Aruba CX — 6100, 6200 and 6300

Configuration example for preparing a factory-default HPE Aruba Networking CX switch so that it works with PrivateLAN. Register the switch in PrivateLAN with type ArubaOS-CX.

This guide is written for ArubaOS-CX 10.09 and later on the campus access families:

ArubaOS-CX is not ArubaOS-Switch. If your switch answers to show running-config with untagged vlan and aaa port-access mac-based lines, it is a ProVision / ArubaOS-Switch model (2530, 2930) and belongs to type ArubaOS instead — a different guide and a different CLI.

Everything in this guide is entered once, on a factory-default switch, before you add it to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

The appliance only accepts syslog, RADIUS and time (NTP) traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

Choose a VRF before you start

This is the decision that shapes every other command in this guide, so make it first.

ArubaOS-CX separates the dedicated out-of-band management port (interface mgmt, in VRF mgmt) from the switching ports (VRF default). Almost every service — SSH, NTP, syslog, RADIUS, the web server — takes an explicit vrf argument, and a service configured in one VRF is simply not reachable from the other.

This guide uses in-band management on VRF default, because that is what most PrivateLAN installations use and because it matches how the same network's Cisco switches are reached. If you manage out of band, replace vrf default with vrf mgmt in every command below, and configure interface mgmt instead of the SVI in section 4.

1. Console access and host name

Connect to the console port at 9600 8N1, no flow control. A factory-default CX switch logs in as admin with no password and immediately asks you to set one. Set it and keep it — this is your way back in.

configure terminal
hostname SW-FLOOR1-01

2. The PrivateLAN account

user privatelan group administrators password plaintext ExampleSwitchPassword

The account must be in the administrators group. PrivateLAN's CX driver goes straight from the login prompt into configure terminal, so an operators or auditors account fails on the first command it runs.

ArubaOS-CX has no enable step, unlike Cisco IOS. Leave the Enable password field empty when you register the switch — the driver does not use it for this platform.

To keep the password out of the command history, omit plaintext and let the switch prompt for it instead:

user privatelan group administrators password

The built-in admin account cannot be deleted. Give it a strong password and treat it as the console-only break-glass account.

3. SSH

PrivateLAN connects over SSH only.

ssh server vrf default
no telnet-server vrf default
ssh maximum-auth-attempts 3

If you manage out of band, use ssh server vrf mgmt instead. Both can be enabled at the same time if you need both paths.

You do not need to disable paging on the switch. The driver sends no page itself on every session.

SSH with a key instead of a password

Optional. PrivateLAN can authenticate to a switch with an SSH private key instead of a password — you paste the private key on the switch's page, and PrivateLAN shows you the matching public key to install here.

ArubaOS-CX does not accept a public key typed into the configuration the way Cisco IOS does. The key is imported as a file, from a TFTP or SFTP server reachable in the same VRF as the management address, and associated with a local user:

copy tftp://192.168.10.9/privatelan.pub ssh-authorized-key privatelan vrf default
show ssh authorized-key privatelan

The exact spelling of this command changed between 10.x releases. Run copy ? on your own switch and use the form it offers rather than the one above. Password authentication is the straightforward path on CX and is what most PrivateLAN installations use.

Leave the local password configured as well. It stays available on the console, which is the only way back in if the key is ever removed.

4. Management VLAN and IP address

PrivateLAN reaches the switch on this address, and this is also the address you register as a RADIUS client.

vlan 10
    name MGMT
    exit
vlan 20
    name DATA
    exit
!
interface vlan 10
    description Management
    ip address 192.168.10.21/24
    no shutdown
    exit
!
ip route 0.0.0.0/0 192.168.10.1

ArubaOS-CX takes an address in CIDR notation, not as a dotted subnet mask. PrivateLAN converts automatically when it programs a VLAN, but you type it in CIDR form here.

The uplink has to carry the management VLAN:

interface 1/1/48
    description UPLINK
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 10,20
    lldp transmit
    lldp receive
    exit

lldp transmit and lldp receive are the default on every port; they are written out here because a port that was a device port before keeps the no lldp transmit of its template. On a link between two switches LLDP has to run in both directions: Reports > Interconnects draws the links between your switches from the LLDP neighbours of the ports tagged [TRUNK].

no routing is required before a physical port will accept vlan trunk or vlan access commands: CX ports are routed interfaces by default, the opposite of Cisco's default.

