CloudLabBox
Try the free demo

HPE Aruba Networking CX switching labs

16 guided labs on AOS-CX 10.14 switches, from your first CLI session to a VSX campus core: VLANs and LAGs, MSTP, inter-VLAN routing with DHCP relay, OSPF, VSX with active gateway, ACLs and policies, dual-homed BGP with a guest VRF, and the REST API, with a troubleshooting lab and a capstone built from a design. Part 4 adds four Lite labs on access security: 802.1X and MAC authentication against a lab RADIUS server, port-access roles and policies, DHCP snooping and port security, and a troubleshooting lab with six planted faults.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 10 of the 16 labs also run in the free demo.

Guided labs
16
Follows
HPE Aruba Networking switching (HPE6-A86 and HPE7-A08)
Runs every lab
Standard
Devices
AOS-CX virtual switch, Alpine Linux and EVE-NG GUI server

Who these labs are for

For engineers preparing for the HPE Aruba Networking switching associate (HPE6-A86) or professional (HPE7-A08) exam, administrators moving to AOS-CX from ArubaOS-Switch or another vendor, and anyone who wants VSX, MSTP, OSPF and REST practice on real AOS-CX.

The AOS-CX simulator doesn’t act on QoS policies, mirroring, policy-based routing or classifier policies outside port-access roles, it has no ARP protection, and its links never go down; the labs that touch these say so.

The 16 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

HPE Aruba Networking CX course 16 labs

Shared folderHPE Aruba Networking CX switching guided labs

One switching topic per lab, a campus with five planted faults, a VSX campus core capstone, then four labs on access security.

  1. 01AOS-CX CLI and management access with checkpoints

    Bring two factory-fresh AOS-CX switches to a documented, secured baseline: learn the CLI contexts, build out-of-band management in the mgmt VRF with SSH, HTTPS, NTP, syslog and SNMP, add role-based users, and make changes safely with checkpoints and auto-rollback.

    2× AOS-CX virtual switch

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  2. 02VLANs and trunks with the native VLAN and LLDP

    Split a flat network into VLANs on two AOS-CX switches, carry them over an 802.1Q trunk with a deliberate native VLAN, document the cabling with LLDP and read the MAC address table.

    2× Alpine Linux, 2× AOS-CX virtual switch

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  3. 03Link aggregation with static LAG and LACP

    Join two AOS-CX switches with two cables safely: build a static LAG, convert it to LACP, tune the LACP rate and hash, and prove that a member failure doesn't interrupt traffic.

    2× Alpine Linux, 2× AOS-CX virtual switch

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  4. 04MSTP design and loop protection

    Replace the accidental spanning tree of a looped triangle with a designed MSTP region: two instances with roots on different distribution switches, edge ports with BPDU guard, root guard towards the access layer, and loop protect for unmanaged switches.

    3× AOS-CX virtual switch, 1× Alpine Linux

    7 vCPU, 9,728 MBFits Standard

  5. 05Inter-VLAN routing with a DHCP server and relay

    Make an AOS-CX core switch the default gateway for two VLANs, connect it to a services switch over a routed link with static routes, run a DHCP server on the services switch and relay host requests to it.

    2× Alpine Linux, 2× AOS-CX virtual switch

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  6. 06OSPF from one area to a multi-area campus

    Route a three-switch campus with OSPFv2 on AOS-CX: point-to-point backbone links with authentication, passive user interfaces, a second area summarised at its ABR, a totally stubby area that only needs a default route, and a default route from the core.

    3× AOS-CX virtual switch, 2× Alpine Linux

    8 vCPU, 10,240 MBFits Standard

  7. 07VSX with VSX LAGs and active gateway

    Build a VSX pair from two AOS-CX core switches: the inter-switch link, a keepalive in its own VRF, a shared system MAC, a multi-chassis LAG to the access switch and an active gateway that both cores answer, then read the VSX state and consistency checks like an operator.

    3× AOS-CX virtual switch, 2× Alpine Linux

    8 vCPU, 10,240 MBFits Standard

  8. 08ACLs and policies with control-plane protection and QoS

    Protect Northwind's servers and switches on AOS-CX: an object-group-based ACL on the user port, a control-plane ACL that limits SSH to the admin workstation, and a classifier policy that marks voice traffic with DSCP EF.

