HPE2-W09 Aruba Data Center Network Specialist Exam Questions and Answers

Aruba CX 6300 switches are an appropriate choice for leaf switches in a leaf-spine topology that uses Virtual Extensible LAN (VXLAN) with Ethernet VPN (EVPN) is a correct positioning of ArubaOS-CX switches in the data center.  The Aruba CX 6300 switches are designed for data center leaf roles, and they support advanced features such as VSX, EVPN, and PFC that enable high performance, scalability, and resiliency for data center networks 1

The exhibit shows a network topology where Switch-1 and Switch-2 are part of a Virtual Switching Extension (VSX) fabric, and the router runs OSPF on LAG 100, which is a Layer 3 LAG. The question asks how to control how core-to-access traffic is forwarded, which means how the router chooses between the two links to Switch-1 and Switch-2. To force the router to use both links, ensuring that active gateway is enabled on LAG 100 on both Switch-1 and Switch-2 is not the correct solution. Active gateway is a feature that allows both VSX members to act as the default gateway for downstream devices, using a common virtual MAC address.  Active gateway does not affect how upstream devices, such as the router, forward traffic to the VSX members 1 . To force the router to use both links, the correct solution is to configure equal-cost multi-path (ECMP) in OSPF on the router. ECMP is a feature that allows a router to load balance traffic across multiple paths with the same cost.  ECMP can be configured using the maximum-paths command and specifying how many equal-cost paths the router should use 2 . Therefore, this does not correctly explain how to control how core-to-access traffic is forwarded.

A Layer 3 VLAN interface is an interface that can be assigned an IP address and attached to a VRF. A VRF allows multiple instances of a routing table to co-exist within the same router.  By attaching a Layer 3 VLAN interface to a VRF, you can isolate the traffic of that VLAN from other VLANs and routing domains 1 2 . This can enhance security and performance of the network.

Deploy Aruba CX 83xx switches as data center spine switches is a best practice when positioning ArubaOS-CX switches in data center networks. The Aruba CX 83xx switches are designed for data center spine or core roles, and they provide high performance, scalability, and resiliency.  They can support various data center network architectures such as leaf-spine, three-tier, or collapsed core 1 .

ERPS is a feature of ArubaOS-CX that prevents loops at layer 2 on ring networks 1 .  ERPS uses a protocol called Ring Auto Protection Switching (RAPS) to detect link failures and perform fast traffic switchover 1 .  ERPS supports multiple rings and multiple instances per ring 1 .  Each instance has a control VLAN and one or more protected VLANs 1 .  The control VLAN carries the RAPS PDUs and must be unique per ring 1 .  The protected VLANs are the user traffic VLANs that are protected by ERPS and must be unique per instance 1 . Based on the exhibit, the design for the control and protected VLANs on the VSX fabric 1 switches is not valid.  The control VLAN 51 is used for both instances 1 and 2 on ring 1, which violates the rule that the control VLAN must be unique per ring 1 .  The protected VLANs 51-100 and 101-150 are also overlapping with the control VLAN 51, which violates the rule that the protected VLANs must be unique per instance 1 . Therefore, this is not a valid design for the control and protected VLANs on the VSX fabric 1 switches, and the correct answer is no.  For more information on ERPS and VLANs, refer to the Aruba Data Center Network Specialist (ADCNS) certification datasheet 2  and the ERPS Guide for your switch model 1 .

The exhibit shows a network topology where Switch-1 and Switch-2 are ArubaOS-CX switches that implement VXLAN without Ethernet VPN (EVPN). Switch-2 uses the same VNI-to-VLAN mappings as Switch-1. The question asks how the specified servers communicate, which means Server 1 and Server 4. Server 1 and Server 4 are in different VLANs and different VNIs, which means they are in different layer 2 segments. To communicate with each other, they require routing services between the VXLANs. However, using Virtual Routing and Forwarding (VRF) to tunnel iSCSI traffic through the network spine on the same links that data traffic uses is not the correct way to provide routing services. VRF is a technology that creates multiple isolated Layer 3 domains on a physical network, each with its own routing table. VRF does not provide any benefits for iSCSI traffic, as it does not guarantee bandwidth, priority, or quality of service.  VRF also adds overhead and complexity to the network configuration 1 . To provide routing services between the VXLANs, the correct way is to use VXLAN routing with EVPN or distributed anycast gateway (DAG).  VXLAN routing with EVPN allows the switches to exchange MAC and IP information using BGP EVPN control plane, and to perform routing between different VNIs using a centralized or distributed model 2 .  DAG allows the switches to act as anycast gateways for their local hosts, and to route traffic between different VNIs using a symmetric or asymmetric model 3 . Therefore, this does not correctly describe how the specified servers communicate.

