Extreme Certified Professional - Extreme Switching cheat sheet

ExtremeXOS (EXOS) and Extreme Fabric Engine (VOSS) are distinct operating systems: EXOS is the CLI/OS used on X-series, Summit, and many SLX/Universal platforms; VOSS is the OS on VSP/Fabric Engine platforms and uses a different CLI syntax and configuration model.

Stacking on Extreme switches uses SummitStack (EXOS) over dedicated stacking ports or front-panel ports; a stack elects a master and a backup master, and the stack is managed as one logical device with one IP address.

Extreme Fabric Connect is a SPB (Shortest Path Bridging, IEEE 802.1aq) based architecture: it uses IS-IS as the control plane, provides MAC-in-MAC encapsulation, and enables L2/L3 virtualization via service instances (VSNs).

EXOS hardware families include fixed-configuration Summit switches and modular X-series chassis; line cards and management modules are hot-swappable on supported chassis, and power supplies can be redundant and load-sharing.

Port numbering on EXOS is slot:port (e.g., 1:5); on stackable Summit switches the stack port numbering and slot ID are assigned at stack formation, and the slot ID determines the port prefix.

Interface types in EXOS include physical ports, LAG (link aggregation group) logical ports, VLAN logical interfaces, and loopback interfaces; routing and management can be bound to these logical interfaces.

EXOS supports alternate operating modes and platforms (e.g., EXOS on supported third-party or white-box hardware via Extreme's open networking offerings); feature availability varies by platform and license.

A switch's forwarding is hardware (ASIC) based; control-plane functions (STP, routing protocols, management) run in software, so a control-plane overload can disrupt protocols while forwarding continues.

EXOS initial access is via console (default baud 9600, 8N1); the default login is admin with no password, and the first configuration step should set a password and management IP.

Management VLAN/IP is configured with commands such as configure vlan Mgmt ipaddress <ip> <mask> and enable ipforwarding vlan Mgmt; the default management VLAN is typically Mgmt (VLAN 4095 on some platforms).

Save configuration with save configuration (or save config); unsaved changes are lost on reboot. Use show configuration to review and upload configuration/download configuration for backup and restore via TFTP/SCP.

Software images on EXOS are updated with download image <server> <file> {primary|secondary} then reboot; show version displays the running image, and use image selects the boot image.

Management protocols to enable/disable: SSH (enable ssh2), Telnet (disable telnet recommended), SNMP (enable snmp access), and HTTPS (enable web http/enable web https). Restrict access with ACLs on the management VLAN.

EXOS supports multiple user accounts with create account <user> <password> {admin|user}; AAA (RADIUS/TACACS+) is configured with configure radius/configure tacacs and configure aaa to authenticate management logins.

Configuration modes: EXOS CLI has a User EXEC and Privileged EXEC model; configure terminal is not required - commands are entered directly at the prompt, and show commands display state.

NTP is configured with configure ntp server add <ip> and enable ntp; correct time is required for certificate validation, log timestamps, and AAA accounting.

VLAN creation: create vlan <name> tag <id>; add ports with configure vlan <name> add ports <portlist> {tagged|untagged}. A port can be untagged in only one VLAN; tagged ports carry multiple VLANs.

The default VLAN is typically VLAN 1 (named Default); untagged traffic on a port belongs to that port's untagged VLAN. Tagged frames use 802.1Q tags with the configured VLAN ID.

EXOS supports STP, RSTP (802.1w), and MSTP (802.1s). Enable with enable stpd <name> and configure mode with configure stpd <name> mode {dot1d|dot1w|mstp}.

MSTP maps VLANs to MST instances; configure with configure stpd <name> add vlan <vlan> dot1d <instance>; the region name and revision must match across all switches in the MST region.

STP port roles include Root, Designated, Alternate, and Backup; port states are Discarding, Learning, and Forwarding (RSTP/MSTP). Root bridge selection uses bridge priority then MAC address.

Edge ports (PortFast equivalent) skip STP listening/learning: configure stpd <name> ports <port> edge-safeguard or edge-port; BPDU guard protects against loops from edge devices.

ERPS (G.8032) and Extreme's Ethernet Automatic Protection Switching (EAPS) provide sub-second ring protection as alternatives to STP; EAPS uses a master node and control VLAN to detect ring failure.

Root guard and BPDU guard: configure stpd <name> ports <port> root-guard prevents a port from becoming root; BPDU guard disables an edge port that receives BPDUs.

LAG creation on EXOS: create lag <name> then configure lag <name> add ports <portlist>; or use enable sharing <master-port> grouping <portlist> algorithm <algo>.

