Aruba CX — 6100, 6200 and 6300

Configuration example for preparing a factory-default HPE Aruba Networking CX switch so that it works with PrivateLAN. Register the switch in PrivateLAN with type ArubaOS-CX.

This guide is written for ArubaOS-CX 10.09 and later on the campus access families:

ArubaOS-CX is not ArubaOS-Switch. If your switch answers to show running-config with untagged vlan and aaa port-access mac-based lines, it is a ProVision / ArubaOS-Switch model (2530, 2930) and belongs to type ArubaOS instead — a different guide and a different CLI.

Everything in this guide is entered once, on a factory-default switch, before you add it to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

The appliance only accepts syslog and RADIUS traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

Choose a VRF before you start

This is the decision that shapes every other command in this guide, so make it first.

ArubaOS-CX separates the dedicated out-of-band management port (interface mgmt, in VRF mgmt) from the switching ports (VRF default). Almost every service — SSH, NTP, syslog, RADIUS, the web server — takes an explicit vrf argument, and a service configured in one VRF is simply not reachable from the other.

This guide uses in-band management on VRF default, because that is what most PrivateLAN installations use and because it matches how the same network's Cisco switches are reached. If you manage out of band, replace vrf default with vrf mgmt in every command below, and configure interface mgmt instead of the SVI in section 4.

1. Console access and host name

Connect to the console port at 9600 8N1, no flow control. A factory-default CX switch logs in as admin with no password and immediately asks you to set one. Set it and keep it — this is your way back in.

configure terminal
hostname SW-FLOOR1-01

2. The PrivateLAN account

user privatelan group administrators password plaintext ExampleSwitchPassword

The account must be in the administrators group. PrivateLAN's CX driver goes straight from the login prompt into configure terminal, so an operators or auditors account fails on the first command it runs.

ArubaOS-CX has no enable step, unlike Cisco IOS. Leave the Enable password field empty when you register the switch — the driver does not use it for this platform.

To keep the password out of the command history, omit plaintext and let the switch prompt for it instead:

user privatelan group administrators password

The built-in admin account cannot be deleted. Give it a strong password and treat it as the console-only break-glass account.

3. SSH

PrivateLAN connects over SSH only.

ssh server vrf default
no telnet-server vrf default
ssh maximum-auth-attempts 3

If you manage out of band, use ssh server vrf mgmt instead. Both can be enabled at the same time if you need both paths.

You do not need to disable paging on the switch. The driver sends no page itself on every session.

SSH with a key instead of a password

Optional. PrivateLAN can authenticate to a switch with an SSH private key instead of a password — you paste the private key on the switch's page, and PrivateLAN shows you the matching public key to install here.

ArubaOS-CX does not accept a public key typed into the configuration the way Cisco IOS does. The key is imported as a file, from a TFTP or SFTP server reachable in the same VRF as the management address, and associated with a local user:

copy tftp://192.168.10.9/privatelan.pub ssh-authorized-key privatelan vrf default
show ssh authorized-key privatelan

The exact spelling of this command changed between 10.x releases. Run copy ? on your own switch and use the form it offers rather than the one above. Password authentication is the straightforward path on CX and is what most PrivateLAN installations use.

Leave the local password configured as well. It stays available on the console, which is the only way back in if the key is ever removed.

4. Management VLAN and IP address

PrivateLAN reaches the switch on this address, and this is also the address you register as a RADIUS client.

vlan 10
    name MGMT
    exit
vlan 20
    name DATA
    exit
!
interface vlan 10
    description Management
    ip address 192.168.10.21/24
    no shutdown
    exit
!
ip route 0.0.0.0/0 192.168.10.1

ArubaOS-CX takes an address in CIDR notation, not as a dotted subnet mask. PrivateLAN converts automatically when it programs a VLAN, but you type it in CIDR form here.

The uplink has to carry the management VLAN:

interface 1/1/48
    description UPLINK
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 10,20
    exit

no routing is required before a physical port will accept vlan trunk or vlan access commands: CX ports are routed interfaces by default, the opposite of Cisco's default.

