Study guide
14.2 Interpreting an Architect's High-Level Design
HPE Aruba Networking Certified Associate - Campus Access HPE6-A85
Track your progress as you read
Finished sections get a check mark.
1 Introduction: HPE6-A85 Exam Overview
HPE6-A85 Exam Facts and Current Blueprint
2 Chapter 1: Network Stack Fundamentals
1.1 OSI Reference Model and Encapsulation 1.2 TCP/IP Protocol Suite and IP Headers 1.3 Layer 2 Operation, ARP, and 802.1Q Tagging
3 Chapter 2: Physical Connectivity and Host Addressing
2.1 Ethernet Media and Transceiver Standards 2.2 Power over Ethernet (PoE, PoE+, PoE++) Standards and Budgeting 2.3 LLDP, LLDP-MED, and Voice VLAN Configuration 2.4 Host IP Addressing and DHCP Relay Operations
4 Chapter 3: Network Resiliency and Virtualization
3.1 Virtual Switching Framework (VSF) Architecture and Topologies 3.2 VSF Split Detection, Failover, and Auto-Stacking 3.3 Virtual Switching Extension (VSX) Architecture and Operations 3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
5 Chapter 4: AOS-CX Architecture and Switch Operation
4.1 AOS-CX Hardware Portfolio and State Database Architecture 4.2 Network Analytics Engine (NAE) and Automated Telemetry 4.3 AOS-CX Interface Configuration and Port Control 4.4 Link Aggregation (LAG) and LACP Configuration
6 Chapter 5: Layer 2 Protocols and Spanning Tree
5.1 AOS-CX VLAN Configuration and Native VLAN Handling 5.2 Spanning Tree Protocols: STP, RSTP, and MSTP 5.3 Spanning Tree Protections and Loop Prevention 5.4 MAC Address Table Learning, Aging, and Forwarding
7 Chapter 6: Wireless Fundamentals, Standards, and RF
6.1 IEEE 802.11 Standards and Wi-Fi Generations 6.2 RF Fundamentals, Signal Propagation, and Channel Design 6.3 Aruba Access Point Hardware Portfolio and Suffix Conventions 6.4 WLAN Topologies, BSSID/ESSID, and Roaming Standards
8 Chapter 7: Aruba Wireless Architecture and Management
7.1 AOS 10 Architecture and Aruba Central Integration 7.2 Wireless Forwarding Modes: Bridge vs Tunnel Mode 7.3 Automated RF and Client Optimization: AirMatch and ClientMatch 7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation
9 Chapter 8: IP Routing Fundamentals and OSPF
8.1 IP Routing Principles and Packet Forwarding 8.2 OSPFv2 Protocol Mechanics and Adjacency Formation 8.3 OSPF Designated Routers and Multi-Area Deployments 8.4 ECMP, Static Routing, and VRF Isolation
10 Chapter 9: Campus Network Security and Segmentation
9.1 DHCP Snooping and Dynamic ARP Inspection 9.2 Port Security and MAC Address Limiting 9.3 ClearPass Policy Management and RADIUS Change of Authorization 9.4 Dynamic Segmentation, User-Based Tunneling, and Policy Enforcement
11 Chapter 10: Authentication, Authorization, and Accounting
10.1 The AAA Framework and Architecture 10.2 802.1X Authentication and EAP Methods 10.3 MAC Authentication and Captive Portal Onboarding 10.4 Administrative Access Control: RADIUS vs TACACS+
12 Chapter 11: Network Management and Telemetry
11.1 Aruba Central Cloud Architecture and Group Configuration 11.2 Zero-Touch Provisioning (ZTP) and Aruba Activate 11.3 AI Insights and Aruba User Experience Insight (UXI) 11.4 Network Telemetry, Streaming APIs, and SNMP/Syslog
13 Chapter 12: Troubleshooting the Solution
12.1 Structured Troubleshooting Methodologies and Scope Isolation 12.2 AOS-CX Layer 2 and Interface Diagnostic Commands 12.3 Layer 3, IP Services, and End-to-End Diagnostics 12.4 Physical-Layer Troubleshooting 12.5 Troubleshooting Wireless Clients and Network Access
14 Chapter 13: Optimizing Performance: QoS, Baselines, and Comparisons
13.1 Quality of Service (QoS) Classification and Marking 13.2 Queuing Algorithms and Congestion Management 13.3 Traffic Policing, Shaping, and Broadcast Rate Limiting 13.4 Establishing a Performance Baseline 13.5 Comparing Results to the Baseline
15 Chapter 14: Plan the Solution
14.1 Analyzing the Current Environment 14.2 Interpreting an Architect's High-Level Design 14.3 Creating a Low-Level Design 14.4 Preparing for Implementation
16 Chapter 15: Validate and Operate the Solution
15.1 Validating the Solution 15.2 Performing Firmware Updates 15.3 Making Basic Ongoing Configuration Changes 15.4 Maintaining Network Documentation
14.2 Interpreting an Architect's High-Level Design
Key Takeaways Explain This Topic AI
A high-level design (HLD) states the architecture: topology tiers, redundancy model, Layer 2/Layer 3 boundary, routing, segmentation, wireless forwarding model, security, and management approach.
VSF stacks (single control plane) typically sit at the access layer, while VSX pairs (two control planes) sit at aggregation or core and provide VSX-LAG uplinks and active-gateway.
Where the default gateways live defines the Layer 2/Layer 3 boundary: SVIs with active-gateway on a VSX pair mean user VLANs must be trunked from access to that pair.
A tunneled SSID needs only the AP management VLAN on the access port, while a bridged SSID needs its client VLAN tagged on the AP port and every trunk up to the gateway.
An associate translates the HLD into implementation tasks and asks the architect about gaps; design decisions are not changed without the architect's approval.