PrivateLAN never removes the management VLAN from a switch. Programming VLANs removes the VLANs on the switch that its switch group does not list, but it keeps VLAN 1, the VLAN the switch's own management address is on, and every VLAN marked as Management VLAN in PrivateLAN. Add the management VLAN in PrivateLAN and mark it, so it is also kept on a switch whose configuration PrivateLAN has not read yet. Assign it to the switch group only if PrivateLAN should program it like any other VLAN, for example add it to new [TRUNK] ports.

Note the interface naming: member/slot/port, so 1/1/48. Use exactly that form when you enter the interface list in PrivateLAN, for example 1/1/1-1/1/48, and for a VSF stack 1/1/1-1/1/24, 2/1/1-2/1/24.

More than 1000 VLANs

ArubaOS-CX has no equivalent of Cisco's normal and extended VLAN ranges, and no VTP. Ids 1 to 4094 are all usable straight away, and nothing has to be enabled first — vlan 2000 works on a factory-default switch.

What does apply is a per-platform ceiling on how many VLANs can exist at once, and on the campus access models that number is well below 4094. It is a hardware and image property, not a setting, so there is nothing to configure if you run into it — the model decides.

show capacities vlan

Run that on the switch itself rather than working from a datasheet: it reports the supported maximum for exactly this model and software version. show capacities-status vlan adds how much of it is currently in use, which is the number to watch if PrivateLAN manages a large VLAN set across a switch group.

5. Passwords in the running configuration

ArubaOS-CX does not store user passwords in the clear — user ... password plaintext is how you enter one, and the running configuration shows a hash. Nothing extra is needed for accounts.

The RADIUS shared secret is different, because the switch has to be able to read it back. Enter it with the plaintext keyword (section 6) and the running configuration stores it as ciphertext. You can confirm this with show running-config — the line comes back as key ciphertext ... rather than the value you typed.

plaintext describes the value you are typing, not how it will be stored. There is no separate command to turn encryption on, and no equivalent of Cisco's reversible type 7 to avoid.

When a switch configuration leaves the appliance — for example through a QR Support report — PrivateLAN strips RADIUS keys, SNMP community strings and similar credential lines before it is encoded, so those never travel with the report.

6. Time and time zone

clock timezone europe/amsterdam
!
ntp server 192.168.10.5 iburst
ntp vrf default
ntp enable

Point the switch at the appliance's own address. The PrivateLAN appliance passes on the time it gets from the time server under System > Networking (an NTP relay), so the switch needs neither internet nor DNS, and its log times line up with the appliance's. The appliance answers only on eth0, only to RFC 1918 addresses, and limits how often one address may ask; a switch asks far less often than that. An appliance that has no time itself says so, and the switch waits instead of taking a wrong time.

The VRF the NTP client uses is selected separately from the server list, and the keyword differs slightly between 10.x releases — check ntp ? on your switch if the line above is rejected.

Verify with show ntp status and show ntp associations. PrivateLAN's Inspection > Compliance page checks the ntp server line and accepts either the appliance's own addresses or the time server the appliance is configured with.

If you point the switch at another time server by host name, it needs a resolver:

ip dns server-address 192.168.10.1 vrf default

7. Sending syslog to the appliance

logging 192.168.10.5 udp 514 vrf default severity info

Severity info matches what the appliance's syslog view expects to receive. Raise it to warning if a switch is noisy — the appliance rate-limits syslog per sending device, and more than roughly 200 UDP messages per second from one source are dropped so that one switch cannot drown out the rest of the fleet. A switch being limited shows up on the dashboard's syslog flood protection tile.

