Aruba Campus Access Associate cheat sheet

OSI layers used in campus design: L1 cabling/PHY, L2 switching and VLANs, L3 routing and subnets, L4+ for policy and services.

Collision domain ends at a switch port; broadcast domain ends at a VLAN boundary or L3 interface.

MAC address is 48 bits written as 12 hex digits; first 3 bytes are the OUI identifying the vendor.

IPv4 private ranges: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16; APIPA 169.254.0.0/16 indicates failed DHCP.

Subnet hosts formula: usable hosts = 2^h - 2, where h is the number of host bits.

Three-tier campus model: core (fast transport), distribution (policy and aggregation), access (endpoint attachment).

ARP resolves IPv4 to MAC within a broadcast domain; a router/gateway is needed to cross subnets.

PoE standards: 802.3af ~15.4 W at PSE, 802.3at (PoE+) ~30 W, 802.3bt up to 60 W or 90 W.

Access port carries one untagged VLAN to an endpoint; trunk port carries multiple VLANs, usually 802.1Q tagged.

802.1Q inserts a 4-byte tag; the VLAN ID field is 12 bits, giving a valid range of 1-4094 (0 and 4095 reserved).

Default VLAN is 1 on Aruba switches; best practice is to move user traffic off VLAN 1 rather than delete it.

Native VLAN on an 802.1Q trunk is sent untagged; mismatched native VLANs cause VLAN hopping and traffic leakage.

Spanning tree default on Aruba is MSTP; RSTP/MSTP converge in seconds versus 30-50 s for legacy STP.

Port states in RSTP: discarding, learning, forwarding; root bridge election uses lowest bridge ID (priority then MAC).

LACP (802.3ad) bundles links into a LAG; member links must match speed, duplex, and VLAN configuration.

DHCP snooping trusts only designated uplink ports; untrusted ports drop DHCP server offers to block rogue servers.

2.4 GHz channels are 1-13 (region dependent) with 5 MHz spacing; only 1, 6, and 11 are non-overlapping in North America.

5 GHz offers more non-overlapping channels (e.g., UNII-1 36-48, UNII-3 149-165) and less interference than 2.4 GHz.

Higher frequency means shorter wavelength, smaller coverage, and higher free-space path loss; 5 GHz has less range than 2.4 GHz.

Wi-Fi 6 (802.11ax) uses OFDMA and BSS coloring; Wi-Fi 6E adds the 6 GHz band.

Signal strength rules of thumb: -65 dBm or better for voice, around -67 to -70 dBm for data, -75 dBm is marginal.

SNR of 25 dB or higher supports high MCS rates; below about 10 dB throughput collapses and retries rise.

A channel width of 40/80 MHz raises throughput but reduces the number of non-overlapping channels available.

AP power should be set so clients associate at similar signal levels; excessive power creates sticky clients and co-channel interference.

802.1X has three roles: supplicant (client), authenticator (switch/AP), and authentication server (RADIUS).

EAP methods: EAP-TLS uses certificates on both sides; PEAP and EAP-TTLS use a server certificate plus inner credentials.

RADIUS uses UDP: 1812 for authentication and 1813 for accounting (legacy 1645/1646).

MAB (MAC authentication bypass) authenticates devices by MAC address when no 802.1X supplicant exists; weaker than 802.1X.

Dynamic VLAN or role assignment from RADIUS places a client into a VLAN or role after successful authentication.

Port security limits learned MAC addresses per port and can shut down or restrict on violation.

DHCP snooping, dynamic ARP inspection, and IP Source Guard together mitigate spoofing and rogue DHCP attacks.

WPA3 uses SAE for personal mode and 192-bit enterprise mode; WPA2 uses PSK or 802.1X with AES-CCMP.

Aruba Central is a cloud management platform for Aruba access points, switches, and gateways from one dashboard.

A group in Central defines configuration and firmware for member devices; a site defines location and maps.

Device onboarding to Central can use cloud activation (activate.arubanetworks.com) or manual add by serial/MAC.

Templates in Central push CLI or configuration to switches; groups apply UI-based configuration to APs and gateways.

Roles and scopes in Central separate MSP or multi-tenant administration from single-account administration.

Firmware compliance is tracked per group; devices can be upgraded in bulk or scheduled during a maintenance window.

AOS-CX switches can be managed in Central as well as through their own REST API and CLI.

Central integrates with ClearPass for policy and with UXI or third-party tools for experience monitoring.

Show commands on Aruba switches: show interfaces, show vlan, show spanning-tree, show lldp neighbor, show arp.

Interface counters: CRC and alignment errors point to cabling or duplex problems; runts and giants point to MTU or frame issues.

Duplex mismatch symptoms: late collisions, FCS errors, and poor throughput on one link.

Layer 1 first: verify link LED, cable category, and speed/duplex before investigating L2 or L3.

Ping tests reachability and RTT; traceroute reveals the path and where hops stop responding.

For wireless issues, check client SNR, retry rate, channel utilization, and AP uplink health in that order.

Syslog severity 0-7: 0 emergency, 3 error, 4 warning, 6 informational, 7 debug; lower number is more severe.

SNMP traps or informs push alerts; polling gathers counters and interface state for trend graphs.