Aruba Campus Access Professional cheat sheet

Aruba campus access is built on AOS-CX switching, Aruba Central (cloud) or on-prem management, and Gateway/AP wireless under a unified policy model.

The Aruba Validated Design model uses collapsed core with VSX pairs at core and access, or two-tier core/distribution with MC-LAG/VSX for redundancy.

VSX (Virtual Switching Extension) is the AOS-CX core redundancy method: two independent switches share a virtual IP/MAC and sync state over the ISL, unlike a single stacked control plane.

VSX requires a dedicated inter-switch link (ISL) for data and a separate keepalive link; ISL carries multicast/sync traffic and can be L2 or L3.

Layer 2 access designs use VLANs with 802.1Q trunks to distribution; Layer 3 access designs push the default gateway to the access switch with OSPF or BGP to core.

Campus wireless uses Aruba gateway clusters (or ArubaOS 10 gateways) for centralized client termination, with APs tunneled via GRE or local-bridged per SSID.

PoE budget planning: 802.3af is 15.4 W at PSE, 802.3at (PoE+) is 30 W, 802.3bt Type 3 is 60 W and Type 4 is 90 W; total switch PoE budget caps simultaneous port delivery.

Uplink oversubscription guidance: 1:1 for core-to-distribution, 2:1 to 4:1 for distribution-to-access, and 20:1 or worse only for edge-only traffic.

AOS-CX VLAN creation: vlan 10 then interface vlan 10 with ip address 10.0.0.1/24; for L2-only VLANs skip the SVI on access.

VSX config: vsx context with system-mac, inter-switch-link <port>, role primary|secondary, keepalive peer <ip> source <ip>, and vsx-sync for config consistency.

LAGs: interface lag 1 with no shutdown and lacp mode active; add members with lag 1 under the physical interface; MCLAG requires VSX and matching LAG IDs.

OSPF on AOS-CX: router ospf 1, area 0.0.0.0, network statements or per-interface ip ospf 1 area 0; passive interfaces suppress hellos on access-facing SVIs.

VLAN trunking on AOS-CX: interface 1/1/1 then no routing, vlan trunk allowed 10,20, vlan trunk native 1; default is access mode with vlan access 1.

BGP on AOS-CX: router bgp <asn>, neighbor <ip> remote-as <asn>, address-family ipv4 unicast, activate; use network or redistribution to advertise.

Static routing: ip route 0.0.0.0/0 <next-hop>; verify with show ip route and show ip route static.

AOS-CX VSF stacking is for access switches: vsf member <id> with vsf member <id> link 1 <port>; a VSF fabric presents as one logical switch.

ClearPass Policy Manager evaluates requests through services, enforcement policies, and roles; role mapping uses attributes from the authentication source (AD, RADIUS, certificate).

802.1X on AOS-CX: aaa authentication port-access dot1x authenticator under the interface, with RADIUS server group configured under radius-server.

MAC authentication (MACA) is configured with aaa authentication port-access mac-auth; combine with 802.1X for phased or fallback authentication.

Role-based access control (RBAC) on AOS-CX: aaa authorization radius plus port-access role <name> and vlan/policy assignments applied via ClearPass role name.

Dynamic Segmentation tunnels user traffic to an Aruba gateway based on role; uses GRE or IPSec from switch/AP to gateway, enforcing policy at the gateway.

RADIUS CoA (Change of Authorization, port 3799) lets ClearPass change a client's role or VLAN mid-session without reauthentication.

DHCP snooping on AOS-CX: enable globally with dhcpv4-snooping, then dhcpv4-snooping trust on uplinks; untrusted ports drop server-sourced offers.

Dynamic ARP Inspection (DAI) requires DHCP snooping bindings; enable with arp inspection on the VLAN and trust the uplink interfaces.

Aruba AP operating modes: instant (no controller, one AP is the virtual controller), controller/gateway-managed, or cloud-managed via Aruba Central.

ArubaOS 8 gateways run the Mobility Master (or standalone) architecture; ArubaOS 10 moves to a gateway cluster with Central management and no separate Mobility Master.

Channel planning: 2.4 GHz uses 1/6/11 non-overlapping; 5 GHz uses UNII bands with 20/40/80 MHz widths; 6 GHz (Wi-Fi 6E) adds 160 MHz and PSC channels.

AOS 8/10 channel and power are managed by ARM (Adaptive Radio Management); disable on individual radios only for static planning.

Roaming: intra-controller roaming is local; inter-controller roaming uses HAP (home agent) tables or gateway clustering in AOS 10 to preserve client state.

ClientMatch steers clients to better APs/bands; band steering pushes dual-band clients to 5 GHz; both are enabled by default on Aruba APs.

WPA3-Enterprise uses 802.1X with 192-bit mode (GCMP-256); WPA3-Personal uses SAE; WPA2/WPA3 mixed mode supports transition.

AP uplink redundancy: Aruba APs support a primary and backup controller/gateway list; the AP falls back to backup if the primary is unreachable.

Aruba Central provides cloud monitoring, AIOps, and config groups; on-prem equivalents are AirWave (wireless) and NetEdit/CLI for switching.

AOS-CX show commands: show interface, show interface brief, show vlan, show ip route, show vsx status, show lacp interfaces, show running-config.

show vsx status reports ISL state, keepalive state, and role; a split-brain appears as both peers primary with ISL down.

show lldp neighbors and show lldp neighbor-info verify topology; LLDP must be enabled per interface on AOS-CX (lldp transmit/receive).

Spanning tree: show spanning-tree and show spanning-tree summary; AOS-CX defaults to RPVST+; MSTP uses spanning-tree mode mstp.

Wireless troubleshooting: show ap database (AOS 8) or Central AP list, show ap active, show user, and show datapath session for client flows.

Packet capture: AOS-CX monitor capture with interface and destination; Aruba APs support remote packet capture via Central/AirWave.

Syslog and SNMP: logging <ip> and snmp-server host <ip> on AOS-CX; severity levels 0 (emergency) to 7 (debug).

ClearPass troubleshooting: Access Tracker shows the full request/response chain; use it to verify service match, role mapping, and enforcement.