With the SOC license option, syslog also makes the port alarms of the SOC live view faster: when the switch logs a link change (Link status for interface 1/1/1 is down), the appliance reads the switch again straight away, so an uplink that goes down shows up as an alarm within about two minutes instead of at the next five-minute poll. The log line itself never raises an alarm; the fresh reading of the switch does. Whether these link messages still get through at warning depends on the severity the switch gives them; if they are filtered out, the port alarms still appear, but only at the regular poll. After raising the severity, unplug a test port and check that its message still arrives in the appliance's syslog view.

Verify with show logging -r, and check that entries arrive under the appliance's syslog view. Inspection > Compliance reports this line as Logging host, and only counts it as a match when it points at this appliance.

8. RADIUS and port-based authentication

This is what makes MAB, PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

radius-server host 192.168.10.5 key plaintext ExampleSharedSecret vrf default
!
aaa group server radius PRIVATELAN
    server 192.168.10.5 vrf default
    exit
!
aaa authentication port-access dot1x authenticator
    radius server-group PRIVATELAN
    enable
    exit
!
aaa authentication port-access mac-auth
    radius server-group PRIVATELAN
    enable
    exit

The block structure above is what ArubaOS-CX 10.09 and later use. Earlier 10.x releases spell parts of the aaa authentication port-access hierarchy differently, so if a line is rejected, walk the context with ? rather than assuming the whole approach is wrong — the model is the same in every release, only the wording moved.

The two aaa authentication port-access blocks enable each method globally. PrivateLAN then enables or disables them per port when it programs a device — you will see aaa authentication port-access dot1x authenticator enable and its mac-auth counterpart appear inside the interface. A method that is not enabled globally cannot be enabled on a port, so both blocks are needed even if you only use one method today.

ArubaOS-CX applies the VLAN returned in the RADIUS reply (Tunnel-Private-Group-ID) natively for port-access; no extra authorization command is required, unlike Cisco IOS.

MAC address format for MAC authentication

PrivateLAN stores a MAB device's RADIUS username and password as the MAC address in twelve lowercase hexadecimal characters with no separators — 00155d5a6500. The RADIUS server matches that string exactly, so a switch that sends 00:15:5d:5a:65:00 or 0015-5D5A-6500 is rejected even though the device is registered correctly.

Check what actually arrives under 802.1x / RADIUS on the appliance, where recent authentication events show the user name the switch sent. If the format does not match, adjust it under aaa authentication port-access mac-auth — the available sub-commands differ per release, so use ? to see which ones your switch offers.

Port configuration is pushed by PrivateLAN

You do not configure port-access on individual ports. PrivateLAN writes it when it programs a device onto a port, from the templates under Devices > Device groups. For a MAC-authenticated port it sends this:

interface 1/1/12
    shutdown
    description PRINTER-01
    vlan access 20
    no port-access port-security
    aaa authentication port-access auth-mode client-mode
    no aaa authentication port-access client-limit
    aaa authentication port-access mac-auth enable
    aaa authentication port-access dot1x authenticator disable
    aaa authentication port-access auth-precedence mac-auth dot1x
    no lldp transmit
    lldp receive
    no spanning-tree bpdu-filter
    spanning-tree bpdu-guard
    spanning-tree port-type admin-edge
    no shutdown

CX keeps every port setting until a command removes it, so each template first switches off what a previous device may have left on the port: port security with its MAC addresses, a client limit, the authentication mode, and BPDU filter. Only then does it configure its own method. The switch writes the result back in its own form: settings at their default value are left out, and mac-auth enable appears as aaa authentication port-access mac-auth with enable indented under it. Inspection > Compliance reads both forms.

After programming a device, Inspection > Compliance shows what PrivateLAN intended against what the switch actually has. The programming result also lists every command the switch refused, with the switch's own message, under The switch refused. Compliance remains the check for what that list cannot show: a setting the switch accepted but stored differently, or a refusal worded in a way PrivateLAN does not recognise.

One device or several per port: the client limit

ArubaOS-CX authenticates every device (every MAC address) on a port separately, and each one gets its own result and its own VLAN. What you choose per device group is how many devices may authenticate on one port: the client limit, in the templates under Devices > Device groups.

