Troubleshooting
Core concepts
Troubleshooting questions test a methodical approach: isolate the layer, gather evidence, and verify the fix. Know the AOS-CX and ArubaOS-CX CLI show commands (show interface, show spanning-tree, show lldp neighbor, show ip route, show vsx status, show authentication), log locations, and how to read counters. Understand common failure signatures: CRC errors (physical), late collisions (duplex), STP blocking (loop), and auth failures (RADIUS reachability).
Traps to watch
- Jumping to conclusions: The exam rewards isolating the layer first. A "no connectivity" symptom may be STP blocking, not a dead link.
- Counter interpretation: CRC errors point to cabling/optics; runts point to duplex; giants point to MTU.
- VSX status: Check ISL and keepalive separately; a healthy keepalive with failed ISL still shows VSX up but degraded.
- RADIUS timeouts: Often a shared-secret mismatch or unreachable server, not a client problem.
- Log levels: Debug logging can flood and mask the real issue; use targeted debug.
Worked example
Users on one VLAN lose connectivity after a switch change. Show interface reveals the port is up but STP shows it in blocking state. The change introduced a redundant path without proper MSTP instance mapping, creating a loop that STP resolved by blocking. The fix is aligning MSTP instances or removing the redundant link. The exam asks for the first command - answer: check spanning-tree state before assuming a physical fault.
Rule of thumb
Follow the OSI layers bottom-up: physical counters → L2 (STP, VLAN) → L3 (routing, ARP) → L4+ (auth, policy).