Key Features

• − High performance 19.2 terabits per second switching (1.2Tbps/slot) capacity
• − Carrier-class high availability with Virtual Switching Extension (VSX), redundant management, power, and fabric
• − AOS-CX enables automation and usability using built-in REST APIs and Python scripts
• − Intelligent monitoring, visibility, and remediation with Network Analytics Engine
• − Dynamic VXLAN with BGP-EVPN for deep segmentation in data center and campus networks
• − One-touch deployment with the CX Mobile App
• − NetEdit support for automated configuration and verification
• − Advanced Layer 2/3 feature set includes BGP, EVPN, OSPF, VRF, and IPv6
• − Compact 8U chassis with high density, line rate 10GbE/25GbE/40GbE/100GbE connectivity

AOS-CX - A Modern Software System

The CX 8400 Switch Series is based on AOS-CX, a modern, database-driven operating system that automates and simplifies many critical and complex network tasks. A built-in time series database enables customers and developers to utilize software scripts for historical troubleshooting, as well as analysis of past trends. This helps predict and avoid future problems due to scale, security, and performance bottlenecks. AOS-CX operating system features are organized into CX Foundation and HPE Aruba Networking CX Advanced software licenses.

Every CX switch includes an active, embedded CX Foundation license at no additional cost with the option to upgrade to an CX Advanced license.

The CX Foundation license has everything needed to deploy, connect, and troubleshoot an enterprise network, including:

• − Network Analytics Engine (NAE)
• − Dynamic Segmentation
• − Switch Stacking
• − High Availability and Resiliency
• − Quality of Service (QoS)
• − Layer 2 Switching
• − Layer 3 Services and Routing
• − IP Multicast
• − Network Security
• − Support for NetEdit

The CX Advanced license includes CX Edge Insights, offering deep visibility with application recognition, identification, and flow capture from layer 4 to layer 7.

For more information on the CX Advanced License, read the HPE Aruba Networking CX Switch License Ordering Guide.

Because AOS-CX is built on a modular Linux architecture with a stateful database, our operating system provides the following unique capabilities:

• − Easy access to all network state information allows unique visibility and analytics
• − REST APIs and Python scripting for fine-grained programmability of network tasks
• − A micro-services architecture that enables full integration with other workflow systems and services
• − Supports HPE Aruba Networking Fabric Composer - a software-defined orchestration solution that simplifies and accelerates leaf-spine network provisioning and day‑to-day operations across rack-scale compute and storage infrastructure.
• − Continual state synchronization that provides superior fault tolerance, fault monitoring and high availability.
• − All software processes communicate with the database rather than each other, ensuring near real-time state and resiliency and allowing individual software modules to be independently upgraded for higher availability.

Network Analytics Engine - advanced monitoring and diagnostics

For enhanced visibility and troubleshooting, Network Analytics Engine (NAE) automatically interrogates and analyzes events that can impact a networks health. Advanced telemetry and automation provide the ability to easily identify and troubleshoot network, system, application and security related issues easily, through the use of python agents, CLI-based agents and REST APIs.

The Time Series Database (TSDB) stores configuration and operational state data, making it available to quickly resolve network issues. The data may also be used to analyze trends, identify anomalies and predict future capacity requirements.

HPE Aruba Networking Central, Cloud-Based Network Management

Flexible cloud-based or on-premises management for unified network operations of wired, WLAN, SD-WAN, and public cloud infrastructure. Designed to simplify day zero through day two operations with streamlined workflows. Switch management capabilities include configuration, onboarding, monitoring, troubleshooting, and reporting.

A Central Advanced license expands these capabilities with premium security and AIOps, including the Central NetConductor Fabric Wizard and Policy Manager to enable dynamic segmentation and distributed enforcement at a global scale.

The Central Advanced license now comes with all CX Advanced features so there is no need to purchase a CX Advanced license. This streamlines operational efficiency, reducing the need for IT teams to keep track of multiple licenses, active terms, and renewal dates. For more information on Central licensing, see the HPE Aruba Networking Central SaaS Subscription Ordering Guide.

NetEdit – automated switch configuration and management

The entire CX portfolio empowers IT teams to orchestrate multiple switch configuration changes for smooth end-to-end service rollouts. NetEdit introduces automation that allows for rapid network-wide changes and ensures policy conformance post network updates. Intelligent capabilities include search, edit, validation (including conformance checking), deployment and audit features. Capabilities include:

• − Centralized configuration with validation for consistency and compliance
• − Time savings via simultaneous viewing and editing of multiple configurations
• − Customized validation tests for corporate compliance and network design
• − Automated large-scale configuration deployment without programming
• − Network health and topology visibility with Networking NAE integration

Notes: A separate software license is required to use NetEdit.

CX Mobile App – unparalleled deployment convenience

An easy to use mobile app simplifies connecting and managing CX 6300 switches for any size project. Switch information can also be imported into NetEdit for simplified configuration management and to continuously validate the conformance of configurations anywhere in the network.

Virtual Switching Extension (VSX)

The ability of AOS-CX to maintain synchronous state across dual control planes allows a simplified carrier-class high availability solution called Virtual Switching Extension (VSX). Designed using the best features of existing high availability technologies such as Multi-chassis Link Aggregation (MC LAG), VSX enables a distributed architecture that is highly available during upgrades or control plane events. Features include:

• − Continuous configuration synchronization via AOS-CX
• − Flexible active-active network designs at Layers 2 and 3
• − Operational simplicity and usability for easy configuration
• − High availability by design during upgrades including support for VSX Live Upgrade with LACP traffic draining

Performance

• − High-speed fully distributed architecture

  • Provides up to 19.2 Tbps switching capacity with up to 7.142 billion packets per second (BPPS) for throughput; all switching and routing is performed in the line modules; meets the demands of bandwidth-intensive applications today and in the future
• − Scalable system design

  • Provides investment protection to support future technologies and higher-speed connectivity

Connectivity

• − High-density port connectivity

  • Supports up to 8 line modules, including a 32-port 10 Gigabit Ethernet with MACsec in hardware (not software), an 8-port 40 Gigabit Ethernet, a 6-port 40/100 Gigabit Ethernet module and a 32 port 25GbE module.
• − Jumbo frames

  • Allows high-performance backups and disaster-recovery systems; provides a maximum frame size of 9K bytes
• − Unsupported Transceiver Mode (UTM)

  • Allows possible use of 1G and 10G transceivers and DAC cables considered unsupported. No warranty nor support for the transceiver/cable when used.
• − Loopback

  • Supports internal loopback testing for maintenance purposes and increased availability; loopback detection protects against incorrect cabling or network configurations and can be enabled on a per-port or per-VLAN basis for added flexibility
• − Packet storm protection

  • Protects against unknown broadcast, unknown multicast, or unicast storms with user-defined thresholds

Quality of Service (QoS)

• − Strict priority (SP) queuing and Deficit Weighted Round Robin (DWRR)

  • Enable congestion avoidance
• − Data Center Bridging (DCB)

  • Supports lossless Ethernet networking standards to eliminate packet loss due to queue overflow

    • − Priority Flow Control (PFC) 7 priorities per port
    • − Enhanced Transmission Service (ETS)
    • − DCB Exchange Protocol (Pre-standard LLDP DCBX IEEE 1.01 version)
• − Flow-Control Guard

  • Prevents accumulation of excessive congestion with periodic flushing. Avoids packets buffering for an extended time period
• − ECN with slope

  • Marks packets as ECN-CE (Congestion Experienced. Helps TCP to reduce receive window size during congestion
• − Advanced lossless pool configuration
• − Global buffering statistics
• − Storage Solution Support

  • iSCSI, Lossless iSCSI, RDMA over Converged Ethernet version 2 (RoCE v1 and v2) and Non-Volatile Memory Express (NVMeOF)

Resiliency and high availability

• − AOS-CX software resiliency with VSX)
• − Redundant and load-sharing fabrics, management, fan assemblies, and power supplies

  • Increases total performance and power availability while providing hitless, stateful failover
• − All hot-swappable modules

  • Allows replacement of modules without any impact on other modules
• − Ethernet Ring Protection Switching (ERPS)

  • Supports rapid protection and recovery in a ring topology.
• − Separate data and control paths

  • Separates control from services and keeps service processing isolated; increases security and performance
• − Bidirectional forward detection (BFD)

  • Enable sub-second failure detection for rapid routing protocol re-balancing
• − Virtual Router Redundancy Protocol (VRRP)

  • Allows groups of two routers to dynamically back each other up to create highly available routed environments
• − Unidirectional link detection (UDLD)

  • Monitors link connectivity and shuts down ports at both ends if unidirectional traffic is detected, preventing loops in STP-based networks
• − IEEE 802.3ad LACP

  • Supports up to 128 link aggregation groups (LAGs), each with eight links per LAG; and provides support for static or dynamic groups and a user-selectable hashing algorithm
• − Multiple internal power supplies

  • Provides high reliability, requiring only two power supplies to support a fully populated CX 8400 and adding two more gives the solution N+N power redundancy

Management

In addition to the CX Mobile App, NetEdit and Network Analytics Engine, the 8400 series offers the following:

• − Built-in programmable and easy to use REST API interface
• − IPSLA

  • Monitor the network for degradation of various services, including monitoring voice. Monitoring is enabled via the NAE for history and for automated gathering of additional information when anomalies are detected.
• − Management interface control

  • Enables or disables each of the following interfaces depending on security preferences: console port, or reset button
• − Industry-standard CLI with a hierarchical structure

  • Reduces training time and expenses, and increases productivity in multivendor installations
• − Management security

  • Restricts access to critical configuration commands; offers multiple privilege levels with password protection; local and remote syslog capabilities allow logging of all access
• − SNMP v2c/v3

  • Provides SNMP read and trap support of industry standard Management Information Base (MIB), and private extensions
• − sFlow® (RFC 3176)

  • Provides scalable ASIC-based wire speed network monitoring and accounting with no impact on network performance; this allows network operators to gather a variety of sophisticated network statistics and information for capacity planning and real-time network monitoring purposes
• − gNMI support

  • Supports OpenConfig standardized YANG model for gNMI Streaming Telemetry
• − Remote monitoring (RMON)

  • Uses standard SNMP to monitor essential network functions and supports events, alarms, history, and statistics groups as well as a private alarm extension group
• − TFTP, and SFTP support

  • Offers different mechanisms for configuration updates;; trivial FTP (TFTP) is a simpler method using User Datagram Protocol (UDP); Secure File Transfer Protocol (SFTP) runs over an SSH tunnel to provide additional security
• − Debug and sampler utility

  • Supports ping and traceroute for both IPv4 and IPv6
• − Network Time Protocol (NTP)

  • Synchronizes timekeeping among distributed time servers and clients; keeps timekeeping consistent among all clock-dependent devices within the network. Can serve as the NTP server in a customer network.
• − IEEE 802.1AB Link Layer Discovery Protocol (LLDP)

  • Advertises and receives management information from adjacent devices on a network, facilitating easy mapping by network management applications
• − LACP-fallback

  • Enables Zero Touch Provisioning over Link Aggregation Groups.
• − Dual flash images

  • Provides independent primary and secondary operating system files for backup while upgrading
• − Supportability

  • Job scheduler framework
• − Analytics

  • AIOPS NAE Agent & Engine Improvements – Unicast Routing and Client Services

Layer 2 switching

• − VLAN

  • Supports up to 4,094 port-based or IEEE 802.1Q-based VLANs; and supports MAC-based VLANs
• − VLAN translation

  • Remaps VLANs during transit across a core network.
• − Q-in-Q VLAN tunnels

  • Expands the VLAN space by tagging the tagged packets. It allows services in a private VLAN to be transparently transmitted over a public network.
• − Bridge Protocol Data Unit (BPDU) tunneling

  • Transmits STP BPDUs transparently, allowing correct tree calculations across service providers, WANs, or MANs
• − Port mirroring

  • Duplicates port traffic (ingress and egress) to monitoring port; supports 4 mirroring groups, with an unlimited number of ports per group
• − STP

  • Supports standard IEEE 802.1D STP, IEEE 802.1w Rapid Spanning Tree Protocol (RSTP) for faster convergence, and IEEE 802.1s Multiple Spanning Tree Protocol (MSTP). It supports STP TCN Trap, STP New Root.
• − Rapid Per-VLAN Spanning Tree+ (RPVST+)

  • Allows each VLAN to build a separate spanning tree to improve link bandwidth usage in network environments with multiple VLANs

Layer 3 services

• − Address Resolution Protocol (ARP)

  • Determines the MAC address of another IP host in the same subnet; supports static ARPs; gratuitous ARP allows detection of duplicate IP addresses; proxy ARP allows normal ARP operation between subnets or when subnets are separated by a Layer 2 network
• − IP Directed Broadcast

  • Support directed broadcast on configured network subnets.
• − Dynamic Host Configuration Protocol (DHCP)

  • Simplifies the management of large IP networks; DHCP Relay enables DHCP operation across subnets
• − DHCP relay coexistence with server

  • Allows DHCP relay coexistence with DHCP server for both IPv4 and IPv6
• − Domain Name System (DNS)

  • Provides a distributed database that translates domain names and IP addresses, which simplifies network design; supports client and server. It supports mDNS Gateway.

Network Virtualization

• − Static VXLAN

  • Allows operators to manually connect two or more VXLAN tunnel endpoints (VTEP)
• − Dynamic VXLAN with BGP-EVPN

  • Deep segmentation for Spine/Leaf data center networks or Layer 3 campus designs, including NSX environments, with centralized gateway and symmetric Integrated Routing and Bridging (IRB) based distributed gateways VXLAN tunnels
• − VXLAN distributed anycast gateway

  • Addressing mechanism that enables the use of the same gateway IP addresses across all the leaf switches part of a VXLAN network. It supports VSX active forwarding for VXLAN underlay

Layer 3 routing

• − Policy Based Routing (PBR)

  • Enables using a classifier to select traffic that can be forwarded based on policy set by the network administrator
• − Static IPv4 routing

  • Provides simple manually configured IPv4 routing
• − Open shortest path first (OSPF)

  • Delivers faster convergence; uses link-state routing Interior Gateway Protocol (IGP), which supports ECMP, NSSA, and MD5 authentication for increased security and graceful restart for faster failure recovery
• − Border Gateway Protocol (BGP-4 and BGP-6

  • Delivers an implementation of the Exterior Gateway Protocol (EGP) utilizing path vectors; uses TCP for enhanced reliability for the route discovery process; reduces bandwidth consumption by advertising only incremental updates; supports extensive policies for increased flexibility; scales to very large networks
• − Dynamic BGP peering

  • Simplifies BGP configuration for ZTP scenarios and enables CX for Azure stack integration
• − IP performance optimization

  • Provides a set of tools to improve the performance of IPv4 networks; includes directed broadcasts, customization of TCP parameters, support of ICMP error packets, and extensive display capabilities
• − Static IPv6 routing

  • Provides simple manually configured IPv6 routing
• − Dual IP stack

  • Maintains separate stacks for IPv4 and IPv6 to ease the transition from an IPv4-only network to an IPv6-only network design
• − Multiprotocol BGP (MP-BGP) with IPv6 Address Family

  • Enables sharing of IPv6 routes using BGP and connections to BGP peers using IPv6.
• − IPv6 Multicast Routing

  • Provides capability to enable routing of IPv6 multicast traffic. Supports multicast listener discovery (MLD), MLD Snooping, and PIM-SM IPv6 Routing.
• − 6in4 tunnels

  • Supports the tunneling of IPv6 traffic in an IPv4 network.
• − OSPFv3 for IPv6

  • Delivers faster convergence; uses link-state routing interior gateway protocol (IGP), which supports ECMP, NSSA, and IPSEC authentication for increased security and graceful restart for faster failure recovery
• − Loopback IP redistribution in OSPF

  • Allows redistribution of IPv4 and IPv6 addresses of loopback interface in OSPFv2/v3
• − Equal-Cost Multipath (ECMP)

  • Enables multiple equal-cost links in a routing environment to increase link redundancy and scale bandwidth
• − Generic routing encapsulation

  • Enables tunneling from site-to-site over a Layer 3 path
  • DHCP Smart Relay

Visibility

Customers can choose to upgrade the active, embedded CX Foundation license to the term-based CX Advanced license to unlock the following benefits for their business:

• − Delivers deep visibility with CX Edge Insights for application recognition, identification, and flow capture from layer 4 to layer 7. CX Edge Insights enables granular datapoint collection with search, sort and reporting as well as the ability to recognize 22 categories and more than 3700 applications.

Security

• − TAA Compliance

  • The CX 8400, a TAA-compliant product, with the AOS-CX uses FIPS 140-2 validated cryptography for protection of sensitive information
• − Federal Certification

  • Compliant with DoDIN, APL, NDcPP, FIPS, and USGv6 requirements for federal certifications.
• − Access control list (ACL) Features

  • Supports powerful ACLs, including VLAN ACL, for both IPv4 and IPv6. Supports creation of object groups representing sets of devices like IP addresses. For instance, IT management devices could be grouped in this way. ACLs can also support protecting control plane services such as SSH, SNMP, NTP or web servers.
• − Remote Authentication Dial-In User Service (RADIUS)

  • Eases security access administration by using a password authentication server
• − Enrollment over Secure Transport (EST)

  • Enables secure certificate enrollment, allowing for easier enterprise management of PKI
• − Terminal Access Controller Access-Control System (TACACS+)

  • Delivers an authentication tool using TCP with encryption of the full authentication request, providing additional security
• − Management access security

  • AOS-CX provides for both on-box as well as off-box authentication for administrative access. RADIUS or TACACS+ can be used to provide encrypted user authentication. Additionally, TACACS+ can also provide user authorization services
• − Secure shell (SSHv2)

  • Uses external servers to securely log in to a remote device; with authentication and encryption, it protects against IP spoofing and plain-text password interception; increases the security of Secure FTP (SFTP) transfers
• − Korea Government Security Features

  • Ensure configuration integrity
  • Limit concurrent users for web access

Multicast

• − IGMP Snooping

  • Allows multiple VLANs to receive the same IPv4 multicast traffic, lessening network bandwidth demand by reducing multiple streams to each VLAN
• − PIM Multicast Boundary (v4)

  • VSX Graceful shutdown for IGMP/MLD Multicast NSF
• − Anycast RP

  • Two or more RPs configured with same /32 Host IP address on loopback interfaces. All the downstream routers will be configured to point to Anycast RP address for multicast routes. Device will automatically select the closest RP for each source and receiver. If equal costs routes exist, the process of registering the sources will be shared equally by all the RPs in the network.
• − MSDP Mesh Groups

  • MSDP used for Anycast RP is an intradomain feature that provides redundancy and load-sharing capabilities. When MSDP mesh groups are used, SA messages are not flooded to other mesh group peers. When MSDP peer in group receives SA message from another MSDP peer in the group, it assumes that this SA message was sent to all the other MSDP peers in the group. It also eliminates RPF checks on arriving SA messages. With MSDP mesh group configured, SA messages are always accepted from mesh group peer
• − PIM-Dense Mode

  • Floods multicast traffic to every corner of the network (push-model). Method is for delivering data to receivers without receivers requesting the data. Can be efficient in certain deployments in which there are active receivers on every subnet in the network. Branches without downstream receivers are pruned from the forwarding trees.
• − FastLeave (FL) and Forced-FastLeave (FFL) for IGMP

  • FL and FFL for IGMP/MLD speed up the process of blocking unnecessary Multicast traffic to a switch port that is connected to end nodes. They help to eliminate the CPU overhead of having to generate an IGMP/MLD Group-Specific Query message.
• − Support for Microsoft Network Load Balancer (NLB) for server applications
• − Protocol Independent Multicast (PIM)

  • Defines modes of IPv4 multicasting to allow one-to-many and many-to-many transmission of information; supports PIM, Sparse Mode (SM) , Source-Specific Multicast (SSM), and PIM Dense Mode (DM).
• − Internet Group Management Protocol (IGMP)

  • Utilizes Any-Source Multicast (ASM) to manage IPv4 multicast networks; supports IGMPv1, v2, and v3

Additional information

• − Green initiative support

  • Provides support for RoHS and WEEE regulations

Customer First, Customer Last Support

When your network is important to your business, then your business needs the backing of Support Services. Partner with HPE Aruba Networking product experts to increase your team productivity, keep pace with technology advances, software releases, and obtain break-fix support.

• − Foundation Care for Support Services include priority access to Technical Assistance Center (TAC) engineers 24x7x365, flexible hardware and onsite support options, and total coverage for HPE Aruba Networking products. HPE Aruba Networking switches with assigned HPE Aruba Networking Central subscriptions benefit with option for additional hardware support only.
• − Pro Care adds fast access to senior HPE Aruba Networking TAC engineers, who are assigned as a single point of contact for case management, reducing the time spent addressing and resolving issues.

For complete details on Foundation Care and HPE Aruba Networking Pro Care, please visit:

https://www.hpe.com/us/en/networking/hpe-aruba-networking-support-services.html

Warranty, services, and support

• − Limited Lifetime Warranty

  • See https://www.hpe.com/us/en/networking/hpe-aruba-networking-support-services.html for warranty and support information included with your product purchase.
• − Software Releases and Features:

  • Refer to AOS-CX Switch Software Documentation Portal
• − Support and services information

  • Visit https://www.hpe.com/us/en/networking/hpe-aruba-networking-support-services.html