Keep the management VLAN out of any VLAN set that PrivateLAN programs onto this switch unless you mean to manage it there. When PrivateLAN removes a VLAN from a switch group it issues no vlan <id> on every member switch — including, if you have configured it that way, the VLAN its own management session is running over.

Note the interface naming: member/slot/port, so 1/1/48. Use exactly that form when you enter the interface list in PrivateLAN, for example 1/1/1-1/1/48, and for a VSF stack 1/1/1-1/1/24, 2/1/1-2/1/24.

More than 1000 VLANs

ArubaOS-CX has no equivalent of Cisco's normal and extended VLAN ranges, and no VTP. Ids 1 to 4094 are all usable straight away, and nothing has to be enabled first — vlan 2000 works on a factory-default switch.

What does apply is a per-platform ceiling on how many VLANs can exist at once, and on the campus access models that number is well below 4094. It is a hardware and image property, not a setting, so there is nothing to configure if you run into it — the model decides.

show capacities vlan

Run that on the switch itself rather than working from a datasheet: it reports the supported maximum for exactly this model and software version. show capacities-status vlan adds how much of it is currently in use, which is the number to watch if PrivateLAN manages a large VLAN set across a switch group.

5. Passwords in the running configuration

ArubaOS-CX does not store user passwords in the clear — user ... password plaintext is how you enter one, and the running configuration shows a hash. Nothing extra is needed for accounts.

The RADIUS shared secret is different, because the switch has to be able to read it back. Enter it with the plaintext keyword (section 6) and the running configuration stores it as ciphertext. You can confirm this with show running-config — the line comes back as key ciphertext ... rather than the value you typed.

plaintext describes the value you are typing, not how it will be stored. There is no separate command to turn encryption on, and no equivalent of Cisco's reversible type 7 to avoid.

When a switch configuration leaves the appliance — for example through a QR Support report — PrivateLAN strips RADIUS keys, SNMP community strings and similar credential lines before it is encoded, so those never travel with the report.

6. Time and time zone

clock timezone europe/amsterdam
!
ntp server nl.pool.ntp.org iburst
ntp vrf default
ntp enable

Point the switch at the same time server the appliance uses, not at the appliance. The PrivateLAN appliance is an NTP client; it does not run an NTP server. You can see which server it uses under System > Networking. Pointing a switch at the appliance produces a switch that silently never syncs.

The VRF the NTP client uses is selected separately from the server list, and the keyword differs slightly between 10.x releases — check ntp ? on your switch if the line above is rejected.

Verify with show ntp status and show ntp associations. PrivateLAN's Reports > Configuration compliance page checks the ntp server line and accepts either the appliance's own addresses or the time server the appliance is configured with.

If you use a host name rather than an IP address, the switch needs a resolver:

ip dns server-address 192.168.10.1 vrf default

7. Sending syslog to the appliance

logging 192.168.10.5 udp 514 vrf default severity info

Severity info matches what the appliance's syslog view expects to receive. Raise it to warning if a switch is noisy — the appliance rate-limits syslog per sending device, and more than roughly 200 UDP messages per second from one source are dropped so that one switch cannot drown out the rest of the fleet. A switch being limited shows up on the dashboard's syslog flood protection tile.

Verify with show logging -r, and check that entries arrive under the appliance's syslog view. Reports > Configuration compliance reports this line as Logging host, and only counts it as a match when it points at this appliance.

8. RADIUS and port-based authentication

This is what makes MAB, PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

radius-server host 192.168.10.5 key plaintext ExampleSharedSecret vrf default
!
aaa group server radius PRIVATELAN
    server 192.168.10.5 vrf default
    exit
!
aaa authentication port-access dot1x authenticator
    radius server-group PRIVATELAN
    enable
    exit
!
aaa authentication port-access mac-auth
    radius server-group PRIVATELAN
    enable
    exit

The block structure above is what ArubaOS-CX 10.09 and later use. Earlier 10.x releases spell parts of the aaa authentication port-access hierarchy differently, so if a line is rejected, walk the context with ? rather than assuming the whole approach is wrong — the model is the same in every release, only the wording moved.

The two aaa authentication port-access blocks enable each method globally. PrivateLAN then enables or disables them per port when it programs a device — you will see aaa authentication port-access dot1x authenticator enable and its mac-auth counterpart appear inside the interface. A method that is not enabled globally cannot be enabled on a port, so both blocks are needed even if you only use one method today.

ArubaOS-CX applies the VLAN returned in the RADIUS reply (Tunnel-Private-Group-ID) natively for port-access; no extra authorization command is required, unlike Cisco IOS.

MAC address format for MAC authentication

PrivateLAN stores a MAB device's RADIUS username and password as the MAC address in twelve lowercase hexadecimal characters with no separators — 00155d5a6500. The RADIUS server matches that string exactly, so a switch that sends 00:15:5d:5a:65:00 or 0015-5D5A-6500 is rejected even though the device is registered correctly.

Check what actually arrives under 802.1x / RADIUS on the appliance, where recent authentication events show the user name the switch sent. If the format does not match, adjust it under aaa authentication port-access mac-auth — the available sub-commands differ per release, so use ? to see which ones your switch offers.

Port configuration is pushed by PrivateLAN

You do not configure port-access on individual ports. PrivateLAN writes it when it programs a device onto a port, from the templates under Devices > Device groups. A MAC-authenticated port ends up looking like this:

interface 1/1/12
    description PRINTER-01
    vlan access 20
    aaa authentication port-access mac-auth enable
    aaa authentication port-access dot1x authenticator disable
    aaa authentication port-access auth-precedence mac-auth dot1x
    no lldp transmit
    lldp receive
    spanning-tree bpdu-guard
    spanning-tree port-type admin-edge
    no shutdown

After programming a device, Reports > Configuration compliance shows what PrivateLAN intended against what the switch actually has. That report is the reliable way to catch a rejected command, because the switch does not report one back over SSH in a form the driver can distinguish from a normal prompt.

9. Spanning tree

Spanning tree is disabled by default on ArubaOS-CX. This is the single biggest difference from a Cisco switch out of the box, and it is not obvious: the switch forwards happily until the day someone patches two access ports together. Enable it before the switch goes into production.

spanning-tree mode mstp
spanning-tree config-name PRIVATELAN
spanning-tree config-revision 1
spanning-tree instance 1 vlan 10,20
spanning-tree

spanning-tree on its own is the command that enables it globally. Confirm with show spanning-tree — an unconfigured switch answers that spanning tree is disabled.

Set the root bridge deliberately, on the switch that should be root:

spanning-tree priority 4

CX takes a priority multiplier from 0 to 15, not Cisco's 0 to 61440. spanning-tree priority 4 means 4 x 4096 = 16384. Entering 24576 here is rejected, and entering 8 gives you a far higher priority than you probably intended.

The device templates apply spanning-tree bpdu-guard and spanning-tree port-type admin-edge per port, which is the CX equivalent of Cisco's PortFast plus BPDU guard. Unlike the Cisco templates, they do not filter BPDUs, so BPDU guard genuinely protects those ports.

10. LLDP

LLDP is enabled by default on ArubaOS-CX. Confirm rather than configure:

show lldp configuration

If it has been turned off, re-enable it:

lldp

PrivateLAN reads show lldp neighbor-info detail to fill the LLDP neighbour column on the interface overview, so this needs to stay on. The port templates set no lldp transmit and lldp receive on device ports, so the switch still learns what is connected but does not advertise itself to end devices.

11. Layer 3 — routing and SVIs

ArubaOS-CX routes by default: an SVI with an IP address is a routed interface, and there is no global ip routing command to enable first.

Set PrivateLAN's routing mode to SVI for CX switches. PrivateLAN offers SVI, HSRP and VRRP under VLANs, but the CX driver only programs plain SVIs. HSRP has never existed on Aruba hardware, and VRRP is not available on the CX 6100. Selecting HSRP or VRRP does not fail loudly — the VLAN simply is not programmed with a gateway. If you need a redundant gateway on CX, configure it outside PrivateLAN, on the core.

PrivateLAN writes the SVI itself when you program a VLAN:

interface vlan 20
    description Data
    ip address 192.168.20.1/24
    no shutdown

What you configure by hand is only the management SVI from section 4 and the default route.

