Aruba 8325 AOS-CX: Access Ports, Trunks and VLANs

The Aruba 8325 is a data center switch running ArubaOS-CX, whose CLI mixes Cisco IOS-style syntax with unique AOS-CX constructs. In a real active/active deployment of two 8325s, the most important day-one tasks are turning the Layer 3-default ports into access or trunk ports and getting VLAN traffic flowing. This article covers the platform basics and the exact CLI for access and trunk ports on AOS-CX, along with the VLAN creation, native VLAN handling, verification and troubleshooting steps that actually matter once the switches are in production.

Aruba 8325 Platform Overview

The 8325 family delivers up to 25Gbps on 48 ports and 100Gbps on 4 uplink ports, running ArubaOS-CX with advanced Layer 3 features and active gateway (a super-VRRP style default gateway). Firmware choice matters: check known issues per release before rollout.

Three platform behaviours drive almost everything you configure on day one, and they trip up engineers coming from Cisco or from the older ProVision/ArubaOS-Switch line:

• Every port is a routed (Layer 3) port by default. There is no implicit switchport state, so a port will not forward Layer 2 frames until you apply no routing.
• Every port is administratively down by default. A freshly cabled link stays dark until you issue no shutdown.
• VLANs are created once, globally, with vlan <id>, then referenced from each port. AOS-CX will also auto-create a VLAN the moment you assign it to an interface — convenient, but it silently hides typos, so verify with show vlan afterwards.

The 8325 runs the same AOS-CX software train as the 6300/6400 access switches, so configuration snippets are portable across the campus and the data centre. What differs is the port layout, buffer depth and the available feature set (VSX, VXLAN/EVPN, EVPN multihoming and so on), not the VLAN syntax.

Preparation and Planning

• Port speeds are separated into blocks of 12 - a group of ports runs either 25G or 1G/10G; you cannot mix within the block.
• 1G connections sometimes only work when speed and duplex are hardcoded to 1000/full on both ends; beware devices without hardcode support.
• Ports are shut down by default and are Layer 3 by default - both must be changed.
• Decide your VLAN plan before touching the CLI: which VLAN is the management VLAN, which is the native VLAN on uplinks, and which VLANs are carried between the two 8325s.

Document the port map first. Because access ports and trunk ports are configured with different commands, mixing them up is the most common source of "the link is up but nothing pings" tickets.

AOS-CX CLI Syntax

Unlike the older ProVision-style Aruba OS, ArubaOS-CX is closer to Cisco IOS: configure terminal, interface 1/1/1, no shutdown, with the distinctive no routing and vlan access/vlan trunk commands replacing Cisco's switchport vocabulary.

The mental translation table saves a lot of time:

• Cisco switchport mode access → AOS-CX no routing plus vlan access <id>
• Cisco switchport mode trunk → AOS-CX no routing plus vlan trunk allowed <list>
• Cisco switchport trunk native vlan → AOS-CX vlan trunk native <id>
• Cisco switchport Nonegotiate / no equivalent → AOS-CX has no DTP at all; every port is statically configured, which removes a whole class of negotiation bugs

Interface naming on the 8325 is member/slot/port, for example 1/1/1. On a standalone switch the first field is always 1; once the chassis is stacked with VSF or running VSX you will reference the same notation across members.

Creating and Naming VLANs

VLANs should be created explicitly so they exist even before the first port is assigned, and so you can give them a meaningful name that shows up in every show command:

switch# configure terminal
switch(config)# vlan 10
switch(config-vlan)# name MGMT
switch(config-vlan)# exit
switch(config)# vlan 200
switch(config-vlan)# name SERVERS
switch(config-vlan)# exit
switch(config)# vlan 20
switch(config-vlan)# name USERS
switch(config-vlan)# exit

A descriptive name is not cosmetic. When you are debugging a trunk that refuses to pass traffic, show vlan becomes far easier to read when the VLAN list reads MGMT, SERVERS and USERS instead of raw numbers.

Choosing Between Access and Trunk

The rule is simple and worth stating explicitly because it drives the whole configuration:

• Access port — the connected device is VLAN-unaware and sends untagged frames. One VLAN only. Typical for servers, printers, IP phones, hypervisor management ports, appliances.
• Trunk port — the connected device is VLAN-aware and tags its own frames. Multiple VLANs. Typical for switch-to-switch uplinks, hypervisor NIC teams, firewalls, and storage arrays that present several networks on one link.