When an access point puts the traffic of its wireless devices on the port itself, all their MAC addresses appear on that port, and each of them has to authenticate on its own. The CX counterpart of Cisco's multi-host is aaa authentication port-access auth-mode device-mode: the access point authenticates, after which the devices behind it may use the port. When that is acceptable is described in the Cisco guide under "Access points". In the access point's own device group, replace aaa authentication port-access auth-mode client-mode in the PEAP or EAP-TLS template by aaa authentication port-access auth-mode device-mode. Check the keyword with ? on your switch. The PrivateLAN templates set client mode themselves, so a port that later gets an ordinary device no longer lets everything behind it in.

For a port that must carry several devices, replace no aaa authentication port-access client-limit in the interface part of the device group's MAB, PEAP or EAP-TLS template by this line:

aaa authentication port-access client-limit #max-mac#

#max-mac# is filled in per port with the number of MAC addresses of the device and its virtual devices. The keyword and its range differ slightly per release, so check them with ? on your switch first.

Do not confuse this with port-access port-security client-limit in the MAC-address template. That is port security for a port without authentication, and has no effect on how many devices may authenticate.

9. Spanning tree

Spanning tree is disabled by default on ArubaOS-CX. This is the single biggest difference from a Cisco switch out of the box, and it is not obvious: the switch forwards happily until the day someone patches two access ports together. Enable it before the switch goes into production.

spanning-tree mode mstp
spanning-tree config-name PRIVATELAN
spanning-tree config-revision 1
spanning-tree instance 1 vlan 10,20
spanning-tree

spanning-tree on its own is the command that enables it globally. Confirm with show spanning-tree — an unconfigured switch answers that spanning tree is disabled.

Set the root bridge deliberately, on the switch that should be root:

spanning-tree priority 4

CX takes a priority multiplier from 0 to 15, not Cisco's 0 to 61440. spanning-tree priority 4 means 4 x 4096 = 16384. Entering 24576 here is rejected, and entering 8 gives you a far higher priority than you probably intended.

The device templates apply spanning-tree bpdu-guard and spanning-tree port-type admin-edge per port, which is the CX equivalent of Cisco's PortFast plus BPDU guard. They do not filter BPDUs, and they remove spanning-tree bpdu-filter from a port that still has it from an earlier version of the templates: with BPDU filter on, the port ignores BPDUs and BPDU guard never sees a switch there. The default configuration of a free port (VLAN > Defaults) does the same.

BPDU guard shuts the port down, and by default it stays down until someone enables it again. Let the switch bring it back by itself after five minutes; if the switch on the port is still there, BPDU guard shuts the port down again straight away:

spanning-tree bpdu-guard timeout 300

Inspection > Compliance shows under Switch settings whether this is configured (BPDU guard recovery).

10. LLDP

LLDP is enabled by default on ArubaOS-CX. Confirm rather than configure:

show lldp configuration

If it has been turned off, re-enable it:

lldp

PrivateLAN reads show lldp neighbor-info detail to fill the LLDP neighbour column on the interface overview, so this needs to stay on. The port templates set no lldp transmit and lldp receive on device ports, so the switch still learns what is connected but does not advertise itself to end devices.

11. Layer 3 — routing and SVIs

ArubaOS-CX routes by default: an SVI with an IP address is a routed interface, and there is no global ip routing command to enable first.

Set PrivateLAN's routing mode to SVI for CX switches. PrivateLAN offers SVI, HSRP and VRRP under VLANs, but the CX driver only programs plain SVIs. HSRP has never existed on Aruba hardware, and VRRP is not available on the CX 6100. Selecting HSRP or VRRP does not fail loudly — the VLAN simply is not programmed with a gateway. If you need a redundant gateway on CX, configure it outside PrivateLAN, on the core.

PrivateLAN writes the SVI itself when you program a VLAN:

interface vlan 20
    description Data
    ip address 192.168.20.1/24
    no shutdown

What you configure by hand is only the management SVI from section 4 and the default route.

12. Third-party transceivers

CX switches disable an SFP they do not recognise. If you use third-party or coloured optics:

allow-unsupported-transceiver

The switch asks for confirmation and warns that unsupported optics are not covered by support. Confirm, save the configuration, and bounce the port. Verify with show interface transceiver detail.

