HPE6-A72 Manage, monitor, administer and operate Aruba solutions

Manage, monitor, administer and operate Aruba solutions Detailed Explanation

I. User and Role Management

Proper user management is key for access control, accountability, and network security.

1. User Accounts and Roles

Creating Local Users:

On both ArubaOS and ArubaOS-CX, you can define local users with specific access levels.

user admin password plaintext MySecurePass manager
user audit password plaintext ReadOnly123 operator

Role	Privileges
manager	Full read-write access
operator	Read-only or limited config access

Use operator role for junior staff or monitoring tools.

Best Practices:

• Avoid using a single shared admin account.

• Enforce unique usernames per admin for traceability.

• Document user roles and expiration (e.g., for contractors).

2. Secure Management Access

Enable SSH (recommended):

crypto key generate ssh
ip ssh

Disable insecure protocols:

no telnet
no http-server

Enable HTTPS if Web UI is used:

ip http secure-server

SSH and HTTPS encrypt your credentials and sessions. Telnet and HTTP transmit in plaintext and should be disabled on all production switches.

Summary of User & Access Control

Task	Command Example	Purpose
Create user	user <name> password plaintext <pwd> role	Role-based privilege assignment
Enable SSH	ip ssh, crypto key generate ssh	Secure remote CLI
Disable insecure protocols	no telnet, no http-server	Harden management plane
Use unique usernames	Per-person accountability	Audit and access tracking

II. Remote Management and Automation Tools

Aruba provides robust tools for centralized management, bulk configuration, and network automation, making large-scale operations efficient and scalable.

1. Aruba Central

Aruba Central is a cloud-based NMS (Network Management System) for Aruba wired and wireless environments.

Core Functions:

Feature	Description
Switch Monitoring	Real-time health, port status, traffic utilization
AI Insights	Root-cause detection for flapping links, high CPU, etc.
Firmware & Config Management	Schedule and push updates
Topology Mapping	Auto-discovers device interconnections
Role-Based Access	Custom admin roles and device-level privileges

Use Case:

• Multi-site deployments

• MSPs managing customer environments

• Auto-provisioning (ZTP) for new hardware

2. Aruba NetEdit (for CX Switches)

NetEdit is Aruba’s automation and validation platform for ArubaOS-CX environments.

Key Use Cases:

Function	Description
Batch config editing	Make changes across many switches at once
Validation before commit	Detect errors like duplicate IPs, broken syntax
Compliance auditing	Check that devices follow baseline configuration
Version control	Track and compare past config states

Ideal for change control and rollback in large environments.

3. REST APIs

All ArubaOS-CX switches support RESTful APIs, allowing programmable access to config and state data.

Common Use Cases:

• Automated provisioning (via Python or Ansible)

• CI/CD pipelines for network changes

• Real-time monitoring tools that query device state

API Access:

• ArubaOS-CX uses a Swagger-based API explorer

  • Access via HTTPS (port 443)

  • Auth required via token or session

Simple Python Example:

import requests
requests.get("https://10.1.1.1/rest/v10.04/system/interfaces")

Summary of Management Tools

Tool	Best For	ArubaOS / ArubaOS-CX
Aruba Central	Cloud-based monitoring, AI troubleshooting	All Aruba switches
NetEdit	Bulk config, validation, compliance (on-prem)	ArubaOS-CX only
REST API	Automation, CI/CD, external integration	ArubaOS-CX only

III. Configuration and File Management

Aruba switches use two main configuration types: active (running) and persistent (startup). Proper management of these files ensures stability, version control, and easy recovery.

1. Configuration Files

Types of Config:

Config Type	Location	Purpose
running-config	In RAM	Live configuration (temporary)
startup-config	In flash memory	Loaded on next reboot (persistent)

Commands to Save Changes:

• ArubaOS (legacy):

  write memory
  

• ArubaOS-CX:

  copy running-config startup-config
  

If you reboot without saving, changes are lost.

2. Backups and Restore

Regular configuration backups prevent data loss and reduce recovery time.

Backup to TFTP:

copy startup-config tftp 192.168.1.10 backup.cfg

Restore from TFTP:

copy tftp startup-config 192.168.1.10 restore.cfg

• Use running-config if you want to apply changes immediately.

3. Configuration Versioning (CX Only)

ArubaOS-CX maintains configuration checkpoints that allow:

• Rollbacks

• Auditing

• Comparison between snapshots

Common Commands:

show checkpoint
checkpoint name before_vlan_change
rollback checkpoint before_vlan_change

Useful for change control, especially in production environments.

Summary of Config and File Management

Task	Command Example	Notes
Save config	write memory or copy run start	Prevent loss on reboot
Backup config	copy startup-config tftp <IP> <file>	Save externally
Restore config	copy tftp startup-config <IP> <file>	Restore after failure
Use CX checkpoints	checkpoint, rollback checkpoint	Rollback to previous config states

IV. Monitoring and Health Checking

Day-to-day network operations rely heavily on proactive monitoring. Aruba switches provide both CLI-based tools and SNMP/log integration for real-time and historical visibility into device health.

1. Show Commands for Health Monitoring

Use these CLI commands regularly to verify performance and catch issues early.

a. Interface Status

show interface brief

• Lists link status, speed, and errors per port

b. VLAN Assignments

show vlan

• Confirms port-to-VLAN mappings

• Essential for troubleshooting communication issues

c. CPU & Memory Usage

show system resource-utilization

• Monitor:

  • CPU load

  • Memory usage

  • Buffer statistics

• Helps detect:

  • Memory leaks

  • High-load conditions

  • DoS attacks

d. Routing/OSPF Status

show ip route
show ospf

• Verifies:

  • Routing tables

  • Dynamic protocol neighbors

  • Route sources

2. Logging and Syslog

Store logs locally or remotely:

logging 192.168.1.100

• Sends syslog messages to a remote server

Adjust log severity:

logging level informational

Level	Use Case
debug	Detailed troubleshooting (temp only)
info	General monitoring
critical	Only major system issues

View logs:

show logging

• CLI view of recent events

3. SNMP Monitoring

SNMP allows external NMS tools to:

• Poll for status

• Receive alerts (traps)

• Visualize performance

Basic SNMPv2 Setup:

snmp-server community public ro
snmp-server host 192.168.1.50 version 2c public

ro = read-only access. Use a custom community string (not “public”) in production.

For secure environments — SNMPv3:

snmpv3 enable
snmpv3 user netops auth sha AuthPass123 priv aes PrivPass123

• Enables authentication and encryption

Summary of Monitoring & Health Checking

Task	Command / Tool	Purpose
Check port status	show interface brief	View real-time link/speed/errors
View CPU/memory usage	show system resource-utilization	Detect performance bottlenecks
View logs	show logging, logging level	See system events
Configure syslog	logging <IP>	Forward logs to SIEM or syslog server
Enable SNMP	snmp-server commands	Integrate with NMS tools (Central, etc.)

V. Time and Event Synchronization

Consistent timekeeping and event correlation are essential for accurate logging, security auditing, and event-driven automation. Aruba switches support NTP for clock sync and event-handlers for intelligent reactions.

1. NTP Configuration

NTP (Network Time Protocol) keeps the switch’s clock synchronized with a central time source — critical for:

• Aligning log entries across devices

• Authenticating certificates

• Tracking security events accurately

Configure NTP Server:

ntp server 192.168.0.1

• Server can be:

  • A local Windows domain controller

  • A firewall

  • An external server (e.g., time.google.com)

Verify Time Settings:

show time
show ntp

Command	Purpose
show time	Displays system time
show ntp	Shows NTP sync status and server info

Best Practices:

• Use redundant NTP servers

• Avoid relying on public servers in secured networks

• Always verify sync after power loss or firmware upgrade

2. Event Tracking (ArubaOS-CX Only)

Event-handlers allow CX switches to automatically respond to certain system events.

Use Cases:

• Interface down → send alert via syslog

• CPU spike → disable non-critical ports

• Failed login attempt → log to external SIEM

Example: Interface Down Alert

event-handler port-down
  event interface-down
  action syslog "ALERT: Interface went down"

Benefits:

• Automates incident notification

• Reduces mean time to resolution (MTTR)

• Enhances integration with monitoring platforms

Summary of Time & Event Sync

Task	Command Example	Purpose
Set NTP server	ntp server 192.168.0.1	Clock synchronization
View time/sync status	show time, show ntp	Verify accuracy
Define event handler (CX)	event-handler, event interface-down	Automate reactions to critical events
Use syslog + NTP together	logging, ntp	Align event timing across logs

VI. Port and Access Management

Day-to-day switch operation includes controlling which devices can connect, when, and how. Aruba switches offer powerful options for port-level control, authentication, and security enforcement.

1. Port Status Control

Control port availability to:

• Prevent unauthorized access

• Disable unused ports

• Manually bring up downed interfaces

Commands:

• Disable a port:

  interface 1/1/10
    shutdown
  

• Enable a port:

  interface 1/1/10
    no shutdown
  

• Add a description:

  description Connected to Finance-Printer
  

2. Port Security

Restricts which MAC addresses can use a specific port — a key defense against:

• Unauthorized devices

• MAC flooding attacks

Example:

interface 1/1/5
  port-security
  mac-address sticky
  port-security max-mac-count 1

• mac-address sticky: Learns and stores the first MAC that connects

• Limits that port to one device

3. Authentication Methods

Aruba supports user/device authentication through ClearPass or other RADIUS servers.

a. MAC Authentication:

• Used for non-interactive devices (printers, phones, IoT)

• Switch sends device MAC address to RADIUS

b. 802.1X Authentication:

• Used for user-based access (laptops, desktops)

• Requires:

  • Supplicant on client device

  • Authenticator on the switch

  • RADIUS server (e.g., ClearPass)

Configuration Example (802.1X):

aaa port-access authenticator
interface 1/1/2
  aaa port-access authenticator
  aaa port-access enable

4. Dynamic VLAN Assignment (Guest/Contractor Access)

Via ClearPass, authenticated users can be assigned to different VLANs based on:

• User group

• Time of day

• Device type

This enables automated role-based segmentation.

Summary of Port & Access Management

Task	Command / Feature	Purpose
Disable/enable port	shutdown, no shutdown	Control physical connectivity
Limit MACs per port	port-security, mac-address sticky	Prevent unauthorized device connections
Enable 802.1X	aaa port-access authenticator	Authenticate users via RADIUS
MAC authentication	Integrated with ClearPass	Identify non-user devices
Dynamic VLANs	Assigned by ClearPass policies	Segregate traffic by user/device type

VII. Software and Image Operations

Managing software images properly ensures safe upgrades, firmware consistency, and the ability to quickly roll back in case of failures. Aruba switches (especially ArubaOS-CX) provide robust image handling features.

1. Upgrade Operations

You can upgrade Aruba switch firmware using TFTP, SFTP, USB, or through Aruba Central.

Example – TFTP Upgrade:

copy tftp flash 192.168.1.10 CX_10_13_1010.swi

• 192.168.1.10 is your TFTP server

• File will be uploaded to flash memory

Verify Current Version:

show version

• Shows:

  • Current running image

  • Platform and OS version

  • Booted partition (primary/secondary

Reboot into New Image:

boot system flash primary
reload

This boots into the primary image (if it was the upgraded one).

2. Flash and Boot Management

Aruba switches support dual image slots: primary and secondary. This allows for rollback protection.

Benefits:

• Upload new firmware to the inactive slot

• Test the image by manually booting into it

• Roll back easily if something breaks

View Image Info:

show image

Set Boot Image:

boot system flash secondary

Summary of Software and Image Ops

Task	Command or Action	Purpose
Upgrade firmware (TFTP)	copy tftp flash <IP> <image.swi>	Upload new OS image to switch
View current version	show version	Confirm OS version and slot
Boot into image	`boot system flash <primary	secondary>`
Use dual image protection	Keep last-known-good in one slot	Roll back if the new version fails

VIII. Daily Admin Best Practices

Daily operations should prioritize security, stability, and recoverability. Following these habits helps prevent outages, reduces troubleshooting time, and enforces good governance in network administration.

1. Back Up Configurations Weekly or Before Changes

Why:

• Prevents loss of config due to errors, reboots, or upgrades.

• Ensures rapid recovery from hardware failure or misconfiguration.

Best Practice:

• Use a naming convention with timestamps:

copy startup-config tftp 192.168.1.10 accesssw-2025-05-22.cfg

2. Review Logs Daily or Use Central Alerts

Why:

• Detects early signs of failure or misbehavior (e.g., port flapping, CPU spikes).

• Identifies unauthorized access or rogue devices.

Options:

• CLI:

show logging

• Aruba Central:

  • Use AI Insights, email alerts, and automated notifications

3. Use Role-Based Access and Disable Unused Protocols

Secure Access Practices:

• Assign each admin their own user account:

user alice password plaintext S3cur3! manager

• Disable unused or insecure services:

no telnet
no http-server

• Enforce SSH/HTTPS-only for remote sessions

4. Schedule Firmware Upgrades During Maintenance Windows

Why:

• Avoids interrupting users during business hours.

• Allows for proper rollback if issues occur.

Best Practice:

• Stage firmware on secondary slot

• Plan upgrade windows with proper change control

• Verify post-upgrade status with:

show version
show system resource-utilization

5. Monitor Port Errors, CPU, and Memory

• Check interface counters regularly:

show interface 1/1/24

• Monitor for:

  • High CRC errors

  • Late collisions

  • Buffer drops

• Track system health with:

show system resource-utilization

Summary of Daily Best Practices

Best Practice	Command / Tool Example	Why It Matters
Back up configs weekly	copy startup-config tftp ...	Fast recovery from config loss
Monitor logs daily	show logging / Central alerts	Detect issues before outages
Use role-based access	`user role <manager	operator>`
Disable unused protocols	no telnet, no http-server	Minimize attack surface
Schedule firmware upgrades	boot system flash secondary, reload	Safe change control with rollback option
Monitor system and port health	show interfaces, show system resource-utilization	Proactive performance management

Manage, monitor, administer and operate Aruba solutions (Additional Content)

I. User Access and Session Auditing

View Current Logged-In Users

show users

• Displays all active CLI/SSH sessions on the device.

• Useful for auditing: checking for unauthorized access, stale sessions, or troubleshooting login issues.

• Especially important in multi-admin environments.

II. Remote Management and Automation Enhancements

1. REST API Authentication via Token

When using ArubaOS-CX REST APIs, it is strongly recommended to use token-based authentication rather than basic (plaintext) credentials.

Example REST Login Request:

POST /rest/v10.04/login HTTP/1.1
Host: <switch_ip>
Content-Type: application/json

{
  "username": "admin",
  "password": "MySecret"
}

• On success, the switch returns a session token.

• Subsequent API calls must include this token in the Cookie or X-Auth-Token header.

2. Aruba NetEdit – Scheduled Configuration Backups

• While NetEdit does not use CLI commands to back up configurations, it supports scheduled snapshots.

• This is ideal for compliance, change control, and disaster recovery.

III. Configuration Change Management

Compare Configuration Checkpoints

show checkpoint diff <checkpoint1> <checkpoint2>

• Displays line-by-line differences between two saved configurations.

• Crucial for auditing what was changed before/after a rollout or upgrade.

IV. Health Monitoring via Central and Local Tools

SNMP Trap and Event History in Aruba Central

• Aruba Central offers a GUI-based trap viewer and alert dashboard.

• You can filter events like:

  • Interface flapping

  • High CPU utilization

  • Authentication failures

Although not CLI-based, this is critical for operations teams monitoring multiple sites.

V. Time and Event Synchronization

1. Redundant NTP Configuration

ntp server 192.168.0.1
ntp server 192.168.0.2

• Configure at least two NTP sources to avoid clock drift.

• Ensures consistency across logs, alerts, and certificate validity.

2. Event-Handler Automation Extensions

Use event-handler not only for logging but to trigger actions such as:

• Sending SNMP traps

• Executing a webhook (HTTP POST to external tool)

• Initiating a custom script (advanced automation)

Example:

event-handler uplink-loss
  event interface-down
  action snmp-trap "uplink failed"

VI. Access Control and Authentication Troubleshooting

Show 802.1X or MAC Authenticated Clients

show port-access clients

• Lists authenticated devices, their MAC addresses, VLAN assignments, and roles.

• Helps verify whether clients were authenticated and provisioned as expected.

• Useful in environments using ClearPass or similar RADIUS backends.

VII. Software and Flash Operations

1. Verify Available Flash Memory

dir

• Ensures there is enough space for firmware uploads or config files.

• Avoid firmware upgrade failures due to insufficient flash.

2. Validate Boot Image Configuration

show boot

• Confirms which image (primary or secondary) is configured for the next boot.

• Should be verified before reloading to avoid booting into an old or corrupted image.

VIII. Admin Scripting and Automation

Configuration Backup Automation Example (Linux Script)

Using shell scripts or Python, create automated tasks to back up configs daily or weekly:

Shell Example (Linux Cron Job):

#!/bin/bash
TFTP_SERVER=192.168.1.100
SWITCH_IP=10.1.1.1
DATE=$(date +%F)
FILENAME="cx_backup_$DATE.cfg"

expect << EOF
spawn ssh admin@$SWITCH_IP
expect "Password:"
send "YourPassword\r"
expect "#"
send "copy startup-config tftp $TFTP_SERVER $FILENAME\r"
expect "#"
send "exit\r"
EOF

• Schedule with crontab -e

• Ensure TFTP server is reachable and authenticated properly.