Aruba Campus Access Professional key terms

A control-plane appliance that manages configuration and image distribution for a cluster of Mobility Controllers. It does not pass user traffic itself; it pushes settings and software to member controllers and coordinates the cluster.

A device that terminates access point tunnels, enforces wireless policy, and anchors client traffic. It handles authentication, encryption, and forwarding for wireless clients in a controller-managed deployment.

A set of Mobility Controllers managed as one logical group by a conductor. Controllers in a cluster share configuration and support client failover between members.

A generic encapsulation used between an access point and a Mobility Controller to carry client traffic and control messages. It transports wireless frames across the wired network without modifying the underlying routing.

A radio device that provides wireless connectivity to clients and bridges them onto the wired LAN. It may operate in controller-managed, instant, or gateway modes depending on the deployment.

An access point that can run without a dedicated controller, electing one member as a virtual controller to coordinate the group. It is suited to smaller sites or branch deployments.

The role one Instant AP assumes to manage configuration and coordinate the other access points in its group. It provides controller-like functions without dedicated hardware.

A management platform that monitors wired and wireless infrastructure, collects device health and RF data, and supports configuration and firmware management across many devices.

A measure of wireless radio conditions such as channel utilization, noise floor, retries, and client signal quality. Poor RF health drives coverage gaps and throughput problems even when the wired network is fine.

The percentage of time a radio channel is busy transmitting or receiving. High utilization indicates contention or heavy traffic and often calls for channel or band changes.

The background radio energy on a channel measured in dBm, excluding intended signals. A raised noise floor reduces signal-to-noise ratio and can shrink usable cell size.

The difference in decibels between a client's received signal and the noise floor. Higher values mean cleaner links and support higher data rates and more stable roaming.

The process of a wireless client moving its association from one access point to another while keeping its session. Fast, seamless roaming depends on consistent security keys and timely handoffs.

A standard that lets access points share neighbor reports so clients can scan more efficiently and choose better roam targets. It reduces the time spent probing during roaming.

A fast roaming standard that pre-establishes security keys across access points so clients can transition without full reauthentication. It reduces handoff latency for latency-sensitive applications.

A Wi-Fi security certification that adds stronger authentication and encryption, including protected management frames and simultaneous authentication of equals for personal networks. It replaces WPA2 as the recommended baseline.

A feature that encrypts and integrity-protects certain management frames such as deauthentication and disassociation. It prevents spoofed management frames from disrupting client connections.

An unauthorized access point connected to the network or broadcasting in the area. Detection and classification help prevent unapproved bridging and client hijacking.

A port-based network access control standard that authenticates supplicants through an authenticator and an authentication server before granting network access. It is the foundation of enterprise wired and wireless NAC.

An extensible authentication framework used within 802.1X exchanges to carry methods such as TLS or PEAP between client and server. The chosen method determines credential type and mutual authentication behavior.

A protocol that carries authentication, authorization, and accounting requests between a network access device and a central server. It returns attributes that determine role and policy assignment.

An access model that assigns permissions according to a user or device role rather than a specific port or address. Roles are typically derived from authentication results and enforced by policy.

A technique that places users and devices into distinct virtual networks or roles based on identity, independent of physical port. It lets one infrastructure enforce different policies for different groups.

A method that authenticates a device by its hardware address, often used for devices that cannot run supplicant software. It is weaker than certificate-based methods and should be combined with other controls.

A web-based login page that intercepts client traffic until the user authenticates or accepts terms. It is common for guest access and can integrate with external identity providers.

A logical Layer 2 broadcast domain created by partitioning switches. VLANs separate traffic and are commonly mapped to roles or departments for policy enforcement.

The standard for VLAN tagging on Ethernet frames. A tag inserted in the frame header identifies which VLAN a frame belongs to as it crosses trunk links.

A switch port configured to carry traffic for multiple VLANs, typically using 802.1Q tags. It connects switches or links to devices that need several VLANs.

Combining multiple physical links into one logical link to increase bandwidth and provide redundancy. Member links must be configured consistently at both ends.

A protocol that negotiates and maintains link aggregation groups between two devices. It detects misconfigured or failed member links and helps keep aggregation consistent.

A Layer 2 protocol that prevents forwarding loops by electing a root bridge and blocking redundant paths. Variants differ in convergence speed and per-VLAN behavior.

A link-state interior gateway routing protocol that builds a topology database and computes shortest paths. It supports areas to scale and converges quickly after topology changes.

A first-hop redundancy protocol in which routers share a virtual IP address and one acts as master. If the master fails, another takes over to keep the gateway available.

The set of known destinations and next hops a device uses to forward packets. It is populated by connected, static, and dynamic routing sources.

Technology that delivers electrical power over Ethernet cabling to devices such as access points and cameras. Power budgets and standards must match the powered device's requirements.

A neighbor discovery protocol that advertises device identity, capabilities, and port information to directly connected peers. It aids topology mapping and can negotiate power and VLAN settings.

A protocol for monitoring and managing network devices through structured object identifiers. Managers poll agents or receive traps to track health and events.

A standard for sending event and log messages from devices to a central collector. Centralized logging supports auditing, alerting, and troubleshooting across many devices.

A protocol that synchronizes device clocks to a reference time source. Accurate time is essential for consistent log correlation and certificate validation.

A hierarchical campus architecture that separates core, aggregation, and access layers. It scales by keeping high-speed transit in the core and policy and access at the edge.