HPE Aruba Networking Certified Expert - Campus Access Switching (HPE7-A06)Demo

ClearPass recognizes a RADIUS NAD by the source IP address of the RADIUS request. The RADIUS-specific source-interface configuration determines that address; if it is 10.10.1.10 and ClearPass has no matching NAD definition, ClearPass reports an unknown NAD. show ip source-interface radius displays the configured source interface/IP for RADIUS traffic.

MultiEdit’s Express Config capability can apply predefined configuration settings, such as NAE scripts, to a single switch or multiple selected AOS-CX switches.

A CX 6400 VSX pair supports multi-chassis LAG, allowing the two core switches to appear as one Layer 2 peer to the downstream 802.3ad/LACP device. This enables active-active forwarding over the ToR uplinks. CX 6400 chassis port density can also allow direct attachment of VM hypervisors to the core, eliminating the constrained ToR uplink path. VSX—not VSF/backplane stacking—is the appropriate high-availability architecture for CX 6400 core deployments.

IGMP querier election uses the lowest eligible SVI IP address. Agg-1 has 10.1.0.2, which is lower than Agg-2’s 10.1.0.3, so Agg-1 is the querier. The VSX Active Gateway IP is a shared default-gateway address, not the address used for this election.

Gateway ZTP requires a WAN service that provides DHCP addressing and Internet access so the gateway can obtain its network configuration and contact Aruba Central. The ZTP connection therefore uses an untagged switchport with Internet reachability and supplies the gateway with an IP address through DHCP. Gigabit Ethernet 0/0/1 is reserved for One Touch Provisioning, not required for ZTP.

AP-655 access points include an integrated BLE 5.0 radio for location, asset-tracking, and IoT gateway applications. They must receive adequate Power over Ethernet; they support 802.3at/802.3bt PoE, and limited or insufficient PoE can place an AP in restricted-power mode or produce a system error.

On a broadcast OSPF network, routers with an OSPF priority of 0 cannot be elected as the DR or BDR. Because both routers have priority 0, no DR or BDR is available to establish the required full adjacency, leaving the neighbors in the 2-WAY/DROther state.

A manually configured common VSX system MAC prevents control-plane identity changes and associated traffic disruption during primary-switch replacement or recovery. ISL member links must have an MTU large enough to carry jumbo frames when the attached environment requires them; AOS-CX drops frames larger than an interface MTU. VSX keepalive traffic should use a dedicated Layer 3 connection, separate from the ISL, so peer liveness can still be determined if the ISL fails.

In AOS-10 gateway deployments, the AP performs the 802.1X authenticator function and the gateway proxies the RADIUS communication. With L3-connected gateways, client authentication state is not retained through AP reassociation, requiring a full 802.1X authentication. Gateway clusters also direct dynamic authorization to the client’s User Designated Gateway (UDG), rather than always to an AP.

AOS-CX captures traffic locally by mirroring it to the switch CPU with destination cpu; diag utilities tshark file can then save the mirrored packets in a local circular capture file for later export. A tunnel destination sends the traffic to a remote host instead.

DHCPv4 snooping trust is configured on the physical port that receives DHCP server messages. Ports 1/1/51 and 1/1/52 are the DHCP-server-facing uplinks, so they must be trusted; otherwise DHCP Offer/Ack messages are discarded. On AOS-CX, dhcpv4-snooping trust is an interface-configuration command.

AOS-10 gateway clusters support hitless failover by synchronizing relevant client and session state between active and standby gateways. Synchronization for high-value client sessions and IPv4 multicast (IGMP) state is supported for the first failover, enabling the standby gateway to take over seamlessly.

Dynamic role changes after DHCP profiling use RADIUS Dynamic Authorization/Change of Authorization (CoA). The switch must have Dynamic Authorization enabled globally, and ClearPass must be able to initiate CoA requests to each switch over UDP port 3799. The configured dynamic-authorization client identifies and authenticates ClearPass, but it does not by itself enable the feature.

On AOS-CX, LLDP-MED network-policy advertises voice-application policy, including DSCP priority values, to connected VoIP endpoints. The Network Policy TLV is sent only when a voice VLAN policy is present, so a Voice VLAN is also required.

VSX Active Gateway provides a redundant, active-active default gateway on an SVI, allowing endpoint traffic to use either VSX peer without a gateway change during movement or failure. The active gateway virtual IP address and virtual MAC address must be configured identically on both VSX switches. Aruba identifies Active Gateway as the modern preferred approach to VRRP for this purpose.

An isolated private VLAN prevents hosts on isolated secondary ports from communicating with one another at Layer 2; they can communicate only with promiscuous ports in the primary VLAN. Private-VLAN forwarding rules are retained across inter-switch links, allowing the isolation to apply to clients connected to both Edge-1 and Edge-2. A community VLAN is unsuitable because hosts in the same community VLAN can communicate with each other.

Wireless client traffic first traverses the AP to the mobility gateway. The gateway then carries the source role’s Group Policy ID across the static VXLAN connection toward the fabric; policy enforcement occurs at the egress switch after it identifies the destination role. Aruba’s NetConductor architecture describes egress enforcement based on the source GPID and the destination client role.

Nine 48-port access switches supply only 432 edge ports, which is fewer than the required 500. Further, an AOS-CX 6200 VSF stack supports no more than eight members, so nine switches cannot form the required single virtual switch.

An orange UXI sensor status LED indicates no connectivity. The sensor therefore cannot establish the required connection to the UXI cloud/backend services.

BPDU guard protects an STP edge port by disabling it when it receives a BPDU. BPDUs can be flooded back through the non-STP CCTV switching loop, causing the affected Edge-1 port to be disabled and breaking the loop. A BPDU-guard timeout automatically re-enables the port after the configured interval.