HPE Aruba Switching Expert (Written, HPE7-A06) flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSPF area 0

The backbone area; all other areas must connect to it directly or via a virtual link. Inter-area LSAs (type 3) are originated by ABRs between areas.

OSPF router ID

Highest loopback IP, else highest physical interface IP, unless manually set. Used to break ties in DR/BDR election and to identify the router.

VRRP virtual MAC

The shared MAC 0000.5e00.01XX where XX is the VRID in hex. The master answers ARP for the virtual IP using this MAC.

RSTP edge port

A port configured as edge (PortFast) skips learning and listening and goes straight to forwarding. It should only face end hosts, not switches.

VSX keepalive link

A separate L3 link between VSX peers used to detect peer liveness. If it fails while ISL is up, the secondary takes over to avoid split-brain.

802.1Q native VLAN

Frames on the native VLAN traverse a trunk untagged. Both ends must agree on the native VLAN or traffic is misclassified and VLANs can leak.

LACP active mode

The port actively sends LACPDUs to negotiate a bundle. Passive mode only responds. At least one side must be active to form the LAG.

Jumbo frame MTU

Frames larger than 1500 bytes (commonly 9000). MTU must match end-to-end; a single 1500-byte hop drops or fragments them.

PoE 802.3at budget

PoE+ delivers up to 30 W at the PSE and 25.5 W at the PD. Budget per port and total switch power must be checked before deployment.

LLDP-MED

An extension of LLDP that carries voice VLAN, power, and inventory details to IP phones, enabling automatic voice VLAN assignment and PoE negotiation.

Link aggregation requirements

All member links must match speed, duplex, MTU, and allowed VLANs. A mismatch silently removes the member from the bundle.

802.1X supplicant

The client device requesting network access. It speaks EAPoL to the authenticator, which relays EAP to the RADIUS server.

MAB authentication

MAC Authentication Bypass sends the client MAC as both username and password to RADIUS. It is a fallback for devices that cannot run 802.1X.

RADIUS CoA

Change of Authorization (RFC 5176) lets the RADIUS server push policy changes to the switch for a live session, such as re-authentication or role change.

DHCP snooping trusted port

A port allowed to carry DHCP server replies. Untrusted ports drop DHCP Offer and ACK, preventing rogue DHCP servers.

Dynamic ARP Inspection

Validates ARP packets against the DHCP snooping binding table. Invalid ARP is dropped, mitigating ARP spoofing and man-in-the-middle attacks.

Port-security shutdown mode

On a violation the port is err-disabled and must be manually or automatically recovered. Protect drops silently; restrict drops and logs.

RADIUS dynamic VLAN

Tunnel-Type=VLAN (13), Tunnel-Medium-Type=802 (6), Tunnel-Private-Group-ID=<VLAN ID> in the Access-Accept assigns the client to a VLAN.

DSCP EF

Expedited Forwarding, value 46, used for voice. Typically placed in a strict priority queue capped to prevent starvation of other classes.

LLQ priority cap

A strict priority queue drains before all others. Capping it (commonly 10–33% of link bandwidth) prevents voice from starving other traffic.

Storm control

Limits broadcast, multicast, or unknown-unicast traffic as a percentage of link bandwidth or packets per second, dropping excess to prevent storms.

WRR scheduling

Weighted Round Robin serves egress queues by weight, distributing remaining bandwidth after priority traffic. DRR is the deficit-based variant.

QoS trust boundary

The point where DSCP or CoS markings are trusted. Typically at the access edge; untrusted traffic is remarked to best-effort (DSCP 0).

Flow control 802.3x

Pause frames stop a link on congestion. They can cause head-of-line blocking and are usually disabled on server and uplink ports.

CRC and input errors

CRC/FCS and input errors indicate physical layer problems: bad cabling, duplex mismatch, or faulty optics. Check counters on both ends.

Duplex mismatch symptom

Late collisions and FCS errors appear on the half-duplex side; runts and alignment errors on the full-duplex side. Fix by forcing matching settings.

OSPF stuck in ExStart

Indicates an MTU mismatch between neighbors. The database description exchange cannot proceed; match MTU or use ip ospf mtu-ignore.

MAC flapping

The same MAC appears alternately on two ports, indicating a loop or misconfigured LAG. Check spanning-tree and LAG membership.

CAPWAP ports

Control traffic uses UDP 5246, data uses UDP 5247. Control is DTLS-encrypted; data may be encrypted depending on configuration.

FlexConnect local switching

The AP switches client traffic locally at the branch and maps SSIDs to local VLANs, surviving WAN loss to the controller.

L3 roaming

A client roams to an AP on a different subnet. A mobility tunnel or anchor controller preserves the client IP and session state.

802.11r fast transition

Fast BSS Transition caches and pre-derives keys so a client can roam between APs without a full 802.1X re-authentication.

WPA3 SAE

Simultaneous Authentication of Equals replaces the PSK handshake with a password-authenticated key exchange, resisting offline dictionary attacks.