Skip to content

NetDesignKit · Tools

Aruba CX Config Generator

Build a 6200F access switch or VSF stack config, plus the matching multi-chassis LAG and SVIs for an 8360 VSX core pair. The form opens with a sample site so you can see the output straight away.

● Runs entirely in your browser. Nothing you type is sent anywhere.

Access switches one MC-LAG per switch on the core

Number of access switches Model VSF link ports (per member)

#	Hostname	VSF members	Mgmt IP / prefix	Core LAG	Core primary port	Core secondary port

Raise the count and new rows continue the numbering from the row above: hostname, management IP, LAG ID and core ports all step up by one. Edit any cell to override. VSF link ports default to the last two SFP+ ports; members 2 and up are joined with vsf renumber-to before cabling.

VLANs subnets feed the core SVIs

ID	Name	Subnet (CIDR)	Role

Core gateway uses .1 as the VSX active-gateway, .2 on the primary and .3 on the secondary. Leave the subnet blank to skip the SVI (for example a guest VLAN routed on the firewall).

Management in-band, default VRF

Mgmt VLAN Default gateway Domain name DNS domain list DNS servers NTP servers Syslog server Timezone Login banner

Edge ports colourless or static, APs

Ports	Type	Description	VLAN	Voice / tagged	Auth

Port ranges apply to every stack member. Colourless: VLAN is the pre-auth VLAN and ClearPass assigns the role, so auth is always on. Static: VLAN is the data VLAN, with an optional voice VLAN; tick Auth to add 802.1X and MAC-auth. AP: VLAN is the native VLAN and the next column lists tagged VLANs.

BPDU guard, admin-edge and loop-protect on colourless and static ports Loop-guard and root-guard on colourless and static ports PoE pre-standard detection on colourless and static ports IP client tracking (global)

Uplink LACP LAG to the core

LAG ID Uplink ports Native VLAN Allowed VLANs

Spanning tree runs Rapid PVST+ on every VLAN in the table. Access switches keep the default bridge priority so the VSX core stays root.

802.1X & ClearPass dot1x + MAC-auth

Enable port-access authentication on user ports ClearPass servers Server group name RADIUS shared secret Client limit per port RADIUS timeout (s) RADIUS retries Concurrent onboarding (run 802.1X and MAC-auth in parallel) Cached re-authentication Cached reauth period (s) 802.1X max EAPOL requests 802.1X max retries 802.1X quiet period (s) 802.1X discovery period (s) MAC-auth quiet period (s) Critical role VLAN (ClearPass down) Reject role VLAN (auth failed) Allow ClearPass CoA RADIUS accounting

The secret is written as plaintext so you can paste it. AOS-CX stores it as ciphertext once applied.

Admin login (TACACS+) device administration

Authenticate switch admin logins with TACACS+ TACACS+ servers Server group name TACACS+ shared secret Login methods Command authorization Command accounting

Local accounts stay as the fallback when no TACACS+ server answers. Keep a local admin configured. Turn on command authorization only after the ClearPass TACACS+ service and enforcement profiles are in place, or you can lock yourself out.

SNMP access and core

SNMP version Trap receivers / NMS Community (v2c) v3 user v3 auth password (SHA) v3 privacy password (AES) System location System contact

Core VSX pair 8360 VSX, downlinks and SVIs

Primary hostname Secondary hostname VSX system MAC Active-gateway MAC ISL LAG ID ISL ports (both peers) Keepalive path Keepalive port Keepalive IP · primary Keepalive IP · secondary

VSX global sync (primary)

Advanced options

STP priority (0–15) RADIUS/TACACS+ source DHCP servers Add ClearPass as IP helper (DHCP profiling) Generate VLANs and SVIs on the core

Core routing (OSPF) loopbacks, transit, WAN uplinks

Run OSPF on the core Process ID Area Loopback 0 · primary Loopback 0 · secondary VSX transit VLAN Transit subnet WAN uplink · primary port WAN uplink · primary IP WAN uplink · secondary port WAN uplink · secondary IP

All interfaces are passive by default. OSPF adjacencies form only on the VSX transit VLAN (over the ISL) and the WAN uplinks, both as point-to-point. User and management SVIs are advertised as passive networks. Loopback 0 is the router ID.

What the generator builds

Access switches: a full AOS-CX config for each 6200F switch or VSF stack, with hostnames, management IPs and uplink LAG IDs numbered automatically.
Edge ports: colourless ports for ClearPass role-based access, static data and voice ports, and AP trunk ports, with BPDU guard, loop-protect and PoE options.
802.1X and MAC-auth: RADIUS server groups, critical and reject roles, CoA, accounting, cached re-authentication and concurrent onboarding.
Core VSX pair: 8360 primary and secondary configs with ISL, keepalive, VSX sync, one multi-chassis LAG per access switch, SVIs with active gateway, DHCP relay and OSPF.
Management: TACACS+ admin login, SNMP v2c or v3, NTP, DNS, syslog and a login banner.

Frequently asked questions

Which AOS-CX versions does it target?

The syntax targets AOS-CX 10.10 and later. Some commands differ between releases, so review the output against your version and test in a lab before applying it to production.

Is my configuration sent anywhere?

No. The generator runs entirely in your browser. Your form is saved only in this browser so it is still there when you come back.

Why are secrets shown as plaintext?

So you can paste the config directly. AOS-CX stores RADIUS, TACACS+ and SNMP secrets as ciphertext once applied. Clear the browser’s saved form if you share the computer.

Does it add a local admin account?

No. Configure and test a local admin account first, so you keep access if TACACS+ or ClearPass is unreachable.

Is NetDesignKit affiliated with HPE Aruba Networking?

No. Aruba and AOS-CX are trademarks of Hewlett Packard Enterprise. The names are used only to describe compatibility.

Planning the whole refresh? See the Campus LAN Refresh HLD pack, or email support@netdesignkit.com for a customised design.