I85PREP
⌘ K
Extreme Networks Associate (ECA) study materials
Extreme Networks Associate (ECA) study resources

Extreme Networks Associate (ECA): Security, Troubleshooting, and Operational Best Practices

Extreme Networks Associate (ECA) · Work through your exam, one topic at a time.

All guide sections

Security, Troubleshooting, and Operational Best Practices

This domain tests the features you enable before an incident, the evidence you collect during one, and the habits that stop a routine change from becoming an outage.

Access control

  • ExtremeControl, delivered with ExtremeCloud IQ Site Engine, provides NAC: 802.1X, MAC-based authentication, web or captive-portal authentication, and policy roles that assign VLAN, ACL and QoS per user.
  • Switch Engine network login and VOSS EAPoL/FlexUNI provide the on-box 802.1X enforcement, while RADIUS and TACACS+ handle authentication and command accounting.
  • Port hardening: DHCP snooping with trusted uplinks, dynamic ARP inspection, IP source guard, and storm control on edge ports.

Troubleshooting order

Work up the stack: physical link, then VLAN and tagging, then IP addressing and routing, then policy such as ACL, NAC or fabric. Confirm each step with show ports or show interfaces, show vlan, show ip route, show lldp neighbors, then the relevant policy tables.

  • Logs: show logging, syslog to a collector, and show tech-support for a bundle to attach to a case.
  • Port mirroring or packet capture settles any argument about whether a packet actually arrived.

Operational practice

  • Back up the configuration before an upgrade, read the release notes for the target version, and compare running against saved configuration after every change.
  • Document I-SID and VLAN allocation and the address plan; most fabric faults are numbering mistakes.
  • Track firmware compliance centrally so devices are not stranded on unsupported releases.
  • Open support cases with the show tech bundle, the topology and the timestamp of the failure.

Worked example

Clients on a newly built VLAN get no address, yet the same port worked on the old VLAN. Reasoning: link and tagging are proven by the old VLAN, so check DHCP snooping first - if the uplink is untrusted, DHCP offers are dropped. Mark the uplink trusted, confirm the helper address and IP forwarding, and the scope answers.

Traps

  • Enabling DHCP snooping without trusting the uplink.
  • Assuming a NAC policy VLAN and a static VLAN both apply; the policy wins.
  • Rebooting after changes that were never saved.
  • Upgrading without a configuration backup or a release-note review.