13. Turning off the web interface

PrivateLAN manages the switch entirely over SSH — it does not use the CX web UI and it does not use the REST API.

no https-server vrf default

If you want to keep the web UI for occasional manual work, restrict it to the out-of-band management network instead of removing it entirely:

https-server vrf mgmt

Check what is actually listening with show https-server. The same applies to the REST API, which shares the https-server configuration — turning off the server on a VRF takes both with it.

14. Save and register in PrivateLAN

end
write memory

Then, in the appliance:

• Switches > Add — host name, management IP address 192.168.10.21, SSH port 22, type ArubaOS-CX, user name privatelan and the switch password. Leave the enable password empty. Choose the switch group and enter the interface ranges in 1/1/1-1/1/48 form.
• 802.1x / RADIUS > Clients — add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Inspection > Compliance — run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

For a VSF stack on a 6200 or 6300, add the stack once, on its shared management address. PrivateLAN detects the stack and lists each member's model, serial number, firmware, uptime, CPU and temperature underneath it.

DHCP snooping (optional)

PrivateLAN reads the switch's DHCP snooping table to find out the address of any device you registered with a Dynamic address instead of a fixed one, and to find the address of wireless clients behind an access point. Without snooping those devices simply report that no address is known — nothing else stops working, so enable it only if you use that.

dhcpv4-snooping
!
vlan 10,20,30
    dhcpv4-snooping
!
interface 1/1/48
    description Uplink
    dhcpv4-snooping trust

Enable it per VLAN as well as globally — the global command on its own records nothing.

Two things decide whether this works at all:

• Every port towards your DHCP server must be trusted. That is the uplink, and any port towards another switch on the way to the server. A port left untrusted drops the server's replies and the devices behind it stop getting addresses — so set the trusted ports in the same change that enables snooping, not afterwards.
• Snooping must be enabled on the VLANs the devices are in. A VLAN it is not enabled on produces no bindings, so those devices keep reporting that no address is known. PrivateLAN does not do this for you: a VLAN it programs onto the switch, or a device group that puts a device in another VLAN, does not get snooping. Add it on the switch for every VLAN that holds devices with a Dynamic address, also for a VLAN added later:

  vlan 1080
      dhcpv4-snooping

show dhcpv4-snooping lists the VLANs it is on under Enabled VLANs.

Check the result on the switch itself:

show dhcpv4-snooping
show dhcpv4-snooping binding

The binding table does not survive a restart of the switch unless you tell the switch to save it. Without that, PrivateLAN reports that no address is known for a dynamic device until each lease is renewed:

dhcpv4-snooping external-storage <url>

Complete example configuration

Everything above in one block, for a CX 6100 acting as a layer 2 access switch with in-band management. Change every value from the table at the top.

configure terminal
!
hostname SW-FLOOR1-01
!
user privatelan group administrators password plaintext ExampleSwitchPassword
!
ssh server vrf default
no telnet-server vrf default
ssh maximum-auth-attempts 3
!
vlan 10
    name MGMT
    exit
vlan 20
    name DATA
    exit
!
interface vlan 10
    description Management
    ip address 192.168.10.21/24
    no shutdown
    exit
!
ip route 0.0.0.0/0 192.168.10.1
!
interface 1/1/48
    description UPLINK
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 10,20
    lldp transmit
    lldp receive
    exit
!
clock timezone europe/amsterdam
ntp server 192.168.10.5 iburst
ntp vrf default
ntp enable
!
logging 192.168.10.5 udp 514 vrf default severity info
!
radius-server host 192.168.10.5 key plaintext ExampleSharedSecret vrf default
aaa group server radius PRIVATELAN
    server 192.168.10.5 vrf default
    exit
aaa authentication port-access dot1x authenticator
    radius server-group PRIVATELAN
    enable
    exit
aaa authentication port-access mac-auth
    radius server-group PRIVATELAN
    enable
    exit
!
spanning-tree mode mstp
spanning-tree config-name PRIVATELAN
spanning-tree config-revision 1
spanning-tree instance 1 vlan 10,20
spanning-tree
!
allow-unsupported-transceiver
!
no https-server vrf default
!
end
write memory

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates