Extreme Networks Associate (ECA) cheat sheet

ExtremeCloud IQ is the cloud-native management plane; ExtremeCloud IQ Controller (formerly ExtremeCloud IQ Site Engine / on-prem options) covers on-premises management.

Switch families by role: Universal switches (5420, 5520, 5720, 7520, 7720) run either ExtremeXOS or VOSS via a selected software image; fixed 4000/5000 series are campus/edge; X8 and SLX target data center and aggregation.

Wireless: Wi-Fi 6/6E access points (AP300/AP400/AP500 series) managed by ExtremeCloud IQ or a controller; Wi-Fi 7 models extend the same management model.

Fabric Engine (formerly SPB-based Fabric Connect) ships on VOSS platforms; ExtremeXOS platforms use Extreme Fabric Connect / IP fabric options depending on release.

Licensing tiers on ExtremeCloud IQ: Connect (basic), Pilot (advanced management/analytics), and CoPilot (AI/ML-driven operations); tier determines feature availability per device.

ExtremeCloud IQ licensing is subscription-based per device and tied to the device's serial number; a device consumes a license when it connects to the cloud instance.

Management/analytics add-ons: ExtremeCloud IQ Site Engine for on-prem, ExtremeAnalytics for application visibility, and ExtremeLocation for presence analytics.

Support and software entitlement follow the support contract level (e.g., NBD, 4-hour, 24x7); feature activation may require an active contract and current software release.

Identify platform by CLI prompt and command set: ExtremeXOS prompts and commands differ from VOSS (e.g., VOSS uses 'enable'/'configure terminal' style with VOSS-specific 'show' syntax).

Campus three-tier model: access (user/AP ports) → distribution (policy/routing boundary) → core (high-speed transit); collapsed core merges distribution and core.

Spanning tree defaults: RSTP/MSTP provide loop prevention; Extreme Fabric Connect replaces STP in the fabric core by using IS-IS-based shortest path forwarding.

VLANs segment Layer 2 broadcast domains; inter-VLAN routing occurs at the distribution/core via SVIs or fabric L3 services.

Link aggregation (LACP) bundles parallel links for bandwidth and redundancy; all member links must match speed, duplex, and VLAN configuration.

PoE budgets: 802.3af (15.4 W at PSE), 802.3at/PoE+ (30 W), 802.3bt Type 3 (60 W) and Type 4 (90 W); verify per-port and total switch power budget.

Data center designs favor spine-leaf with equal-cost multipath (ECMP); oversubscription ratio = downlink bandwidth ÷ uplink bandwidth.

MTU: jumbo frames (typically 9000 bytes) must be consistent end-to-end for storage and vMotion traffic; a mismatch causes silent drops.

QoS marking at the edge (DSCP for L3, CoS/PCP for L2) preserves priority across the network; trust boundaries are set at access ports.

IPv6 uses ND/RA instead of ARP; dual-stack requires consistent VLAN and routing configuration on both address families.

ExtremeXOS (rebranded Switch Engine) CLI modes: user exec (>) → privileged exec (#) via 'enable' → global config via 'configure terminal'; VOSS uses 'enable' then 'configure terminal' with VOSS-specific context.

ExtremeXOS VLAN creation: 'create vlan tag ' then 'configure vlan add ports '; VOSS uses 'vlan create name ' and 'vlan members add '.

ExtremeXOS port config: 'configure ports auto on speed '; verify with 'show ports configuration'. VOSS: 'interface gigabitethernet <slot/port>' then 'no shutdown'.

Saving config: ExtremeXOS uses 'save configuration' and 'upload configuration'; VOSS uses 'save config' and 'copy config ...'. Unsaved changes are lost on reboot.

ExtremeXOS show commands: 'show vlan', 'show iproute', 'show lldp neighbors', 'show version', 'show log'. VOSS: 'show vlan', 'show ip route', 'show lldp neighbor', 'show sys-info'.

VOSS uses a single 'vlan' object model with port membership and a separate 'ip interface vlan ' for L3; ExtremeXOS binds IP directly to the VLAN via 'configure vlan ipaddress'.

Routing: ExtremeXOS 'enable ipforwarding vlan ' plus 'configure iproute add default '; VOSS 'ip routing' plus 'ip route 0.0.0.0/0 '.

Fabric: VOSS enables Fabric Connect with 'fabric enable' and 'fabric isis'; ExtremeXOS uses 'enable fabric' and 'configure fabric' commands depending on release.

