Aruba Associate cheat sheet

802.11 channel width and data rate: 20 MHz channels are the most reliable; 40 MHz doubles throughput but consumes two adjacent channels; 80/160 MHz (11ac/11ax) only fit in 5 GHz and 6 GHz and sharply reduce available non-overlapping channels.

2.4 GHz uses channels 1-14 with only 1, 6, and 11 non-overlapping in the common 3-channel plan (5 MHz separation needed; 25 MHz between 1/6/11); 5 GHz UNII-1 (36-48), UNII-2A (52-64), UNII-2C (100-144), UNII-3/ISM (149-165).

5 GHz UNII-2A and UNII-2C require DFS and TPC; a radar detection triggers a 60-second channel move time and a 10-minute non-occupancy period on that channel.

RSSI/SNR planning: -65 dBm or better at the cell edge for voice, -67 to -70 dBm for data; SNR of 25 dB supports 64-QAM/high MCS, SNR below 10 dB collapses to low rates.

Co-channel interference (CCI) is managed by channel reuse and power; adjacent-channel interference (ACI) is avoided by never using overlapping channel widths; SNR/SINR, not raw RSSI, determines modulation.

Free-space path loss: FSPL(dB) = 20log10(d) + 20log10(f) + 32.44 with d in km and f in MHz; doubling distance adds ~6 dB loss, and higher frequency adds loss at equal distance.

802.11 frame types: management (beacon, probe request/response, authentication, association), control (RTS/CTS, ACK, Block ACK), data; beacons default to 100 ms and carry SSID, supported rates, and capability info.

Roaming decisions are client-driven; 802.11k provides neighbor reports, 802.11v sends BSS transition management requests, and 802.11r enables fast BSS transition (FT) to cut reauthentication time.

WPA2 uses AES-CCMP; WPA3 uses AES-GCMP-256 with SAE replacing PSK, and WPA3-Enterprise optionally adds 192-bit suite-B cryptography; WEP and TKIP are deprecated.

Aruba mobility controllers (Mobility Master plus managed Mobility Controllers) run ArubaOS; the Mobility Master is optional in newer AOS 8.x deployments where a single controller or conductor model can be used.

Instant APs run Aruba InstantOS and elect a virtual controller (VC) from the AP group; the VC holds the configuration and pushes it to members, with no hardware controller required.

Aruba switches span the CX family (CX 6000/6100/6300/6400/8400) running AOS-CX and the older 2930/3810/5400 series running AOS-S; AOS-CX is the current platform.

Aruba access points include the 500/510/530 series (Wi-Fi 6), 630/650 series (Wi-Fi 6E), and 300/310/340 series (Wi-Fi 5); AP model number suffixes indicate internal/external antenna and regulatory domain.

ClearPass Policy Manager provides RADIUS/TACACS+, 802.1X, MAC authentication, role mapping, and guest workflows; it is the policy engine for Aruba's role-based access control.

ArubaOS-CX uses a VSX (Virtual Switching Extension) pair for high availability instead of VRRP/stacking; VSX uses ISL and keepalive links and provides active-active forwarding.

Aruba Central is the cloud management platform for APs, switches, and gateways; ArubaOS 8 gateways can be managed by Central, and AOS-CX switches support Central onboarding.

Aruba's architecture separates the control plane (Mobility Master/VC) from the data plane (APs and controllers); traffic can be tunneled to the controller or bridged locally at the AP (local bridging).

Licensing families: ArubaOS controller licenses (AP, PEF, RF Protect), Central subscription tiers (Foundation/Advanced), and ClearPass device/access licenses are distinct and not interchangeable.

AP boot sequence: power on, load firmware, discover controller via DHCP option 43, DNS (aruba-master), or broadcast; then join, download config, and start SSIDs.

AP operational modes: access (normal), monitor (dedicated scanning, no SSID), spectrum (RF spectrum analysis), and mesh (point-to-point/point-to-multipoint bridging); modes are set per-AP in the AP group.

Controller redundancy: an AP can be configured with a primary and backup controller (LMS); if the primary fails, the AP fails over to the backup and re-downloads its configuration.

Instant AP cluster: APs in the same VLAN/subnet form a cluster; the VC is elected by priority/MAC, and a cluster can span up to 128 APs (model-dependent); a conductor AP can manage multiple clusters.

AP uplink: 802.3af provides ~12.95 W at the AP, 802.3at ~25.5 W, 802.3bt up to 60/90 W; Wi-Fi 6/6E APs often need at least 802.3at for full radio operation.

Armon: Aruba's RF management feature that automatically assigns channels and transmit power; ARM scans, builds an RF neighborhood, and adjusts to avoid interference.