Last updated: October 2026
14.2 Interpreting an Architect's High-Level Design
Quick Summary: The high-level design (HLD) is the architect's description of the target network: which tiers exist, how they are made redundant, where routing starts, how users are segmented, how wireless traffic is forwarded, and how everything is managed. HPE6-A85 expects you to interpret an HLD: recognize what each statement means for the devices you will configure, notice what is missing, and turn the design into concrete tasks.
What an HLD Usually Contains
HLD element Typical statement What you must understand
Topology "Two-tier collapsed core" or "three-tier access/aggregation/core" How many layers of switches and where each closet uplinks
Access redundancy "CX 6300 VSF stacks in a ring per closet" VSF links, primary/secondary members, split detection
Aggregation/core redundancy "CX 8360 VSX pair with active-gateway" ISL, keepalive, VSX-LAG downlinks, shared gateway
- L2/L3 boundary "User SVIs on the core" or "routed access" Where VLANs end and which trunks carry them
- Routing "OSPF area 0 between core and WAN edge" Which links run OSPF and which are passive
Segmentation "Roles via ClearPass; IoT tunneled with UBT" Which ports use 802.1X/MAC-Auth and which roles tunnel
Wireless "AOS 10; corporate SSID tunneled to a two-node gateway cluster; guest SSID bridged" What VLANs the AP ports need
Security "WPA3-Enterprise; DHCP snooping and ARP inspection on access" Trust settings on uplinks
Management "HPE Aruba Networking Central; out-of-band management network" Onboarding path and management VLAN/VRF
QoS "Trust DSCP from phones and APs; voice in strict priority" Trust and queue settings
An HLD is deliberately not a configuration. It may show one representative closet instead of all twenty, and it rarely lists port numbers. That detail belongs in the low-level design (Section 14.3).
- Reading the Common Patterns
- Two-tier versus three-tier
Two-tier (collapsed core): access switches uplink directly to a core pair that also performs aggregation. Common in single buildings and mid-size campuses.
Three-tier: access uplinks to aggregation per building or zone, and aggregation uplinks to a core. Common on large campuses where many buildings connect to the core.
VSF at the access layer
A statement such as "access closets use CX 6300 VSF stacks in a ring" tells you:
Each closet is one logical switch with one management IP address (Section 3.1).
You will configure VSF links on the designated ports, a secondary member for the Standby role, and vsf split-detect mgmt if the management ports are cabled (Section 3.2).
Uplinks should come from at least two members so the closet survives a member failure.
VSX at aggregation or core
"Aggregation is a CX 8360 VSX pair with active-gateway" tells you:
Two switches with independent control planes, an ISL LAG, and a keepalive (Section 3.3).
Each access closet connects with a VSX-LAG , one or more links to each peer, so no links are blocked by spanning tree.
User default gateways live on SVIs on both peers with active-gateway : the same virtual IP and virtual MAC on both peers (Section 3.4).
The Layer 2 / Layer 3 boundary
If gateways are on the VSX pair, every user VLAN must be created on the access stack, carried on the access uplink trunk, and allowed on the VSX-LAG. If the design says routed access , the access switch owns the gateways and the uplinks become routed links running OSPF, so VLANs stay inside the closet.
Wireless forwarding model
Tunneled SSID (AOS 10 with a gateway cluster): the access port to the AP needs only the AP management VLAN; client VLANs live on the gateway cluster (Section 7.2).
Bridged SSID: the client VLAN must be tagged on the AP port and on every trunk up to its default gateway.
Mixed: both rules apply, SSID by SSID.
A Worked Example
The HLD for a three-floor office says:
- "Each floor has a CX 6300 VSF ring. Uplinks: VSX-LAG to a CX 8360 VSX core pair."
- "User, voice, and IoT gateways: active-gateway on the core. OSPF area 0 from the core to the WAN edge."
"AOS 10 APs. Corporate SSID: WPA3-Enterprise, tunneled to a two-gateway cluster. Guest SSID: bridged to VLAN 500, internet only."
- "802.1X with ClearPass on desk ports; MAC-Auth for printers; phones get the voice VLAN through LLDP-MED."
- "Managed by Central."
Implementation implications an associate should list:
VSF: ring links and a secondary member per floor; management ports connected for split detection.
Uplinks: an LACP LAG on each stack with members on two different stack members, terminating on a VSX-LAG on the core.
VLANs on access trunks: user, voice, IoT, AP management, and VLAN 500 (because guest is bridged). Corporate wireless VLANs are not needed on access trunks because that SSID is tunneled.
Core: SVIs with active-gateway for each user VLAN, an OSPF uplink to the WAN edge, and passive OSPF on user SVIs.
Access ports: 802.1X and MAC-Auth with ClearPass as the RADIUS server, a voice VLAN flagged with voice , and dynamic authorization for CoA.
Central: devices added to the GreenLake workspace, subscriptions assigned, and groups or scopes prepared.
Questions to Raise with the Architect
A good associate does not guess. Typical clarifying questions:
Which ports are reserved for VSF links and uplinks on each model?
What should happen if ClearPass is unreachable: is there a critical role?
Is the guest VLAN routed by the core or only by the firewall?
Which DSCP values must be trusted, and on which ports?
Is there an out-of-band management network, and which VRF should management use?
Changing a design decision, such as converting a tunneled SSID to bridged because it is "simpler," is not the implementer's call.
Common Exam Traps
Confusing VSF and VSX roles in a design. VSF is a single logical switch for access stacking; VSX is a two-switch pair with separate control planes for aggregation or core.
Forgetting bridged SSID VLANs. A bridged SSID's VLAN must reach the AP port; a tunneled SSID's VLAN does not.
Treating the HLD as complete. Missing details are expected; they are resolved in the low-level design with the architect's input.