Aruba Mobility Expert (Written) flashcards

36 cards. Read the term and the definition here. The deck at the top of this page is optional.

Mobility Conductor role

In AOS 8, the conductor centralizes configuration and management for multiple controllers but does not forward client traffic; controllers and gateways handle the data plane.

Controller cluster size limit

An Aruba controller or gateway cluster supports up to 12 members; standby roles are distributed among members to provide N+1 redundancy.

Cell edge RSSI target

For general enterprise WLAN design, target about -65 dBm or better at the cell edge, with SNR of at least 25 dB for voice-grade coverage.

High-density client planning

Plan roughly 30 to 50 clients per radio in high-density venues, using 5 GHz and 6 GHz as primary bands with band steering and load balancing enabled.

AP survivability

APs store a backup controller address; if the primary controller is lost, the AP re-homes to the backup to keep serving clients.

L2 versus L3 cluster

An L2 cluster places members in the same subnet; an L3 cluster spans routed subnets and requires IPsec over GRE between cluster members.

VRRP master election

The controller with the highest VRRP priority (default 100) becomes master; preemption is disabled by default and must be enabled explicitly.

Stateful cluster failover

When APs are members of a controller cluster, client sessions and state are synchronized so failover preserves existing sessions without forcing reauthentication.

Database backup restore

Controller and conductor configurations are backed up to a file; restore requires a matching AOS version and is performed from the CLI.

License mismatch risk

If cluster members lack matching AP, PEF, RFProtect, or VC licenses, APs may fail to terminate or features may be disabled after failover.

ARM function

Adaptive Radio Management scans the RF environment and assigns channels and transmit power per radio, reacting to interference and changing conditions.

ClientMatch steering

ClientMatch uses 802.11k/v and band-steering logic to move clients to the best AP and band, superseding legacy band steering when enabled.

Virtual AP profile

A virtual AP binds an SSID profile, AAA profile, and forwarding mode, and is applied to an AP group to create a broadcast SSID.

Minimum basic rate

Raising the minimum basic rate by disabling low rates such as 1, 2, 5, and 11 Mbps shrinks 2.4 GHz cells and improves airtime efficiency.

AirMatch versus ARM

AirMatch performs scheduled, coordinated RF optimization across the network, while ARM makes per-AP reactive adjustments based on local scanning.

WMM voice access category

WMM maps voice traffic to AC_VO; ensure DSCP is trusted on the uplink switch port for end-to-end QoS treatment.

EAP-TLS authentication

EAP-TLS uses client and server certificates for mutual authentication and is the strongest 802.1X EAP method, avoiding password-based weaknesses.

Role derivation

The AAA profile assigns a client role using server-derived RADIUS attributes or user rules; the role determines the firewall policy applied.

WPA3-Personal SAE

WPA3-Personal uses Simultaneous Authentication of Equals, which resists offline dictionary attacks that affect WPA2 pre-shared key handshakes.

PEF licensing effect

Policy Enforcement Firewall licensing enables stateful role-based ACLs on controllers; without it, only basic forwarding policies are enforced.

RFProtect WIDS

RFProtect provides wireless intrusion detection and prevention, including rogue AP classification, containment, and detection signatures.

RADIUS CoA

Change of Authorization lets the RADIUS server push a new role or policy to an active client session without requiring reauthentication.

Tunnel versus bridge mode

Tunnel mode sends client traffic over GRE to the controller; bridge mode forwards locally at the AP, reducing controller data-plane load.

DHCP relay requirement

The user VLAN SVI must have an ip helper-address pointing to the DHCP server, or clients will fail to obtain leases after association.

VRRP virtual gateway

VRRP presents a shared virtual IP that the master controller answers for; clients use it as their default gateway for the user VLAN.

QoS trust boundary

Trust DSCP on switch ports facing APs and controllers; untrusted edge ports should remark or drop to prevent QoS abuse.

AP database flags

In show ap database, a U flag means the AP is up; I means inactive and N means no heartbeat, typically indicating a tunnel failure.

Client triage order

Troubleshoot in order: 802.11 association, authentication, DHCP, ARP, DNS, then application, to isolate the failing layer quickly.

AP-side packet capture

The ap packet-capture command captures over-the-air frames at the AP, useful when controller-side captures miss wireless-only problems.

Firmware upgrade path

Push AP and controller images from the conductor; stagger AP upgrades to limit downtime and verify image compatibility with the controller version.

AIOps in Aruba Central

Central AIOps uses telemetry to detect anomalies and suggest root causes, complementing dashboards for client, AP, and RF health monitoring.

NTP and syslog consistency

Consistent NTP and syslog configuration is required because time skew breaks certificate validation and prevents reliable log correlation during incidents.

ClearPass Onboard

ClearPass Onboard provisions device certificates for BYOD endpoints, enabling certificate-based EAP-TLS authentication without manual IT involvement.

AirGroup function

AirGroup enables mDNS and Bonjour service discovery across VLANs, controlled by role-based service ACLs to limit which clients see which services.

VPN concentrator

A VPNC terminates IPsec tunnels from Remote APs, allowing branch APs to reach the controller over untrusted networks.

AOS 10 control plane

In AOS 10, Aruba Central provides the management and control plane while gateways handle tunneling, policy, and data forwarding.