ArubaOS-CX Access/Trunk Interface Best Practices

Getting edge and uplink interfaces right on HPE Aruba CX switches is one of those details that separates a stable network from one that produces mysterious outages at 2 a.m. This article distills the community-validated ArubaOS-CX access/trunk interface configuration good practices into ready-to-use templates, covering VLAN tagging decisions, loop protection and spanning-tree hardening for both host-facing and switch-facing ports.

Access Interface Template for ArubaOS-CX

For an edge port connecting a host, the recommended configuration disables routing, sets a jumbo-friendly MTU and enables loop protection plus BPDU guard so a rogue cable or switch on the edge cannot take down the VLAN:

interface 1/1/1
  no shutdown
  mtu 9198
  description "Link-to-Edge-Host"
  no routing
  vlan access 10
  loop-protect
  spanning-tree bpdu-guard
  spanning-tree port-type admin-edge
  spanning-tree tcn-guard
  exit

BPDU guard disables interfaces that receive unexpected STP BPDUs, while port-type admin-edge moves the port to forwarding immediately, avoiding the 30-second spanning-tree delay for legitimate end hosts.

Trunk Interface Template for Peer Switches

For a trunk to a third-party switch, tag the native VLAN explicitly and restrict the allowed list to only the VLANs that must traverse the link. An explicit allow list prevents a newly created VLAN from leaking across the whole network:

interface 1/1/24
  no shutdown
  no routing
  mtu 9198
  description "Link-to-Remote-Switch"
  vlan trunk native 10 tag
  vlan trunk allowed 10,20,30
  spanning-tree link-type point-to-point
  spanning-tree ignore-pvid-inconsistency enable
  exit

Native VLAN Tagging: A Matter of Policy

Whether the native VLAN is tagged or untagged is ultimately a design preference, but tagging it is the safer default: it guarantees no untagged traffic flows on the trunk, which makes future VLAN additions simpler and avoids interop surprises with peers that expect fully tagged links. Keep the allowed list as tight as the business requires.

Global Settings That Make These Templates Work

The loop-protect and spanning-tree statements depend on global configuration: spanning-tree must be enabled, and loop-protect uses the default tx-rx-disable action with a re-enable-timer (e.g. 3600 seconds) so a recovered port comes back automatically. Integrate these templates into your ArubaOS-CX REST API automation flow, and see AOS-CX Central onboarding for fleet deployment.

Related: building EVPN-VXLAN fabrics on Aruba.

原文链接：https://airheads.hpe.com/discussion/arubaos-cx-accesstrunk-interface-configuration-commongood-practices