Aruba Campus Access Associate flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Broadcast domain boundary

A broadcast domain includes all devices that receive a given Layer 2 broadcast. It ends at a router interface or a Layer 3 boundary; each VLAN is its own broadcast domain.

Usable hosts formula

For a subnet with h host bits, usable host addresses equal 2^h minus 2, subtracting the network address and the broadcast address. A /24 therefore yields 254 usable hosts.

Three-tier campus model

Core provides high-speed transport, distribution aggregates access switches and enforces policy, and access connects endpoints. Smaller campuses may collapse core and distribution into two tiers.

ARP purpose

Address Resolution Protocol maps a known IPv4 address to a MAC address inside a broadcast domain. Traffic to a different subnet is sent to the gateway MAC instead.

PoE 802.3at

802.3at, also called PoE+, delivers roughly 30 W at the power sourcing equipment and about 25.5 W at the powered device. It is used for access points and cameras.

APIPA address meaning

A 169.254.x.x address is self-assigned by a host that received no DHCP reply. Its presence usually indicates a DHCP reachability, VLAN, or server problem.

Access versus trunk port

An access port carries a single untagged VLAN to one endpoint. A trunk port carries multiple VLANs, normally tagged with 802.1Q, toward another switch or an AP.

802.1Q VLAN ID range

The 802.1Q tag uses a 12-bit VLAN identifier, so valid IDs are 1 through 4094. VLAN 0 and VLAN 4095 are reserved and cannot be used for user traffic.

Native VLAN mismatch risk

The native VLAN travels untagged on an 802.1Q trunk. If the two ends disagree, frames land in the wrong VLAN, causing connectivity loss and possible VLAN hopping.

LACP link aggregation

LACP (802.3ad) negotiates a bundle of physical links into one logical link. Member ports must share speed, duplex, and VLAN settings, and both ends must agree.

DHCP snooping behavior

DHCP snooping marks ports as trusted or untrusted. DHCP server replies arriving on untrusted ports are dropped, blocking rogue DHCP servers from handing out addresses.

RSTP port states

Rapid Spanning Tree uses discarding, learning, and forwarding states. It converges in seconds by using proposal/agreement handshakes rather than timers.

Root bridge election

Spanning tree elects the root bridge by lowest bridge ID, which combines priority and MAC address. Lower priority wins; the MAC breaks ties.

2.4 GHz non-overlapping channels

In North America the only non-overlapping 2.4 GHz channels are 1, 6, and 11, since each channel is 20 MHz wide with 5 MHz spacing. Other regions may allow 1, 5, 9, 13.

Wi-Fi 6 technology

802.11ax, branded Wi-Fi 6, adds OFDMA, MU-MIMO, and BSS coloring to improve efficiency in dense environments. Wi-Fi 6E extends it into the 6 GHz band.

SNR thresholds

Signal-to-noise ratio of about 25 dB or higher supports high data rates. Around 10 dB or lower, retries climb and throughput drops sharply regardless of signal strength.

Channel width tradeoff

Wider channels of 40 or 80 MHz increase peak throughput but consume more spectrum, reducing the number of non-overlapping channels and raising co-channel interference in dense deployments.

Sticky client problem

A client stays associated with a distant AP instead of roaming to a closer one. Excessive AP power and poor roaming thresholds make this more likely and hurt client experience.

5 GHz versus 2.4 GHz

5 GHz has more non-overlapping channels and less interference but shorter range and higher path loss. 2.4 GHz travels farther but is crowded and limited to three clean channels.

802.1X three roles

The supplicant is the client device, the authenticator is the switch or AP controlling access, and the authentication server is typically a RADIUS server validating credentials.

EAP-TLS versus PEAP

EAP-TLS requires certificates on both client and server. PEAP uses only a server certificate and then carries username and password inside the TLS tunnel.

RADIUS ports

RADIUS uses UDP port 1812 for authentication and authorization and UDP port 1813 for accounting. Older deployments may still use 1645 and 1646.

MAC authentication bypass

MAB authenticates a device by its MAC address against the RADIUS server when no 802.1X supplicant is present. MAC spoofing makes it weaker than certificate-based 802.1X.

Dynamic authorization result

After successful 802.1X or MAB, RADIUS can return attributes that place the client into a specific VLAN, role, or access policy rather than the default.

WPA3 personal mode

WPA3-Personal replaces the WPA2 pre-shared key handshake with SAE, which provides forward secrecy and resists offline dictionary attacks on captured handshakes.

Dynamic ARP inspection

DAI validates ARP packets against the DHCP snooping binding table, dropping forged ARP replies. It mitigates man-in-the-middle attacks within a VLAN.

Aruba Central group

A group is the configuration and firmware container in Central. Devices inherit settings from their group, and firmware compliance is tracked and enforced per group.

Aruba Central site

A site represents a physical location in Central, holding maps, floor plans, and device placement. Sites are separate from groups, which control configuration.

Cloud activation onboarding

Devices contact activate.arubanetworks.com to learn their Central assignment. Alternatively, an administrator adds the device by serial number or MAC in the Central inventory.

Central templates

Templates push CLI or structured configuration to switches in a group, while UI groups apply settings to APs and gateways. Templates allow variable substitution per device.

Duplex mismatch symptoms

A duplex mismatch produces late collisions, FCS errors, and very poor throughput on one link. Both ends must agree on speed and duplex, ideally via autonegotiation.

Syslog severity levels

Syslog severities run 0 to 7: 0 emergency, 3 error, 4 warning, 6 informational, 7 debug. A lower number is more severe, and logging level sets the threshold.