Aruba’s ESP Campus Access Design and NetConductor Architecture guides outline the validated roles of devices in dynamic segmentation deployments.

Access Layer (Edge): Aruba CX 6300The CX 6300 provides 10 Gb uplinks to distribution, advanced features like VXLAN and EVPN, and support for role-based access control at the edge. It is the recommended choice for modern edge deployments in an ESP fabric.

Route Reflector (RR): Aruba CX 8325The CX 8325 is optimized for routing and control-plane operations. As a route reflector, it scales overlay BGP sessions and distributes policies/roles through the fabric. It is explicitly referenced as the ideal RR platform in Aruba ESP campus validated designs.

Stub/Border: Aruba CX 8360The CX 8360 family provides advanced aggregation and fabric services. It supports VXLAN, EVPN, and border routing functions, making it the right choice for stub/border persona in ESP designs.

WLAN Gateway: Aruba 9240The Aruba 9200/9240 series gateways provide role-based policy enforcement for tunneled WLAN traffic. They terminate GRE/IPsec tunnels from APs, enforce user policies, and forward into the fabric. This is critical to meet the requirement of tunneling all WLAN user traffic for enhanced security.

Dynamic Segmentation with NetConductorAruba Central NetConductor enables centralized definition and orchestration of user roles and segmentation policies. Roles are automatically enforced across the fabric using VXLAN with Group-Based Policy (GBP). This supports both centralized tunneling (for WLAN traffic) and distributed segmentation (for wired POS traffic requiring low latency).

Requirement Mapping:

Low-latency POS traffic → Distributed role enforcement within the fabric via 8360/8325.

Secure WLAN traffic → User traffic tunneled to the 9240 gateway for role-based enforcement.

10 Gb uplinks and redundancy → Provided by 6300 edge switches with dual power options in technical rooms.

ESP architecture → NetConductor automates overlay, segmentation, and role orchestration.

Other options are eliminated because:

A uses 3320 for RR, which lacks overlay fabric scalability.

B uses 8320 for RR (possible, but Aruba recommends 8325 for RR roles in NetConductor designs).

D omits the WLAN Gateway, which is required to tunnel WLAN traffic.

E uses 6200 at the edge, which does not provide the required 10 Gb uplink capability.

Therefore, Option C is the only design that fully satisfies the cruise line’s requirements while aligning with Aruba’s ESP Campus validated architectures.

Reference Extracts (Aruba Official Study & Design Guides):

Aruba ESP Campus Design Guide: device personas (edge, RR, stub/border, gateway) and NetConductor integration.

Aruba NetConductor Technical Overview: VXLAN-GBP, dynamic segmentation, and centralized role enforcement.

Aruba Dynamic Segmentation Solution Overview: tunneling of WLAN traffic, role-based security across wired and wireless.

Aruba CX Switch Series Data Sheets: CX 6300 (edge with 10 Gb uplinks), CX 8325 (RR), CX 8360 (border/stub), Aruba 9240 (WLAN gateway).

To ease the transition for IT staff accustomed to legacy Aruba OS-S (ProCurve) equipment when moving to Aruba OS-CX switches, two effective approaches are creating aliases (Option A) and using the CLI Reference Guide for Aruba OS-CX, Aruba OS-Switch, Comware, and Cisco IOS (Option B). Aliases allow the creation of custom command shortcuts or mappings in Aruba OS-CX, which can mimic or resemble the commands staff are familiar with from Aruba OS-S, making the command-line interface (CLI) more intuitive for them. The CLI Reference Guide is an invaluable resource that provides a comparative view of commands across different operating systems, including Aruba OS-CX and Aruba OS-S, helping staff understand the equivalent commands and functionalities in the new OS-CX environment. Both these tools can significantly reduce the learning curve and help the IT staff become proficient with Aruba OS-CX switches more quickly.

In a Virtual Switching Framework (VSF) stack, the standby member requires a reboot when performing an In-Service Software Upgrade (ISSU). This process allows for the software of the networking devices in the VSF stack to be updated with minimal disruption to the network. The standby member in a VSF configuration is rebooted to apply the new software version while the active member continues to handle the network traffic, ensuring continued operation of the network. This approach minimizes downtime during the upgrade process, which is critical for maintaining network availability and performance.