Edge and Networking
Edge and Networking
The Edge and Networking domain tests how you design, secure, and operate HPE Aruba Networking at the edge and connect it to HPE GreenLake operations. Questions focus on wired switching, wireless, policy enforcement, SD-WAN, and cloud management rather than generic networking theory.
Core rules and concepts
- Aruba ESP combines unified infrastructure, Zero Trust security, and AIOps. Aruba Central is the cloud management and AIOps plane for Aruba CX switches, access points, and gateways; AirWave is the legacy on-premises management product.
- AOS-CX supports two high-availability designs. VSF creates a stack with one control plane and cross-member link aggregation, typically for a single wiring closet. VSX creates an active-active pair with independent control planes, an inter-switch link, and a keepalive, typically for distribution or data-center pairs.
- Dynamic Segmentation uses ClearPass Policy Manager to assign a role, then enforces that role at the Aruba CX switch, AP, or gateway using role-based ACLs or user-based tunneling (UBT). The same role can follow a user across wired and wireless.
- Aruba EdgeConnect SD-WAN builds business-intent overlays over any underlay, with local internet breakout, path conditioning, and First-Packet iQ for application classification.
- At the compute edge, HPE ProLiant DL20/DL360 Gen11 servers are managed through HPE Compute Ops Management; HPE GreenLake for Aruba provides network-as-a-service consumption.
Worked example
A branch has two access switches in one closet, a core pair, employee Wi-Fi, and IoT cameras. Choose VSF for the closet because the switches are co-located and need one management plane and cross-member LAGs. Keep VSX at the core if the pair must run independent control planes and active-active routing. In ClearPass, map employees to a role that permits business VLANs and map cameras to an IoT role that denies employee VLAN access. Enforce both roles on the CX switches with role-based ACLs, and use UBT only where traffic must be tunneled to a gateway. This design gives consistent policy without creating a separate firewall zone for every device type.
Traps that cost marks
Do not confuse VSF with VSX: VSF is stacking, VSX is MLAG-like active-active. ClearPass makes the policy decision; it does not enforce traffic itself. Aruba Central is not AirWave. SD-WAN overlays are not the same as underlay routing. Aruba access points do not run AOS-CX; CX is the switch operating system.