HPE Aruba Switching Expert (Written, HPE7-A06) cheat sheet

OSPF: neighbor states progress Down → Init → 2-Way → ExStart → Exchange → Loading → Full; stuck in ExStart/Exchange usually indicates MTU mismatch.

OSPF cost = reference bandwidth (default 100 Mbps) ÷ interface bandwidth; a 1 Gbps link costs 1, 10 Gbps also costs 1 unless auto-cost reference-bandwidth is raised.

In OSPF, a router with priority 0 is never elected DR/BDR; DR election is won by highest priority, then highest router ID, and is non-preemptive.

VRRP: master is elected by highest priority (default 100, range 1–254); 255 is reserved for the address owner; preemption is enabled by default.

STP port roles: Root port = lowest cumulative path cost to root; Designated port = lowest cost on a segment; Alternate/Blocking = redundant path kept standby.

RSTP/MSTP convergence uses proposal/agreement handshake on point-to-point links; edge (PortFast) ports skip learning and go straight to forwarding.

AOS-CX VSX requires an ISL (multi-chassis LAG) plus a separate keepalive link; split-brain is prevented by keepalive failure triggering a secondary role.

802.1Q trunk: native VLAN frames are sent untagged; a native VLAN mismatch between peers raises CDP/LLDP errors and can merge broadcast domains.

802.1X roles: supplicant (client), authenticator (switch), authentication server (RADIUS); EAPoL runs only between supplicant and authenticator.

MAB (MAC Authentication Bypass) authenticates the client MAC as both username and password to RADIUS; it is weakest and should be a fallback, not primary.

Dynamic Authorization (CoA) lets RADIUS push a change of authorization to the switch (RFC 5176) to re-apply role or re-authenticate a live session.

RADIUS uses UDP 1812 (auth) and 1813 (accounting); the shared secret authenticates the client but the user password is encrypted only in the Access-Accept/Access-Request attribute.

Port-security violation modes: protect (drop, no log), restrict (drop + log/SNMP), shutdown (err-disable the port).

DHCP snooping: trusted ports may carry server replies; untrusted ports drop DHCP Offer/ACK; the binding table feeds Dynamic ARP Inspection and IP Source Guard.

Dynamic ARP Inspection validates ARP packets against the DHCP snooping binding table; ARP ACLs allow static hosts; DAI drops invalid gratuitous ARP by default.

RADIUS tunnel attributes for dynamic VLAN assignment: Tunnel-Type=VLAN (13), Tunnel-Medium-Type=802 (6), Tunnel-Private-Group-ID=.

PoE standards: 802.3af = up to 15.4 W at PSE / 12.95 W at PD; 802.3at (PoE+) = 30 W PSE / 25.5 W PD; 802.3bt Type 3 = 60 W, Type 4 = 90 W at PSE.

LLDP is the standard for PoE negotiation and neighbor discovery; CDP is Cisco-proprietary; MED (LLDP-MED) carries voice VLAN and power detail to IP phones.

LACP: active/passive - at least one side must be active; LACP uses system priority + port priority + MAC to form the aggregation key.

Static LAG vs LACP: static LAG has no control protocol and can blackhole on misconfiguration; LACP detects member failure and rebalances.

Link aggregation requires matching speed, duplex, MTU, and VLAN membership on all member links; a mismatch silently drops the member from the bundle.

Jumbo frames: MTU must be raised end-to-end (switch ports and routed interfaces); a single 1500-byte hop fragments or drops 9000-byte frames.

VLAN trunking: allowed VLAN lists must include the VLAN on both ends; pruning a VLAN on one side strands traffic on the other.

Spanning-tree on a LAG: the whole bundle is one logical port; individual member links do not run independent STP state machines.

QoS trust boundaries: trust DSCP at the core, trust CoS/802.1p at access for tagged traffic, and remark at the edge if untrusted.

DSCP EF (46) = voice; AF41 (34) = video; CS1 (8) = scavenger/background; default best-effort is 0.

LLQ (priority queue) for voice should be capped (e.g., 10–33% of link) to prevent starvation of other classes.

WRR/DRR distributes remaining bandwidth by weight; strict priority always drains first, so cap priority traffic.

Buffer/queue drops show as output drops on an interface; input drops indicate oversubscription or a too-small input queue.

AOS-CX supports egress queue shaping per-port and per-queue; shaping smooths bursts while policing drops excess.

Storm control thresholds are configured as percentage of link bandwidth or pps; broadcast, multicast, and unknown-unicast are counted separately.

Flow control (802.3x) pauses a link on congestion; it can propagate head-of-line blocking and is typically disabled on server/uplink ports.

show interfaces: runts (<64 B) = collisions/duplex; giants (>MTU) = MTU mismatch; CRC/input errors = cabling or duplex mismatch.

Duplex mismatch symptom: late collisions and FCS errors on the half-duplex side, runts and alignment errors on the full-duplex side.

OSPF stuck in 2-Way between non-DR/BDR neighbors is normal on broadcast segments; stuck in ExStart/Exchange points to MTU mismatch.

Ping/traceroute: use extended ping with a specific source and size to test MTU and routing symmetry; traceroute reveals asymmetric paths.

show mac-address-table + show arp: a MAC flapping between ports indicates a loop or misconfigured LAG.

show spanning-tree: root bridge location, port roles, and topology-change counters; repeated TCNs indicate flapping links.

show lldp neighbors / show cdp neighbors: verify physical topology and detect one-sided link aggregation or VLAN mismatch.

RADIUS auth failures: check shared secret, source-interface reachability, and whether the NAS is sending the correct NAS-IP-Address attribute.

CAPWAP runs over UDP: control 5246, data 5247; it can run over IPv4 or IPv6 and is DTLS-encrypted for control.

AP boot order: DHCP → discover controller (broadcast/unicast/DNS) → join → image download if mismatch → config download → run.

FlexConnect (AOS) / flex-role AP: locally switches client traffic at the branch, survives WAN loss, and supports local VLAN mapping.

Roaming types: L2 roam (same subnet, same controller) keeps the client IP; L3 roam (different subnet) requires mobility tunnel or anchor.

Mobility group / mobility domain: controllers in a group share client state so a client can roam across controllers without re-authentication.

Band steering pushes dual-band clients to 5 GHz; it is a steering hint, not a guarantee, and should be disabled for legacy-only clients.

802.11k neighbor reports and 802.11v BSS transition management assist fast, informed roaming; 802.11r enables fast BSS transition (FT) key caching.

WPA3-Enterprise uses 192-bit security (GCMP-256); WPA3-Personal uses SAE instead of PSK to resist offline dictionary attacks.