If a server has a single NIC and no VLAN tagging configured in the OS, it is an access port. If the same server runs 802.1Q sub-interfaces, bond interfaces with VLANs on top, or an OVS bridge with tagged ports, it is a trunk.

Access Port Configuration

An access port accepts untagged frames and maps them to one VLAN - the right mode for computers, printers and other non-VLAN-aware devices:

switch(config)# interface 1/1/1
switch(config-if)# no shutdown
switch(config-if)# description "Connected to Server Host 1"
switch(config-if)# no routing
switch(config-if)# vlan access 200
switch(config-if)# exit

Order matters less than completeness, but do not skip no routing. If you configure vlan access 200 and forget no routing, AOS-CX keeps the port in Layer 3 mode and the VLAN assignment never takes effect. The port will report link-up, which makes the mistake look like a cabling or VLAN problem rather than a mode problem.

To give a port an explicit speed and duplex — the pattern that 1G peers frequently need — add the speed block before bringing the port up:

switch(config)# interface 1/1/5
switch(config-if)# no routing
switch(config-if)# vlan access 20
switch(config-if)# speed 1000-full
switch(config-if)# no shutdown
switch(config-if)# exit

Use speed auto to return to auto-negotiation when you are done troubleshooting. If a peer refuses to link at 1G with auto-negotiation on both sides, hardcoding both ends is the standard workaround, and the usual cause is an older NIC or an SFP that advertises an incomplete capability set.

Trunk Port Configuration

A trunk (tagged) port inserts 802.1Q tags and carries multiple VLANs - used for switch-to-switch links, servers with VLAN-aware NICs, and firewalls:

switch(config)# interface 1/1/48
switch(config-if)# no shutdown
switch(config-if)# no routing
switch(config-if)# description "Uplink to Distribution"
switch(config-if)# vlan trunk allowed 10,20,30,200
switch(config-if)# vlan trunk native 1
switch(config-if)# exit

vlan trunk allowed lists the tagged VLANs; vlan trunk native sets the untagged (native) VLAN. If the peer expects only tagged frames, add tag to the native command: vlan trunk native 1 tag.

The allowed keyword accepts ranges and commas, so vlan trunk allowed 10,20,30,200 and vlan trunk allowed 10-30 are both valid. A common practice in mixed environments is to allow only the VLANs that should cross the link and to leave VLAN 1 out entirely, using a dedicated tag-only trunk:

switch(config)# interface 1/1/47
switch(config-if)# no routing
switch(config-if)# vlan trunk allowed 10,20,30
switch(config-if)# vlan trunk native 999 tag
switch(config-if)# no shutdown
switch(config-if)# exit

Assigning an unused VLAN 999 as the tagged native VLAN means every frame on the link carries a tag, so there is no untagged traffic to leak between switches. This is the cleanest configuration when both ends are AOS-CX.

Native VLAN, the tag Keyword and Untagged Frames

The native VLAN is the one exception to the "trunks are tagged" rule: frames belonging to the native VLAN traverse the link without an 802.1Q header. By default AOS-CX uses VLAN 1 as the native VLAN, and by default it will accept untagged frames into that VLAN.

There are exactly two sane configurations for the native VLAN:

• Native VLAN matches on both ends and carries real traffic — for example an untagged management VLAN shared with a device that cannot tag, such as an older IPMI port or an out-of-band appliance.
• Tagged native VLAN — vlan trunk native 999 tag. No untagged frames are accepted, mismatches become immediately visible, and VLAN hopping risk through native VLAN manipulation disappears.

What you must never do is let the two ends disagree. A native VLAN mismatch between an 8325 and a downstream switch merges two different broadcast domains into one and produces intermittent connectivity that looks nothing like a VLAN problem. Check both ends with show interface 1/1/48 trunk whenever a trunk behaves strangely.

Uplinks, VSX and Uplink Redundancy

In an active/active pair, the two 8325s are typically joined with a VSX inter-switch-link and present their uplinks as a single logical entity. The VLAN configuration on those links does not change — it is still no routing plus vlan trunk allowed — but two things are worth knowing before you build the trunk:

• The inter-switch-link should be a tagged trunk carrying every VLAN that must cross between the peers, plus the dedicated ISL VLAN if you use one.
• Where an uplink is a VSX LAG, the member ports on each 8325 are configured as trunk ports inside the LAG; the VLAN list belongs on the LAG interface, not on the individual members.

If the design calls for the 8325s to route between VLANs, the alternative to trunking is to give the VLAN a switched virtual interface: interface vlan 200 followed by ip address 10.0.200.1/24. That interface is the Layer 2/3 boundary for that VLAN and is the Aruba equivalent of a Nexus SVI or a Junos IRB.

Verification Commands

switch# show vlan brief
switch# show vlan id 200
switch# show interfaces brief
switch# show running-config interface 1/1/1
switch# show interface 1/1/48 trunk
switch# show interface 1/1/1 | include rate

What good looks like, in order:

• show vlan brief lists every VLAN with its name, status and member ports. Ports shown as A are access members of that VLAN; ports shown as T are tagged trunk members.
• show interface 1/1/48 trunk prints the native VLAN, the allowed VLAN list and the currently active VLANs, which is the fastest way to spot a native VLAN mismatch or a VLAN that was never allowed.
• show interfaces brief confirms Link State: up and the negotiated speed.
• show running-config interface 1/1/1 proves what is actually applied, as opposed to what you believe you typed.

When a port is up but the VLAN is not passing traffic, run these checks in this order: is no routing present, is the VLAN created and allowed, does the native VLAN match the peer, and is the peer's port also configured. A surprising share of "VLAN problems" are one missing no routing on the far side.

Common Mistakes and Troubleshooting

• Port configured but still down — no shutdown was never entered. Every 8325 port ships administratively down.
• Access VLAN ignored — no routing missing. The VLAN assignment is accepted by the parser but has no effect on a routed port.
• Link up, no traffic on a trunk — the VLAN was never added to vlan trunk allowed, or the native VLAN differs from the peer.
• 1G link refuses to come up — hardcode speed 1000-full on both ends; some older peers do not negotiate cleanly against 25G-capable ports.
• VLAN exists that nobody created — a typo in vlan access auto-created it. Delete it with no vlan <id> once the port is corrected.
• Interface descriptions empty — you will thank yourself later for filling them in. A trunk with no description is anonymous during an outage.

Checkpoints, Rollback and the Startup Configuration

AOS-CX gives every change a safety net that older Aruba platforms lacked. Create a checkpoint before a change window:

switch# checkpoint create pre-vlan-change
switch# show checkpoint list
switch# checkpoint rollback pre-vlan-change
switch# checkpoint auto 30

The last command enables automatic checkpointing so a rollback point is captured automatically, and checkpoint auto without a value disables it. Because AOS-CX commits running configuration to the startup configuration as you type, there is no separate write memory step — which is convenient, and also the reason checkpoints matter: a bad change is live immediately, so the rollback command is your undo button.

FAQ

Can an access port carry more than one VLAN? No. An access port maps all untagged traffic into exactly one VLAN. If several VLANs must arrive on one link, use a trunk and tag them, or use a trunk with a native VLAN plus tagged VLANs.

Do I still need no shutdown if the port shows link up? If the port shows link up, it is already administratively enabled. When in doubt, show interface 1/1/1 prints the administrative state separately from the link state.

Does AOS-CX negotiate trunks automatically? No, there is no DTP equivalent. Both ends must be configured explicitly, which is why trunking problems on AOS-CX are usually configuration errors rather than negotiation failures.

What happens if a VLAN in the allowed list does not exist? It is created implicitly. Traffic in that VLAN will then be forwarded on the trunk, so always confirm the VLAN list matches your design before the link is put into service.

Related articles: ArubaOS-CX access vs trunk native VLAN tagging, Junos VLAN access, trunk and IRB examples, Cisco Nexus NX-OS VLAN and trunk configuration, ArubaOS-CX Access vs Trunk: Verify with show vlan, and ArubaOS-CX VSX Configuration: Active-Active Switch HA.

原文链接：https://networkengineerblogs.wordpress.com/aruba-8325