Aruba Mobility Expert (Written) cheat sheet

Aruba mobility architecture separates the control plane (controller or Mobility Master/Conductor) from the data plane (gateways, APs, and switch fabric), enabling centralized policy with distributed forwarding.

Campus design tiers: core, aggregation/distribution, and access. Aruba recommends collapsed-core for small sites and a dedicated Mobility Conductor tier for large multi-controller deployments.

AOS 8 uses a two-tier hierarchy: Mobility Conductor (control/management) and Mobility Controllers or gateways (data). AOS 10 collapses control into Aruba Central and uses gateways for tunneling and policy.

Cluster sizing rule: an L2/L3 cluster supports up to 12 controllers/gateways; standby roles are assigned per controller for N+1 redundancy.

AP capacity per controller is bounded by platform model; always verify max APs, clients, and tunnels for the specific controller or gateway before finalizing design.

RF design: target -65 dBm or better RSSI at cell edge, 15-20% channel overlap, and SNR of 25 dB or higher for voice; 20 MHz channels in 5 GHz for high-density.

For high-density venues, plan for roughly 30-50 clients per radio and use 5 GHz/6 GHz as primary bands with band steering and load balancing enabled.

Redundancy domains: AP survivability (failover to backup controller), controller clustering, and gateway redundancy (VRRP) each protect a different failure layer.

Controller cluster types: L2 cluster (members in same VLAN/subnet) and L3 cluster (members routed, requires IPsec over GRE between cluster members).

VRRP provides gateway redundancy: the controller with highest priority (default 100, higher wins) becomes master; preemption is disabled by default.

AP fast failover: APs maintain a backup LMS (BLMS) address; on primary loss the AP reboots or, with stateful failover, re-homes without dropping clients.

Stateful cluster failover requires the cluster to be formed and the AP to be in the cluster; unclustered controllers use stateless AP failover only.

Mobility Conductor redundancy: a standby conductor can be configured; whitelist synchronization and database backup are required to restore configuration.

Database backup should be scheduled and stored off-box; restore is performed via the conductor/controller CLI and requires a matching AOS version.

Cluster heartbeat uses the controller IP/management network; ensure low latency (sub-10 ms recommended) and no firewall blocking between members.

License types (AP, PEF, RF Protect, VC) are installed per controller or via Central; license mismatch across cluster members can block AP termination.

SSID profiles bind to virtual AP (VAP) profiles; a VAP references an SSID profile, AAA profile, and forwarding mode (tunnel, bridge, or split).

ARM (Adaptive Radio Management) scans channels and assigns power/channel; scanning can be disabled per radio, and ARM profiles control min/max power and channel sets.

ClientMatch steers clients to the best AP/band using 802.11k/v and band-steering logic; it supersedes legacy band steering when enabled.

Channel planning: use non-overlapping 5 GHz channels (UNII-1/2/3), avoid DFS channels where radar events are likely, and set 2.4 GHz to 1/6/11 only.

Transmit power rule: higher power widens cells and increases co-channel interference; lower power in dense areas improves spatial reuse.

AirMatch (AOS 8) performs scheduled, coordinated RF optimization versus ARM's per-AP reactive adjustments.

Minimum basic rate should be raised (e.g., disable 1/2/5/11 Mbps) to shrink 2.4 GHz cells and improve airtime efficiency.

WMM and DSCP mapping: voice uses AC_VO, video AC_VI; ensure QoS trust is set on the uplink switch port (trust DSCP) for end-to-end treatment.

802.1X uses EAP methods (PEAP-MSCHAPv2, EAP-TLS); EAP-TLS requires client certificates and is the strongest method.

Roles are assigned via server-derived rules (RADIUS attributes) or user rules in the AAA profile; role determines firewall policies (ACLs) applied to the client.

Captive portal and MAC authentication can be combined (MAC auth first, then captive portal fallback) for guest/IoT onboarding.

WPA3-Enterprise uses 192-bit security (GCMP-256, SHA-384); WPA3-Personal uses SAE, which resists offline dictionary attacks versus WPA2-PSK.

RADIUS accounting and CoA (Change of Authorization) allow dynamic role/policy changes mid-session without reauthentication.

