HPE Network Switching Professional (HPE7-A08)

By default, 802.1X has higher authentication precedence than MAC authentication, so a device that cannot perform 802.1X can wait for that process before MAC authentication is attempted. Configuring MAC authentication before 802.1X lets those devices authenticate through MAC authentication promptly while preserving controlled network access. Aruba AOS-CX: aaa authentication port-access auth-precedence

A mirror session with the CPU as its destination lets Tshark capture the mirrored traffic into a PCAP file on the CX switch for transfer to a remote server. A destination interface or ERSPAN forwards traffic for external analysis, while real-time tcpdump output does not produce the required complete capture file. Aruba documents CPU-destined mirroring for Tshark captures and the copy tshark-pcap workflow for transferring capture data to a remote secure file-transfer server.

On an Aruba AOS-CX VSX LAG, lacp fallback lets member links operate as nonbonded interfaces when no LACP partner is detected. This feature is supported only when the downstream or peer device has a single link to each VSX node.

ARP protection validates ARP traffic on untrusted ports against the DHCP snooping binding table. Configuring DHCP snooping creates the required client IP/MAC/VLAN/interface bindings, allowing valid users’ ARP traffic to pass.

The vsx-peer parameter obtains the corresponding command output from the peer VSX switch. Comparing the local and peer running configurations for the same interface is used to identify configuration differences that can cause inconsistent VSX LAG behavior; this is the spot-the-difference methodology.