AP console/CLI: 'show ap database' lists APs and state, 'show ap active' shows joined APs, 'show ap arm rf-summary' shows channel/power, and 'show ap debug system-status' shows AP detail.

Controller CLI basics: 'show ap database', 'show user', 'show station', 'show datapath session', and 'show log all' are the first-line troubleshooting commands.

AP groups bind APs to a virtual AP (SSID) profile, an RF profile (ARM settings), and a regulatory profile; a virtual AP must be attached to an AP group to broadcast.

802.1X/EAP: the supplicant authenticates to the authenticator (controller/switch) which relays to the RADIUS server; EAP-TLS uses certificates, PEAP/MSCHAPv2 uses credentials inside a TLS tunnel.

Role-based access control in ArubaOS assigns a user role after authentication; roles map to ACLs, VLANs, and captive-portal policies, and can be derived from RADIUS attributes or server-derived rules.

MAC authentication (MAB) is a fallback for devices that cannot do 802.1X; it is weak because MAC addresses are spoofable, so it should be combined with role restrictions.

Guest access patterns: captive portal with an internal or external (ClearPass) portal, self-registration, sponsor approval, and social login; Aruba's guest workflows can be local or ClearPass Guest.

WPA2-Enterprise uses 802.1X with RADIUS; WPA2-Personal uses a pre-shared key; WPA3-Personal uses SAE (Simultaneous Authentication of Equals) to resist offline dictionary attacks.

ClearPass role mapping: enforcement policies evaluate tips/roles and return enforcement profiles that set VLAN, role, or ACL; services bind authentication sources to enforcement policies.

RADIUS accounting (start/interim/stop) tracks session time and data; CoA (Change of Authorization) lets the RADIUS server change a live session's policy without reauthentication.

PEF (Policy Enforcement Firewall) on Aruba controllers applies stateful role-based ACLs; 'show user' shows the assigned role and 'show datapath session' shows permitted flows.

Guest isolation: a guest VLAN with ACLs blocking RFC1918 internal subnets and inter-client traffic prevents guests from reaching corporate resources.

SNMP: Aruba controllers and APs expose MIBs; SNMPv3 with auth/priv is preferred over v2c; traps notify on AP up/down, client association, and RF events.

Syslog severity levels 0-7 (0 emergency, 7 debug); ArubaOS logging can target a syslog server and filter by facility and severity.

'show ap database' fields: AP name, group, IP, model, flags (U=up, D=down), and switch IP; 'show ap active' shows channel, power, and clients per radio.

Client troubleshooting flow: check association/authentication state ('show station'), then DHCP, then role/ACL ('show user'), then datapath ('show datapath session'), then RF (SNR, retries).

RF monitoring: 'show ap arm rf-summary' shows channel, noise, and utilization; high channel utilization with low client count suggests interference or a non-Wi-Fi source.

Packet capture: AP monitor mode with a mirroring profile sends traffic to a destination; controller 'packet-capture' and 'show datapath' commands help isolate forwarding issues.

Firmware management: controllers support image upgrade with preloading to APs; Instant APs auto-update from the VC; always check the release notes for upgrade paths and supported AP models.

Backup/restore: 'backup flash' and 'copy flash: ...' on ArubaOS controllers; configuration can be exported and restored, and 'write memory' persists running config.

Alerts and dashboards in Aruba Central and AirWave show AP health, client counts, and RF heatmaps; AirWave is the on-premises management/monitoring platform.

Aruba Central is a cloud SaaS platform for onboarding, configuring, monitoring, and troubleshooting Aruba APs, switches, and gateways; devices connect outbound to Central over HTTPS (443).

Device onboarding: APs/switches are added by serial number or claimed to a Central account; the device must reach Central's activation servers and be assigned to a group/site.

Groups in Central hold configuration (templates or UI-based); sites hold location and topology data; a device belongs to one group and one site.

Central licensing tiers: Foundation (monitoring/basic config) and Advanced (AI insights, WLAN design, and advanced security features); subscriptions are per-device and time-based.

Central's AI Insights and AIOps use telemetry to detect RF issues, client experience problems, and anomalies; these require the Advanced tier.

Templates in Central: group-level templates (CLI/JSON) push configuration to devices; variables and device-specific overrides allow per-device customization.

Central guest access can use ClearPass or Central's built-in guest portal; guest accounts can be created by sponsors and expire automatically.

Central troubleshooting tools include live client views, AP/switch health, event logs, and the 'Commands' or 'Troubleshooting' pane for running show commands remotely.

Central is distinct from AirWave (on-premises) and from ArubaOS controller management; a device managed in Central may still be managed locally depending on mode.