12. Third-party transceivers

CX switches disable an SFP they do not recognise. If you use third-party or coloured optics:

allow-unsupported-transceiver

The switch asks for confirmation and warns that unsupported optics are not covered by support. Confirm, save the configuration, and bounce the port. Verify with show interface transceiver detail.

13. Turning off the web interface

PrivateLAN manages the switch entirely over SSH — it does not use the CX web UI and it does not use the REST API.

no https-server vrf default

If you want to keep the web UI for occasional manual work, restrict it to the out-of-band management network instead of removing it entirely:

https-server vrf mgmt

Check what is actually listening with show https-server. The same applies to the REST API, which shares the https-server configuration — turning off the server on a VRF takes both with it.

14. Save and register in PrivateLAN

end
write memory

Then, in the appliance:

• Switches > Add — host name, management IP address 192.168.10.21, SSH port 22, type ArubaOS-CX, user name privatelan and the switch password. Leave the enable password empty. Choose the switch group and enter the interface ranges in 1/1/1-1/1/48 form.
• 802.1x / RADIUS > Clients — add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Reports > Configuration compliance — run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

For a VSF stack on a 6200 or 6300, add the stack once, on its shared management address. PrivateLAN detects the stack and lists each member's model, serial number, firmware, uptime, CPU and temperature underneath it.

DHCP snooping (optional)

PrivateLAN reads the switch's DHCP snooping table to find out the address of any device you registered with a Dynamic address instead of a fixed one, and to find the address of wireless clients behind an access point. Without snooping those devices simply report that no address is known — nothing else stops working, so enable it only if you use that.

dhcpv4-snooping
!
vlan 10,20,30
    dhcpv4-snooping
!
interface 1/1/48
    description Uplink
    dhcpv4-snooping trust

Enable it per VLAN as well as globally — the global command on its own records nothing.

Two things decide whether this works at all:

• Every port towards your DHCP server must be trusted. That is the uplink, and any port towards another switch on the way to the server. A port left untrusted drops the server's replies and the devices behind it stop getting addresses — so set the trusted ports in the same change that enables snooping, not afterwards.
• Snooping must be enabled on the VLANs the devices are in. A VLAN it is not enabled on produces no bindings, so those devices keep reporting that no address is known.

Check the result on the switch itself:

show dhcpv4-snooping
show dhcpv4-snooping binding

The binding table does not survive a restart of the switch unless you tell the switch to save it. Without that, PrivateLAN reports that no address is known for a dynamic device until each lease is renewed:

dhcpv4-snooping external-storage <url>

Complete example configuration

Everything above in one block, for a CX 6100 acting as a layer 2 access switch with in-band management. Change every value from the table at the top.

configure terminal
!
hostname SW-FLOOR1-01
!
user privatelan group administrators password plaintext ExampleSwitchPassword
!
ssh server vrf default
no telnet-server vrf default
ssh maximum-auth-attempts 3
!
vlan 10
    name MGMT
    exit
vlan 20
    name DATA
    exit
!
interface vlan 10
    description Management
    ip address 192.168.10.21/24
    no shutdown
    exit
!
ip route 0.0.0.0/0 192.168.10.1
!
interface 1/1/48
    description UPLINK
    no shutdown
    no routing
    vlan trunk native 1
    vlan trunk allowed 10,20
    exit
!
clock timezone europe/amsterdam
ntp server nl.pool.ntp.org iburst
ntp vrf default
ntp enable
!
logging 192.168.10.5 udp 514 vrf default severity info
!
radius-server host 192.168.10.5 key plaintext ExampleSharedSecret vrf default
aaa group server radius PRIVATELAN
    server 192.168.10.5 vrf default
    exit
aaa authentication port-access dot1x authenticator
    radius server-group PRIVATELAN
    enable
    exit
aaa authentication port-access mac-auth
    radius server-group PRIVATELAN
    enable
    exit
!
spanning-tree mode mstp
spanning-tree config-name PRIVATELAN
spanning-tree config-revision 1
spanning-tree instance 1 vlan 10,20
spanning-tree
!
allow-unsupported-transceiver
!
no https-server vrf default
!
end
write memory

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates