Aruba Campus Access Professional flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

VSX

Aruba AOS-CX high-availability feature where two independent switches share a virtual MAC/IP and synchronize state over an inter-switch link, providing active-active forwarding without a single stacked control plane.

VSX inter-switch link

Dedicated link carrying VSX synchronization and multicast traffic between peers; must be up for the pair to operate normally, and its failure triggers split-brain handling.

VSX keepalive

Out-of-band heartbeat link between VSX peers used to detect peer liveness; if the ISL fails but keepalive succeeds, the secondary disables its VSX interfaces.

MCLAG

Multi-chassis LAG where a downstream device forms a single LAG to two VSX peers, providing link redundancy and active-active bandwidth without spanning-tree blocking.

Collapsed core design

Campus topology where core and distribution functions share the same switch pair, connecting access switches directly; reduces hop count and cost for smaller campuses.

PoE 802.3bt Type 4

Power over Ethernet standard delivering up to 90 W at the PSE and about 71 W at the powered device, used for high-power APs and cameras over standard cabling.

AOS-CX VLAN SVI

Layer 3 interface created with interface vlan <id> and an IP address; provides the default gateway for hosts in that VLAN on an AOS-CX switch.

VSX role primary

Command vsx role primary designates which peer owns certain control functions; both peers forward traffic, but role determines priority during split-brain recovery.

LACP active mode

Link aggregation mode where the local device actively sends LACPDUs to negotiate the LAG; configured with lacp mode active under an AOS-CX lag interface.

OSPF passive interface

Interface setting that advertises the connected network into OSPF but suppresses hello packets, preventing neighbor formation on access-facing or host-only links.

VLAN trunk native

AOS-CX command setting the untagged VLAN on a trunk port; frames without a tag are placed in this VLAN while tagged VLANs carry the rest.

VSF stacking

Aruba access-switch stacking technology where multiple physical switches form one logical device with a single control plane, managed via a single IP address.

ClearPass service

Policy Manager object defining which authentication methods and sources apply to a request; matched first in the request pipeline before role mapping and enforcement.

Enforcement policy

ClearPass object that returns RADIUS attributes such as VLAN, role name, or downloadable ACL to the network device after a successful authentication.

RADIUS CoA

Change of Authorization message sent to the network access device on UDP 3799 to alter an active session's role, VLAN, or disconnect the client without reauthentication.

802.1X authenticator

Switch port role that relays EAP frames between supplicant and authentication server; enabled on AOS-CX with aaa authentication port-access dot1x authenticator.

MAC authentication

Access control method where the client MAC address is sent to RADIUS as both username and password; useful for devices without 802.1X supplicants.

Dynamic Segmentation

Aruba feature tunneling role-based user traffic from switch or AP to a gateway, where firewall policy is enforced regardless of physical location.

DHCP snooping trust

Port setting marking the uplink toward the legitimate DHCP server; untrusted ports cannot offer DHCP leases, preventing rogue server attacks.

Dynamic ARP Inspection

Security feature validating ARP packets against DHCP snooping bindings; drops spoofed ARP replies that would enable man-in-the-middle attacks.

Aruba Instant mode

AP operating mode where one AP acts as virtual controller and manages peers without a hardware controller; suitable for small sites with limited scale.

ArubaOS 10 gateway cluster

Architecture where Aruba gateways form a cluster managed by Central, replacing the separate Mobility Master; provides centralized client termination and roaming state.

ARM

Adaptive Radio Management; Aruba feature that dynamically assigns channel and transmit power to APs based on RF neighbor and interference measurements.

ClientMatch

Aruba feature that steers clients to the best AP and band using per-client RF metrics, improving roaming and reducing sticky-client problems.

WPA3-SAE

WPA3-Personal authentication using Simultaneous Authentication of Equals, a password-based handshake resistant to offline dictionary attacks.

6 GHz PSC channels

Preferred Scanning Channels in the 6 GHz band, spaced every 80 MHz; clients scan only these to speed discovery and reduce probe overhead.

Inter-controller roaming

Roaming where a client moves between APs managed by different controllers; state is preserved using home agent tables or gateway clustering.

Aruba Central

Cloud management platform for Aruba switches, APs, and gateways; provides configuration groups, monitoring, AIOps, and firmware management.

show vsx status

AOS-CX command displaying ISL state, keepalive state, and peer role; used to diagnose split-brain and synchronization problems in a VSX pair.

show lldp neighbor-info

AOS-CX command listing LLDP neighbors per interface, including system name and port; verifies cabling and topology assumptions.

RPVST+

Rapid Per-VLAN Spanning Tree Plus; the AOS-CX default spanning-tree mode, running an independent rapid spanning-tree instance per VLAN.

ClearPass Access Tracker

Policy Manager view showing each authentication request's full processing chain, including service match, role mapping, and enforcement results for troubleshooting.