    2× Alpine Linux, 1× AOS-CX virtual switch

    4 vCPU, 4,096 MBFits LiteRuns in the free demo

  9. 09Dual-homed BGP with route policy and a guest VRF

    Connect Northwind's AOS-CX core to two ISPs with eBGP: advertise only the corporate prefix, prefer ISP-A for outbound traffic with local preference, steer inbound traffic with AS-path prepending, and keep guest traffic in its own VRF with its own exit.

    3× AOS-CX virtual switch, 2× Alpine Linux

    8 vCPU, 10,240 MBFits Standard

  10. 10The AOS-CX REST API with curl and Python

    Open the AOS-CX REST API safely in the mgmt VRF, then use it from an Ubuntu workstation: log in and read data with curl, explore the API reference in a browser, create a VLAN and update an interface, and run Python scripts that inventory the switch and save its configuration.

    1× AOS-CX virtual switch, 1× EVE-NG GUI server

    3 vCPU, 5,120 MBFits LiteRuns in the free demo

  11. 11Troubleshooting a campus with five planted faults

    A branch was rebuilt over the weekend and nothing works properly: half the LAG is missing, one VLAN can't reach its gateway, the access switch can't be managed and nobody reaches the application server. Find and fix five planted faults on AOS-CX with a bottom-up method.

    3× AOS-CX virtual switch, 2× Alpine Linux

    8 vCPU, 10,240 MBFits Standard

  12. 12Capstone - a VSX campus core from a design

    Build a complete campus core from factory defaults: a VSX pair with ISL and keepalive, a VSX LAG to the access switch, active gateways for two VLANs, OSPF towards the WAN switch, DHCP relay to a central server, edge protection and checkpoints, then prove it end to end.

    4× AOS-CX virtual switch, 2× Alpine Linux

    10 vCPU, 13,312 MBFits Standard

  13. 13802-1X port access with RADIUS and local roles

    Close Northwind's open wall ports: point AOS-CX at a RADIUS server, build local roles, turn on 802.1X and watch real EAP logins pick a role and a VLAN, with a reject role, re-authentication, accounting and RADIUS logins to the switch itself.

    1× AOS-CX virtual switch, 3× EVE-NG GUI server

    5 vCPU, 6,144 MBFits LiteRuns in the free demo

  14. 14MAC authentication with role policies and device profiles

    Bring printers and cameras onto a port-access network without opening it up: MAC authentication, a role policy that really drops traffic, client and device mode side by side, a device profile, 802.1X and MAC authentication on one port, and a critical role for a RADIUS outage.

    1× AOS-CX virtual switch, 4× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  15. 15DHCP snooping and port security with an ARP spoofing demo

    Watch a rogue DHCP server hand out its own gateway, then stop it with DHCP snooping, trusted ports and a binding limit, lock a shared port with sticky port security, and see an ARP spoof that this virtual switch cannot block.

    1× AOS-CX virtual switch, 4× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  16. 16Troubleshooting access security with six planted faults

    A rushed rollout left Northwind's 802.1X, MAC authentication and DHCP snooping broken in six places, on the switch and on the RADIUS server. Follow the chain from the client through RADIUS to the role and the policy, and fix each fault as the last one uncovers the next.

    1× AOS-CX virtual switch, 4× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the Aruba CX practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
Aruba AOS-CX virtual switcharubacx-10.142 vCPU, 3,072 MB1633
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB1019
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 2,048 MB; 1 vCPU, 1,024 MB516

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HPE Aruba Networking CX switching guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the Aruba CX labs

Are these Aruba CX labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 10 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 10 of the 16. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone - a VSX campus core from a design”, needs 10 vCPU and 13,312 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Hewlett Packard Enterprise?

No. CloudLabBox wrote them to follow the topics of HPE Aruba Networking’s switching exams, HPE6-A86 (Certified Associate) and HPE7-A08 (Certified Professional). They aren’t training material from Hewlett Packard Enterprise, and CloudLabBox is independent of Hewlett Packard Enterprise.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 10 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Hewlett Packard Enterprise. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.