HPE Aruba Switching Expert (Written, HPE7-A06) key terms

A Layer 2 protocol that prevents loops in a bridged network by electing a root bridge and blocking redundant paths while keeping one active path per segment.

An evolution of STP defined in IEEE 802.1w that converges much faster by using explicit port roles and proposal/agreement handshakes instead of long timer-based transitions.

An IEEE 802.1s standard that maps groups of VLANs to independent spanning tree instances, allowing different active topologies and better load sharing across redundant links.

A switch port feature that disables or err-disables an edge port if it receives a bridge protocol data unit, protecting the topology from unauthorized or misconfigured switches.

A per-port protection that blocks superior BPDUs from being accepted, preventing a downstream switch from becoming the root bridge and destabilizing the spanning tree topology.

A bundle of multiple physical links treated as one logical link to increase bandwidth and provide redundancy, negotiated with LACP or configured statically on both ends.

The Link Aggregation Control Protocol (IEEE 802.3ad) that exchanges control frames between peers to negotiate, verify, and maintain the membership of links in an aggregation bundle.

An Aruba high-availability technology that pairs two switches into a single logical control plane with synchronized state, enabling active-active forwarding and multichassis link aggregation.

A link aggregation where member links terminate on two different VSX peer switches, giving servers or downstream switches redundant dual-homed connectivity without spanning tree blocking.

The dedicated link between VSX peers that carries synchronization and, in some designs, data traffic; it is distinct from the keepalive path used for peer health checks.

A separate connectivity path between VSX peers used to detect peer failure and decide whether to keep forwarding, preventing a split-brain condition when the ISL is down.

A logical grouping of OSPF-enabled interfaces that limits link-state flooding and topology calculation scope; all areas must connect to the backbone area 0 through an ABR.

An OSPF area that blocks external LSAs to reduce database and CPU load; routers inside reach external networks via a default route injected by the area border router.

The OSPF router elected on a multi-access segment to represent the segment in the topology database and to form adjacencies with all other routers, reducing LSA flooding.

The full relationship formed between two OSPF routers after matching hello parameters and completing database exchange; only adjacent routers share link-state advertisements directly.

The Virtual Router Redundancy Protocol lets multiple routers share a virtual IP and MAC so one acts as master and others as backups, providing default gateway redundancy for hosts.

A design pattern using protocols such as VRRP to give hosts a resilient default gateway, so a router failure does not interrupt outbound traffic from the subnet.

An IEEE standard that authenticates a supplicant before granting Layer 2 access, using an authenticator switch and a RADIUS server to authorize the port or session.

A AAA protocol that carries authentication, authorization, and accounting exchanges between a network access device and a central server, typically over UDP with shared-secret protection.

The Extensible Authentication Protocol is a framework carried inside 802.1X that negotiates authentication methods such as TLS or PEAP between supplicant and authentication server.

A RADIUS feature (RFC 5176) allowing the server to push changes such as disconnect or reauthorize requests to the switch, enabling session changes without waiting for reauthentication.

A policy model where users or devices are assigned roles that determine VLAN, ACL, and QoS treatment, applied dynamically after authentication rather than by static port configuration.

A switch feature that limits the number of learned MAC addresses per port and can restrict, protect, or shut down the port when unauthorized addresses appear.

A security feature that classifies ports as trusted or untrusted and filters DHCP server messages from untrusted ports, building a binding table of legitimate client leases.

A feature that validates ARP packets against the DHCP snooping binding table, dropping spoofed replies on untrusted ports to prevent man-in-the-middle attacks.

An ordered set of permit or deny rules matched against packet fields, applied to interfaces or roles to filter traffic; placement and implicit deny behavior affect results.

A mechanism that rate-limits traffic destined to the switch CPU, protecting routing and management protocols from overload or denial-of-service floods.

A standard method for delivering DC power alongside data on Ethernet cabling, with classes and negotiation that determine how much wattage a powered device receives.

The Link Layer Discovery Protocol advertises device identity, capabilities, and neighbor information between directly connected devices, and is used for topology discovery and PoE negotiation.

The total wattage a switch can supply to powered devices across its ports, constrained by power supply capacity and allocation policy, which determines how many devices can be powered.

The point in the network where packet markings such as DSCP or 802.1p are trusted and preserved; markings from untrusted sources are typically remarked at the edge.

The Differentiated Services Code Point is a 6-bit field in the IP header used to classify packets into per-hop behaviors such as expedited forwarding or assured forwarding.

A 3-bit priority field in the Ethernet VLAN tag used to signal relative forwarding priority on Layer 2 links, often mapped to or from DSCP at trust boundaries.

A congestion avoidance mechanism that probabilistically drops lower-priority packets before a queue fills completely, signaling TCP senders to slow down and avoiding tail-drop bursts.

The method a switch uses to decide which queued packet leaves next, such as strict priority or weighted deficit round robin, balancing latency-sensitive and bulk traffic.

The repository of link-state advertisements a router builds from OSPF flooding; all routers in an area should hold identical databases for consistent shortest-path calculation.

A switch capability that automatically re-enables a port placed in an error-disabled state after a configured interval, useful for transient causes such as BPDU Guard triggers.

A failure condition where two redundant control-plane peers both believe they are active because the link between them is lost, risking duplicate addressing and inconsistent forwarding.

A switch test that sends pulses down a copper cable to estimate fault distance and detect opens, shorts, or impedance mismatches, helping isolate physical-layer problems.

A spanning tree port role for links to end devices, allowing immediate forwarding without listening or learning delay; it should never connect to another bridge.

A feature that stops BPDUs from being sent or received on a port, effectively isolating it from spanning tree; misconfiguration can create undetected loops.

An Aruba appliance or virtual device that centrally manages mobility controllers, pushing configuration, licensing, and firmware policies to managed controllers across the network.

A gateway device that terminates access point tunnels, enforces user roles and policies, and anchors client traffic between wireless and wired networks.

The Control and Provisioning of Wireless Access Points protocol encapsulates control and optionally data traffic between an access point and its controller over IP.

A wireless device that bridges 802.11 client traffic onto the wired network, either tunneling it to a controller or forwarding it locally depending on the deployment mode.

The process of a wireless client moving its association from one access point to another while maintaining connectivity, with handoff behavior depending on client and infrastructure support.

The Service Set Identifier is the name that identifies a wireless network; multiple SSIDs can map to distinct VLANs and security policies on the same access point.