ExtremeCloud IQ onboarding: device must reach the cloud via DHCP option 43 or DNS, obtain a management IP, and be added by serial number to a tenant.

Configuration is template-driven: network policies, device templates, and SSIDs are pushed from ExtremeCloud IQ; local CLI changes can be overwritten by the next push.

Monitoring views: dashboard health, client 360, device 360, and alarm/event logs; alarms have severity levels (critical, major, minor, warning, info).

Firmware upgrades are scheduled from ExtremeCloud IQ; devices must be online and have sufficient flash; upgrades can be staged by device group.

ExtremeCloud IQ Site Engine (on-prem) provides network topology maps, configuration backup, and policy management for environments that cannot use cloud.

Backup and restore: configuration snapshots are stored in the cloud; restoring requires the device to be re-onboarded or matched by serial.

Role-based access control (RBAC) in ExtremeCloud IQ: admin, operator, monitor, and installer roles limit what each user can change.

API access: ExtremeCloud IQ exposes REST APIs for automation; tokens are scoped to the tenant and expire per policy.

Troubleshooting tooling includes packet capture from the AP/switch, client troubleshooting, and RF/spectrum analysis views.

Extreme Fabric Connect (SPB/IS-IS) builds a shortest-path L2/L3 fabric; edge nodes attach services, core nodes only forward.

Service types: L2 VSN (VLAN extension), L3 VSN (routed virtual service network), IP Shortcut, and ELINE/ETREE for point-to-point and multicast.

BCB (backbone core bridge) nodes run IS-IS and forward; BEB (backbone edge bridge) nodes host service access points and I-SIDs.

I-SID is the 24-bit service identifier that maps a customer service to the fabric; VSN binds a VLAN to an I-SID.

Overlay vs underlay: VXLAN provides L2 over L3 encapsulation with a VNI; EVPN provides control-plane MAC/IP learning for the overlay.

VXLAN VTEPs encapsulate frames in UDP (port 4789); MTU must accommodate the 50-byte outer header plus inner frame.

Fabric Connect replaces STP in the core - no blocked links; all paths forward via IS-IS ECMP.

Fabric attach: SPB requires consistent IS-IS area/system ID configuration and matching MTU on fabric links.

Troubleshooting fabric: 'show isis adjacencies', 'show isis spbm', 'show vlan i-sid', and 'show fabric' verify neighbor and service state.

AAA: configure RADIUS/TACACS+ with a shared secret; TACACS+ encrypts the full payload and is preferred for command accounting.

802.1X port authentication uses EAP over LAN; the switch is the authenticator, the client the supplicant, and RADIUS the authentication server.

MACsec provides hop-by-hop L2 encryption on supported links; it requires key agreement and matching cipher suites on both ends.

Management hardening: disable Telnet and HTTP, enable SSH and HTTPS, restrict management access by ACL, and change default credentials.

DHCP snooping binds client MAC/IP to a trusted port; dynamic ARP inspection and IP source guard rely on the snooping database.

Storm control limits broadcast/multicast/unknown-unicast rates per port to prevent loops from saturating links.

Firmware and configuration backups should be taken before changes; maintain a rollback image and a saved config snapshot.

Logging: send syslog to a central collector, set NTP for accurate timestamps, and monitor for authentication failures and config changes.

Change management: schedule changes in maintenance windows, document rollback steps, and verify with post-change show commands.

Layered troubleshooting: physical (link LEDs, cable, optics) → L2 (VLAN, STP, MAC table) → L3 (ARP, routing, ACL) → L4+ (application, DNS).

ExtremeXOS diagnostics: 'show ports statistics', 'show tech-support', 'show log', 'clear counters'; VOSS uses 'show interfaces gigabitethernet <slot/port>'.

MAC address table: 'show fdb' (ExtremeXOS) or 'show mac-address-table' (VOSS) confirms learning and identifies the egress port for a destination.

STP troubleshooting: verify root bridge election with 'show spanning-tree', check port roles (root, designated, alternate), and confirm consistent timers.

Routing issues: check interface up/up, IP address and mask, ARP resolution, and route table entries; a missing route causes silent drops.

Packet capture: mirror a port to a capture host ('configure mirroring add port '), or use built-in capture on ExtremeCloud IQ-managed devices.

Log analysis: correlate timestamps across syslog, NTP-synced devices, and alarm history to identify the first failure in a cascade.

Escalation: collect 'show tech-support', config backup, and topology details before opening a support case; this shortens resolution time.

Baseline metrics (interface errors, CRC, utilization, CPU/memory) establish what 'normal' looks like so anomalies are detectable.