HPE Aruba Networks AOS-CX Basics 3 - VLAN Config Hands-On

VLANs are a fundamental part of networking but their misconfiguration is one of the most common reasons for network outages*.
In this video we take a close look at the intricacies of VLAN configuration using HPE Aruba Networks AOS-CX.

8320 config guide here:

N.B. The diagram shows the addressing as .1 & .2 but I ping .101 to .102. I had to change the addressing mid-video because those addresses were already taken on my home lab 🙄🤦♂️....Networking!
I hope that doesn't confuse anyone. The principle is the same, ping from one IP address to another across the link connecting the 8320s.

Twitter:

*I used to work Ops and VLAN config error was high on the list of causes of outage.

#HPE Aruba Networks

[wx]

Brilliant use of tiled console and wireshark screens. Adding the logical diagram alongside for references would move the presentation into superior category. Thanks!!

[grvadelic]

I've been going through your videos. Thank you! I am still completely confused trying to setup VLANs, but you do a good job of explaining. I just need to learn more it appears.

[NorwayDet]

Thank you so much for helping me understand this. First started working with Cisco switches, so I got confused when tasked to fix a network for another business that had an old HP switch with this CLI

[norbertt.t]

Great video, simple with fluent explanations

[marklynch]

This is great, just about to order 2 8320 switches for a new site. I'll be configuring a routed access design with OSPF and the 8320s in a VSX at the core so the timing of these videos is perfect, thanks. 👍

[miltondenson]

Joe, These are very good. Please keep them coming.

[petersimon]

And again a nice video from you, please keep up the series

[grahammccann]

Hi Joe, Great Video thank you for making it. Joe I just started working on Aruba, did you do make any videos on just Aruba switches 2930?

[wx]

Consider: At about the 5:16 mark in this #3 Basic video, you correct yourself with a NOTE displayed in the upper right corner of the video window. You reference (my paraphrase), "you meant to say vid 2." Please state it as "video #2" or something similar. I am very new to AOS-CX and for much time, I thought you were referring to some CLI command when you wrote "vid"

[wx]

Some AOS-CX video suggestions (BTW: The snippet videos are brilliant...short and to the point): (1.) If one can create remote mirroring over a local network, how? (2.) Adding AOS-CX routing/switching to an existing AOS/Provision/Procurve environment?? (3.) What are the AOS-CX pros/cons of using Layer-3 routing versus Layer-2 VLANs for segmentation and switch speed in light of the 8320/6300 device speed??? (4.) Using Global routing versus Interface routing - advantages/disadvantages ++ design considerations ???? (5.) A summary video of all your current and planned basic AOS-CX videos include diagrams and other concept helps. Thanks.

[null_zero]

At the 10:25 mark I think I could have done a better job of describing what's happening. The trunk on 8320-1 is sending frames tagged in VLAN150, the receiving port on 8320-2 is still an access port in VLAN150. In that state 8320-2 will switch the traffic to the end destination, so there will be one-way comms.
However, the return traffic will leave 8320-2's access port untagged and will hit 8320-1's 1/1/1 port but that switch will deem it to be in the native VLAN of 1, rather than 150, because it is untagged, and will not send it out on VLAN150 to the ubuntu VM.
For the ping to be successful, the return traffic needs to hit the source, hence why it is timing out.


Got all that? Phew 🥴 In conclusion though I would never recommend configuring one end differently from the other, it is just too easy to make mistakes. Identical VLAN config either end of the link is the desired state.

[zacharypoling]

Another great video! I do however have a question about the tagging. I'm used to the OS's of the HP Layer 2+ switches where vlans work a bit different. For example, a switch to switch port on that OS would untag vlan 1 (where their management IPs are) then tag the other vlans for traffic flow. In AOS-CX, I had to set the port to native vlan 1, but then also allow vlan 1 with the other vlans. If I only had vlan 1 set to native but not also allowed, my pings would not flow. On the other hand, I could also only allow it and not set any vlan as native and it works fine. It seems that I'm not quite understanding the purpose of the native vlan function.

I'm rather proficient with the standard HP switch OS but oh my have I just been bumbling around AOS-CX 🥴 I've also heard many a time that using vlan 1 in practice is a bad idea, but this network has been built for over 15 years now and changing it isn't exactly in anyone's headspace.

[billwoodall]

Question, is there a command to setup multiple ports on a VLAN instead of one port at a time. I can easily do the commands in provision.

[herrschnitzelmann]

In the video you only configured Port 1/1/1 on 8320-1 for no routing and Vlan 150. Why you don`t have to configure the egress port 1/1/2 on 8320-1?

[nickdoud]

When it doesn't work, does wireshark tell you why it isn't working in the error messages?

[daraqnet]

Does this apply for the old MAS switches, like S2500?

[sunsopheary]

it is possible to configure MVRP and RPVST+ at the same time? In the document of Aruba OS CX it said that the limitation of MVRP is it cannot be enabled MVRP and PVST at the same time.

[NeerajSharma-obwf]

When switch 1 => 1/1/1 trunk with Native 150 and Switch 2 => 1/1/1 change to access VLAN traffic was not discarded. Even when Interface should only accept VLAN. How did it work. Can someone please explain in more details.

[wesleyfer]

can you explain to me how to do network routing? and routing vlans

[sokocul]

how to add dhcp pool to interface vlan bro ?