Aruba CX 8325 switches are an appropriate choice for leaf switches in a leaf-spine topology that uses Virtual Extensible LAN (VXLAN) with Ethernet VPN (EVPN) is a correct positioning of ArubaOS-CX switches in the data center. The Aruba CX 8325 switches are designed for data center spine or core roles, but they can also be used as leaf switches in a VXLAN with EVPN scenario.  They support advanced features such as VSX, EVPN, and PFC that enable high performance, scalability, and resiliency for data center networks 1 .

Split-recovery mode is a feature of ArubaOS-CX that prevents traffic loss when the ISL goes out-of-sync and keepalive subsequently fails 1 2 . This can happen if the ISL is restored after a failure but the VSX nodes are not synchronized.  Split-recovery mode enables the secondary switch to restore its VSX LAGs after 10 keepalive packets are missed, approximately 10 seconds after keepalive goes down 2 .  This avoids a split brain situation where both switches act as primary and forward traffic independently, causing loops and duplicate packets 1 . Therefore, disabling split-recovery mode is not a use case for preventing split brain situations, and the correct answer is yes.  For more information on split-recovery mode and VSX, refer to the Aruba Data Center Network Specialist (ADCNS) certification datasheet 3  and the Virtual Switching Extension (VSX) Guide for your switch model 2 .

Implement Virtual Switching Extension (VSX) on pairs of ERPS switches at the same site. Then combine multiple links between two data centers into VSX LAGs (MC-LAGs) is not part of a valid strategy for load sharing traffic across the links in an Ethernet Ring Protection Switching (ERPS) ring. ERPS is a feature that provides loop prevention and fast convergence for Layer 2 networks that use ring topologies. VSX is a feature that provides active-active forwarding and redundancy for ArubaOS-CX switches. VSX LAGs or MC-LAGs are LAGs that span across two VSX nodes and provide load balancing and resiliency. However, VSX LAGs or MC-LAGs are not supported by ERPS because they can create loops in the ring topology.  A better way to load share traffic across the links in an ERPS ring would be to use link aggregation groups (LAGs) between two nodes in a ring as long as they are not multi-chassis LAGs (MC-LAGs) 1 .

Extending Layer 2 communications between data centers that connect over Layer 3 MPLS links is not a use case for deploying Ethernet Ring Protection Switching (ERPS). ERPS is a feature that provides loop prevention and fast convergence for Layer 2 networks that use ring topologies.  ERPS does not support extending Layer 2 communications over Layer 3 networks such as MPLS 1 .

VXLAN is a tunneling protocol that encapsulates layer 2 traffic over an IP network using VXLAN Network Identifiers (VNIs) to identify different layer 2 segments. VXLAN Tunnel Endpoints (VTEPs) are devices that perform the encapsulation and decapsulation of VXLAN packets. According to the exhibit, Switch-1 and Switch-2 are VTEPs that use VNI 10010 to map VLAN 10 traffic.  Therefore, when Switch-1 receives a frame with destination MAC address 00:50:56:00:00:03 and VLAN 10 tag on interface 1/1/1, it should encapsulate the frame with a VXLAN header that contains VNI 10010 and send it as a unicast packet to Switch-2’s loopback address (10.1.1.2) over the IP network 1 . Switch-1 should not switch the frame out interface 1/1/2 without VXLAN, as this would violate the VNI mapping and cause layer 2 loops. Therefore, this is not how the switch handles the traffic. https://networklessons.com/cisco/ccnp-encor-350-401/introduction-to-virtual-extensible-lan-vxlan

ISCSI is a protocol that allows storage devices to communicate over IP networks. ISCSI traffic has different requirements than data traffic, such as low latency, high throughput, and reliability. Therefore, it is not a best practice to send data and storage traffic on the same pair of 10GbE links, as this can cause congestion and performance degradation. It is also not a best practice to use Virtual Routing and Forwarding (VRF) to tunnel ISCSI traffic through the network spine on the same links that data traffic uses. VRF is a technology that creates multiple isolated Layer 3 domains on a physical network, each with its own routing table. VRF does not provide any benefits for ISCSI traffic, as it does not guarantee bandwidth, priority, or quality of service.  VRF also adds overhead and complexity to the network configuration 1 . Therefore, this is not a valid way to support the ISCSI requirements.

It enables the switch REST API interface, if disabled is not something that NetEdit 2.0 does after it discovers a switch. NetEdit 2.0 is a tool that provides configuration management and validation for ArubaOS-CX and ArubaOS-Switch devices. NetEdit 2.0 can discover switches using various methods such as IP range scan, LLDP scan, CSV import, etc.  However, NetEdit 2.0 cannot discover or communicate with switches that have their REST API interface disabled because NetEdit 2.0 relies on REST API calls to interact with switches 1 .

The solution is incorrect because enabling the REST interface in read-only mode is not a minimum requirement for setting up communications between the switch and NetEdit. NetEdit uses the REST interface to configure the switch, so it needs write access as well as read access. Therefore, enabling the REST interface in read-write mode is a minimum requirement for setting up communications between the switch and NetEdit.

Virtual Extensible LAN (VXLAN) enables multiple isolated Layer 3 domains, each with its own routing table, to share a physical network is not a way that a data center technology can help meet requirements for multi-tenancy. Multi-tenancy is the ability to provide logical separation and isolation of network resources for different tenants or customers on a shared physical infrastructure. VXLAN is a feature that provides Layer 2 extension over Layer 3 networks using UDP encapsulation.  VXLAN does not enable multiple isolated Layer 3 domains, but rather multiple isolated Layer 2 domains, each with its own VNI 1 .

The status is Protection, which means that the ring is up and fully connected with the RPL port blocked is what the specified status means for Ethernet Ring Protection Switching (ERPS) on an ArubaOS-CX switch. Protection is one of the possible statuses for an ERPS ring instance, and it indicates that the ring is operating normally with one port blocked to prevent loops.  The RPL port is the port that connects to the RPL node, which is responsible for blocking and unblocking traffic on the ring 2

A broadcast arrives in VLAN 10 on Switch-1. Switch 1 forwards the frame on all interfaces assigned to VLAN 10, except the incoming interface. It encapsulates the broadcast with VXLAN and sends it to 192.168.1.3, but not 192.168.1.2 is not a correct explanation of how the switch handles the traffic. Switch-1, Switch-2, and Switch-3 are ArubaOS-CX switches that use VXLAN and EVPN to provide Layer 2 extension over Layer 3 networks. VXLAN is a feature that uses UDP encapsulation to tunnel Layer 2 frames over Layer 3 networks using VNIs. EVPN is a feature that uses BGP to advertise multicast information for VXLAN networks using IMET routes. Switch-1 receives a broadcast in VLAN 10, which belongs to VNI 5010. Switch-1 forwards the frame on all interfaces assigned to VLAN 10, except the incoming interface, as per normal Layer 2 switching behavior. However, Switch-1 does not encapsulate the broadcast with VXLAN and send it only to 192.168.1.3, which is Switch-2’s loopback interface, but rather replicates the broadcast, encapsulates each broadcast with VXLAN, and sends the VXLAN traffic to both 192.168.1.2 and 192.168.1.3, which are Switch-3’s and Switch-2’s loopback interfaces respectively.

The show dcbx interface command shows the current DCBx status and the configuration of PFC, ETS, and application priority applied on the interface and the status of the TLVs received from the peer 1 . The Application Priority Map section shows the protocol, port/type and priority for both local and remote advertisements. Therefore, this is where you can see whether the connected converged network adapter (CNA) has accepted the application priorities advertised with DCBX. Reference: https://www.arubanetworks.com/techdocs/AOS-CX/AOSCX-CLI-Bank/cli_8400/Content/Chp_DCBx/DCBx_cmds/sho-dcb-int.htm

NetEdit is a network management tool that allows you to configure, monitor, and troubleshoot ArubaOS-CX switches. You can use NetEdit to deploy a standard config to the switches, but you need to use a different feature than conformance validation tests.  Conformance validation tests are used to check if the switches comply with a predefined set of rules or best practices, and to generate reports or alerts if any deviations are found 1 . They are not used to deploy configurations. To deploy a standard config that includes device-specific settings, you should use templates.  Templates are files that contain configuration commands with variables that can be replaced with device-specific values when applied to the switches 1 . Therefore, this is not what you should do.

Attach VNIs 5010 and 5020 to interface 1/1/3 on Switch-2 is not part of a valid configuration to meet the requirements for providing VXLAN services for several VMs and servers using ArubaOS-CX switches. VNIs are virtual network identifiers that are used to identify VXLAN segments.  A VNI can only be attached to a VLAN interface, not a physical interface, on an ArubaOS-CX switch 1 .

NetEdit 2.0 is a network management tool that allows you to configure, monitor, and troubleshoot ArubaOS-CX switches. NetEdit 2.0 can discover switches using different methods, such as IP range scan, LLDP neighbors, or manual entry. After it discovers a switch, NetEdit 2.0 does not enable SNMP on the switch, if disabled. SNMP is a protocol that allows NetEdit 2.0 to collect information and statistics from the switches, but it is not required for discovery or management.  NetEdit 2.0 can use other protocols, such as REST API or SSH, to communicate with the switches 1 . Therefore, this is not something that NetEdit 2.0 does after it discovers a switch.

Automated provisioning of LAGs between AHV and VSX is an operation supported when Aruba Fabric Composer (AFC) is integrated with Nutanix. AFC is a tool that provides automation and orchestration for managing data center networks composed of ArubaOS-CX switches. AFC can integrate with various data center software such as VMware vSphere, Nutanix AHV, Microsoft Hyper-V, etc. AFC can discover, monitor, and configure Nutanix AHV clusters and hosts using REST APIs.  AFC can also automate the provisioning of LAGs between AHV and VSX by creating VSX LAGs or MC-LAGs on the ArubaOS-CX switches and configuring the corresponding LAGs on the AHV hosts 1 .

Virtual Switching Extension (VSX) is a high-availability technology that allows two ArubaOS-CX switches to operate as a single logical device. Split-recovery mode is a feature that prevents traffic loss when the Inter-Switch Link (ISL) goes out-of-sync and keepalive subsequently fails. When split-recovery mode is enabled, the secondary VSX member disables its downstream links until it synchronizes with the primary member.  When split-recovery mode is disabled, the secondary VSX member keeps its downstream links up even when it is out-of-sync with the primary member 1 . Disabling split-recovery mode does not affect how the primary switch waits a period before it takes over as the primary switch after a failure and reboot. The primary switch always takes over as the primary switch immediately when it comes back online, regardless of the split-recovery mode setting.  To make the primary switch wait a period before it takes over as the primary switch, you need to configure a preemption delay on both VSX members 1 . Therefore, this is not a use case for disabling split-recovery mode on ArubaOS-CX switches in a VSX fabric.

Enhanced Transmission Selection (ETS) is a network scheduling algorithm that allows the switch to assign different priority and bandwidth values to different traffic classes 1 . This can be useful for transmitting traffic to servers that have different requirements for latency, jitter, or throughput. For example, ETS can prioritize voice or video traffic over data traffic, or allocate more bandwidth to backup or replication traffic.  ETS is configured using the Data Center Bridging Exchange (DCBx) protocol, which advertises the configuration to peer devices 2 . Therefore, implementing ETS on an ArubaOS-CX switch is a valid use case for enabling the switch to assign the correct priority and bandwidth to traffic that it transmits to servers.

Based on the exhibits, Switch-1 has a trunk port on 1/1/1 that allows VLANs 10 and 20. Switch-2 has an access port on 1/1/2 that belongs to VLAN 10. Switch-3 has an access port on 1/1/3 that belongs to VLAN 20. If a broadcast arrives with a VLAN 10 tag on 1/1/1 on Switch-1, Switch-1 does not drop the frame. Instead, Switch-1 forwards the frame to all ports that belong to VLAN 10, which includes the trunk port 1/1/2 and the access port 1/1/4. Switch-2 receives the frame on its access port 1/1/2 and forwards it to all ports in VLAN 10, which includes the access port 1/1/5. Switch-3 does not receive the frame because it is not in VLAN 10. Therefore, this is not how the switch handles the traffic, and the correct answer is no.

A physical interface using Layer 2 mode cannot be attached to a VRF on an ArubaOS-CX switch. A VRF is a virtual routing and forwarding instance that provides logical separation of routing tables on a switch.  A physical interface can only be attached to a VRF if it is using Layer 3 mode and has an IP address assigned to it 1 .

On Switch-1, set 192.168.1.3 as a peer IP address in the VNI 5020 context is part of the process for setting up VXLAN to meet the requirements of enabling servers to be part of the same VXLANs and VNIs as shown in the exhibit. Switch-1, Switch-2, and Switch-3 are ArubaOS-CX switches that use VXLAN to provide Layer 2 extension over Layer 3 networks without EVPN. VXLAN is a feature that uses UDP encapsulation to tunnel Layer 2 frames over Layer 3 networks using VNIs. To set up VXLAN without EVPN on Switch-1, you need to do the following steps:

Configure loopback interfaces with IP addresses on each switch

Configure VLAN interfaces with IP addresses on each switch

Configure VXLAN interfaces with VNIs on each switch

Configure peer IP addresses for each VNI on each switch

Configure static routes or dynamic routing protocols to enable reachability between loopback interfaces On Switch-1, setting 192.168.1.3 as a peer IP address in the VNI 5020 context means that Switch-1 can send and receive VXLAN traffic for VNI 5020 to and from Switch-2, which has the loopback interface with IP address 192.168.1.3.

Create a separate OSPF process for each VRF on Switch-1. Then redistribute each process into the other VRFs’ processes is not a valid strategy for meeting this goal of enabling devices in VRF B and VRF C to reach shared resources in VRF A. This strategy would create unnecessary complexity and overhead on Switch-1, and it would not guarantee optimal routing between the VRFs.  A better strategy would be to use inter-VRF routing or route leaking on Switch-1, which allows direct communication between different VRFs without requiring redistribution 1 .

In the Enhanced Transmission Selection (ETS) Local advertisement section is not where you can see whether the connected converged network adapter (CNA) has accepted the application priorities advertised with DCBX on an ArubaOS-CX switch interface. The ETS Local advertisement section shows the priority groups and bandwidth allocation that the switch advertises to the CNA, but it does not show whether the CNA has accepted them or not.  To see whether the CNA has accepted the application priorities advertised with DCBX, you need to look at the Application Priority Local advertisement section, which shows the application protocol identifier (APPID) and priority values that the switch advertises to the CNA, and compare them with the Application Priority Remote advertisement section, which shows the APPID and priority values that the CNA advertises to the switch 1 .

Place all three VRFs in the same OSPF process on Switch-1 is not a valid strategy for meeting this goal of enabling devices in VRF B and VRF C to reach shared resources in VRF A. This strategy would not work because OSPF does not support multiple VRFs in the same process on ArubaOS-CX switches.  Each VRF must have its own OSPF process with a unique process ID 1 .

A broadcast arrives in VLAN 10 on Switch-1. Switch 1 forwards the frame on all interfaces assigned to VLAN10, except the incoming interface. It replicates the broadcast, encapsulates each broadcast with VXLAN, and sends the VXLAN traffic to 192.168.1.2 and 192.168.1.3 is a correct explanation of how the switch handles the traffic. Switch-1, Switch-2, and Switch-3 are ArubaOS-CX switches that use VXLAN and EVPN to provide Layer 2 extension over Layer 3 networks. VXLAN is a feature that uses UDP encapsulation to tunnel Layer 2 frames over Layer 3 networks using VNIs. EVPN is a feature that uses BGP to advertise multicast information for VXLAN networks using IMET routes. Switch-1 receives a broadcast in VLAN 10, which belongs to VNI 5010. Switch-1 forwards the frame on all interfaces assigned to VLAN 10, except the incoming interface, as per normal Layer 2 switching behavior. Switch-1 replicates the broadcast, encapsulates each broadcast with VXLAN, and sends the VXLAN traffic to both 192.168.1.2 and 192.168.1.3, which are Switch-3’s and Switch-2’s loopback interfaces respectively.

Inside a configuration plan, right-click any device-specific parameters and modify the parameter per-device is what you should do if you want to use NetEdit to manage ArubaOS-CX switches and deploy a standard config to the switches, but need the config to include a few device-specific settings such as hostname and IP address.  This approach allows you to edit any parameter value for individual devices within a configuration plan without affecting other devices or creating separate plans 1 .

To reduce the amount of traffic sent over the ISL between Switch-1 and Switch-2, enable Equal Cost Multi Path (ECMP) on both Switch-1 and Switch-2 is not a correct explanation of how to control how core-to-access traffic is forwarded. Switch-1, Switch-2, and the router run OSPF on LAG 100, which is a Layer 3 LAG. ECMP is a feature that allows a router to load balance traffic destined to some network that is reachable through multiple equal cost route nexthops. Enabling ECMP on Switch-1 and Switch-2 would not reduce the amount of traffic sent over the ISL, but rather increase it by sending traffic over both links instead of one.  A better way to reduce the amount of traffic sent over the ISL would be to enable active forwarding on LAG 100 on both Switch-1 and Switch-2, which would make one link active and one link standby for each direction of traffic 1 .

It collects information about the switch hardware is something that NetEdit 2.0 does after it discovers a switch. NetEdit 2.0 is a tool that provides configuration management and validation for ArubaOS-CX and ArubaOS-Switch devices. NetEdit 2.0 can discover switches using various methods such as IP range scan, LLDP scan, CSV import, etc.  After NetEdit 2.0 discovers a switch, it collects information about the switch hardware such as model number, serial number, MAC address, firmware version, etc 1 .

You cannot leak multicast routes is a rule for the setup of multi-protocol BGP to implement dynamic VRF route leaking on an ArubaOS-CX switch.  Multi-protocol BGP only supports unicast routes for route leaking, and multicast routes are not leaked between VRFs 1 .