Static LAGs require matching configuration on both ends; LACP (802.3ad) uses configure sharing <master> lacp and negotiates aggregation automatically.

LACP modes: active (initiates LACP), passive (responds only). At least one side must be active for the LAG to form.

Load-sharing algorithms include L2 (source/destination MAC), L3 (source/destination IP), and L4 (TCP/UDP port). Choose an algorithm that matches traffic patterns to avoid polarization.

All ports in a LAG must have the same speed, duplex, and VLAN membership; a port can belong to only one LAG, and the master port carries the LAG's configuration.

show sharing and show lacp display LAG status, member ports, and LACP neighbor state; show ports <port> info detail shows per-port link and flow control.

Multi-switch LAG (MLAG) on EXOS uses Extreme's MLAG or VSS-like features; on Fabric Engine, multi-homing uses SMLT/RSMLT for active-active dual-homed connections.

LAG health-check and min-links: configure a minimum number of active links so the LAG goes down if too few members remain, preventing black-holing.

Enable routing globally with enable ipforwarding; create a VLAN interface with configure vlan <name> ipaddress <ip> <mask> and enable enable ipforwarding vlan <name>.

Static routes: configure iproute add <network> <mask> <gateway>; default route uses 0.0.0.0/0. show iproute displays the routing table and show iproute <network> shows a specific route.

EXOS supports OSPF (v2/v3), BGP, IS-IS, and RIP. OSPF is enabled with enable ospf and areas/interfaces configured via configure ospf add vlan <name> area <id>.

VRF (Virtual Routing and Forwarding) separates routing tables: create with create vrf <name> and bind VLANs/interfaces to the VRF; each VRF has independent routing and forwarding.

ECMP (Equal-Cost Multi-Path) allows multiple equal-cost routes; EXOS supports ECMP for OSPF/BGP/static routes, and configure iproute add ... metric influences path selection.

ARP: show iparp displays the ARP table; clear iparp flushes entries. Proxy ARP can be enabled per VLAN with enable iparp proxy.

IPv6 is supported with enable ipforwarding ipv6, configure vlan <name> ipaddress <ipv6>/<prefix>, and configure iproute add <prefix> <gateway> for IPv6 routes.

Route redistribution between protocols is configured with configure <protocol> add export <protocol>; use route maps to filter and set attributes.

Port security limits MAC addresses per port: configure ports <port> limit-learned-mac <n> and configure ports <port> lock-learning; violations can disable the port or drop frames.

802.1X authentication: configure netlogin dot1x; RADIUS server configured with configure radius primary server <ip> ...; supplicants authenticate before the port is authorized.

MAC-based authentication (netlogin mac) authenticates devices by MAC against RADIUS; Web-based authentication (netlogin web) redirects users to a login page.

ACLs on EXOS are created with create access-list <name> ... and applied to VLANs or ports with configure access-list <name> [ports|vlan] ...; ACLs match on L2/L3/L4 fields.

DHCP snooping with enable dhcp snooping and trusted ports prevents rogue DHCP servers; dynamic ARP inspection (DAI) validates ARP packets against the DHCP snooping binding table.

IP source guard binds source IP/MAC to the DHCP snooping table, dropping spoofed source addresses on untrusted ports.

Management access security: restrict SSH/Telnet/SNMP to a management VLAN, apply ACLs, use configure snmpv3 for encrypted SNMPv3, and disable unused services.

RADIUS/TACACS+ AAA: configure aaa radius primary server <ip> and configure aaa primary authentication radius; TACACS+ is commonly used for per-command authorization.

show ports <portlist> statistics displays per-port counters; clear ports <portlist> counters resets them. show ports <portlist> info detail shows link state, speed, and flow control.

show log displays the system log; configure log target <target> sets log destinations (memory-buffer, console, syslog server). Severity levels range from emergency to debug.

show tech-support collects a diagnostic bundle for TAC; show diagnostics displays hardware health (temperature, fans, power supplies).

sFlow/NetFlow: enable sflow and configure sflow collector <ip> export traffic samples; show sflow verifies configuration.

show version displays software image, boot image, and hardware; show switch shows slot/stack status; show slot shows module inventory.

Spanning tree troubleshooting: show stpd <name> ports shows roles/states; show stpd <name> bridge shows bridge priority and root. show lldp neighbors maps topology.

ping and traceroute are available from the EXOS CLI: ping <ip> {count <n>} and traceroute <ip>; show iparp verifies ARP resolution.

show configuration and show configuration <module> help audit running config; diff (where supported) compares saved vs running configuration.