PEF (Policy Enforcement Firewall) applies stateful role-based ACLs; without PEF licensing, only basic L2/L3 forwarding policies apply.

RFProtect provides WIDS/WIPS: rogue AP classification (rogue, suspected-rogue, interfering), containment, and wireless intrusion detection signatures.

Certificate-based device trust: clearPass Onboard/OnGuard issues and validates device certificates; the controller must trust the issuing CA chain.

Controller/gateway uplinks can be trunk (802.1Q tagged) or access; management VLAN should be separate from user VLANs.

GRE tunnels carry client traffic from AP to controller in tunnel mode; bridge mode forwards locally at the AP, reducing controller data-plane load.

VRRP on the controller provides a virtual gateway IP for the user VLAN; the master controller answers ARP for the VIP.

OSPF/BGP can be enabled on gateways for dynamic routing into the campus core; static routes are typical for small deployments.

Spanning tree: ArubaOS switches default to MSTP; enable BPDU protection and root guard on access ports facing APs.

DHCP relay (ip helper-address) must point to the DHCP server from the user VLAN SVI; option 43 can direct APs to a controller.

QoS trust boundaries: set trust DSCP on switch ports facing APs/controllers; untrusted edge ports should remark or drop.

LACP/port-channel between controller and switch provides link redundancy; ensure both sides use the same hashing and LACP mode.

Show commands: show ap database (AP state/flags), show user (client table), show datapath session (flows), show ap arm rf-summary (RF health).

AP flags: 'U' = up, 'I' = inactive, 'N' = no heartbeat; a 'N' flag usually indicates a tunnel/heartbeat failure.

Client connectivity triage order: association (802.11) -> authentication (802.1X/PSK) -> DHCP -> ARP -> DNS -> application.

Packet capture: use 'packet-capture' or mirror on the controller; for AP-side capture use 'ap packet-capture' to see over-the-air frames.

Logs: 'show log all', 'show log system', and 'show ap debug system-status' for AP-side issues; tech-support generates a full bundle for TAC.

RF issues: high retry rates, low SNR (<20 dB), and co-channel interference show in 'show ap arm rf-summary' and client statistics.

DHCP failures commonly trace to missing ip helper, VLAN mismatch on trunk, or VRRP master not forwarding.

Verify RADIUS reachability with 'aaa test-server' and check shared-secret mismatch in logs before escalating.

Aruba Central provides cloud monitoring, AIOps (AI Insights), and configuration management; AOS 8 on-prem uses AirWave for the same role.

Firmware upgrades: use the conductor to push images to controllers and APs; AP image upgrade can be staggered to limit downtime.

Backups: schedule automatic database backups; retain copies off-device and verify restore in a lab before relying on them.

Licensing: track AP/PEF/RFProtect/VC license consumption; expired licenses can disable features or block AP termination.

Health dashboards track client count, throughput, retries, and AP uptime; set alerts on AP down, high channel utilization, and RADIUS failures.

Tech-support and 'show tech-support' bundles are the standard artifacts for TAC cases; capture before rebooting a faulty device.

Change management: stage configs in a lab, use configuration diff/audit, and keep a rollback plan (previous image and backup).

NTP and syslog must be configured consistently; time skew breaks certificate validation and confuses log correlation.

Aruba Central (AOS 10) moves control to the cloud; gateways provide tunneling, policy, and overlay (IPsec/GRE) to Central.

Aruba ESP includes Central, ClearPass, and gateways; AIOps uses telemetry for anomaly detection and root-cause suggestions.

Location services: Aruba Meridian/ALE use AP telemetry for wayfinding and asset tracking; requires adequate AP density and RTLS-ready APs.

ClearPass Policy Manager provides NAC, role derivation, device profiling, Onboard (BYOD), and OnGuard (posture); integrates via RADIUS/CoA.

SD-WAN and microbranch use gateways for branch overlay; VPNC (VPN concentrator) terminates remote AP (RAP) IPsec tunnels.

AirGroup enables mDNS/Bonjour service discovery across VLANs with role-based service ACLs.

IoT onboarding uses device profiling plus dedicated IoT roles and VLANs; separate IoT SSIDs limit lateral movement.

Aruba Fabric Composer and CX switches provide EVPN-VXLAN fabrics for large campus/data-center integration with the mobility overlay.