and spoofed address assignments.

A security feature that validates ARP packets against a trusted binding table, dropping forged replies that attempt to redirect traffic through an attacker.

Using scripts, templates, or orchestration platforms to configure and manage devices consistently at scale, reducing manual error and speeding deployment and change.

A programmatic interface that exposes device or management-platform functions over HTTP methods, letting automation tools read state and apply configuration changes.

A reusable parameterized definition of device settings that automation applies across many devices, ensuring consistent configuration and enabling repeatable rollback.

A management protocol for polling device metrics and receiving unsolicited traps, widely used by monitoring systems to track health, interfaces, and fault conditions.

A logging standard that forwards event messages from network devices to a central collector for correlation, alerting, and audit of configuration and fault events.

Streaming detailed operational data from devices at frequent intervals to an analytics platform, giving finer visibility than periodic polling for performance and fault analysis.

A mechanism that gives hosts a shared virtual default gateway address so traffic continues to flow if the primary router or switch fails.

A Layer 2 protocol that blocks redundant paths to prevent broadcast loops, electing a root bridge and selecting a loop-free forwarding topology that reconverges on failure.

Design and protocol measures that stop Layer 2 frames from circulating indefinitely, including spanning tree, split-horizon rules, and careful control of redundant links.

The maximum frame size a path can carry and the process of splitting larger packets, which must be planned consistently to avoid drops in tunneled or overlay traffic.

The arrangement of logical tunnels connecting gateways and access devices, determining how traffic and policy flow across the fabric independent of physical cabling.

A fabric technology that uses BGP Ethernet VPN control plane signaling with VXLAN data encapsulation to stretch Layer 2 segments and distribute policy across a routed underlay.

Sequencing the replacement or upgrade of network components in phases with rollback points, validating dependencies so services stay available during the transition.

Architecting redundant components, paths, and power so no single failure disrupts service, including device pairing, diverse uplinks, and tested failover behavior.

A disciplined process for requesting, reviewing, approving, and documenting network changes, with backout plans, to reduce outages caused by unplanned modifications.