The Aruba 5400R zl2 Switch Series delivers enterprise-class resiliency with innovative flexibility and scalability for customers
creating
series brings scalable aggregation with Virtual Switching Framework (VSF) stacking technology, hitless failover, and Fast Sof
Upgrade f
robust QoS and policy
Based on a powerful ProVision ASIC, the Aruba 5400R zl2 Switch Series
crossbar switching fabric with low 2.1
This series offers flexible connectivity options with 6 or 12 slot
multigigabit or 10GbE
to deploy, use and manage using Aruba AirWave or Aruba Central.
portal support. The switches include a Limited Lifetime Warranty.
Aruba 5412R zl2 Switch
Key Features
•
• Advanced security and network management via Aruba ClearPass Policy Manager, Aruba AirWave and Aruba Central
smart digital workplaces that are optimized for mobile users with an integrated wired and wireless approach. This modular
tware
or 5400R VSF stacks. The advanced Layer 2 and 3 feature set includes OSPF, IPv6, IPv4 BGP, dynamic segregation,
-based routing with no software licensing required.
has a high-speed, high-capacity architecture with 2 Tbps
µ robust feature support, and value with flexible programmability for the latest applications.
compact chassis, line rate 40GbE, up to 96 line rate Smart Rate
ports and up to 288 ports of PoE+ for powering access points, cameras and IoT devices. The 5400R is easy
Aruba ClearPass offers centralized security and external captive
Powerful Aruba Layer 3 modular switch with VSF stacking, dynamic segmentation, low latency and resiliency.
• HPE Smart Rate for high speed multi gigabit bandwidth and PoE+ power.
• Scalable with line rate 40GbE for wireless traffic aggregation.
• Resilient with redundant management and hot swappable power supplies.
• Up to 288 ports of PoE+
• Software-defined ready with REST APIs and OpenFlow support.
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Overview
2
Models
Aruba 5406R zl2 Switch
J9821A
Aruba 5412R zl2 Switch
J9822A
Aruba 5412R 92GT PoE+ and 4-port SFP+ (No PSU) v3 zl2 Switch
Aruba 5406R 44GT PoE+ and 4-port SFP+ (No PSU) v3 zl2 Switch
JL003A
Aruba 5406R 16-port SFP+ (No PSU) v3 zl2 Switch
JL095A
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
3
Enhanced Capabilities
Simplified configuration and management
Advertises and receives management information from adjacent devices on a network, facilitating easy mapping by network
Stores easily to the flash image
Connectivity
provides automatic adjustments for straight-through or crossover cables on all 10/100 and 10/100/1000 ports
• Aruba Central cloud-based management platform
Offers simple, secure, and cost effective way to manage switches
•Zero Touch ProVisioning (ZTP)
Simplifies installation of the switch infrastructure using Aruba Activate-based or DHCP based process with AirWave and
Central Network Management
• Flexible management
Supports both cloud-based Central and on-premise AirWave without ripping and replacing switching infrastructure
• IP SLA for Voice
Monitors quality of voice traffic using the UDP Jitter and UDP Jitter for VoIP tests (requires v3 modules).
•Built-in programmable and easy to use REST API interface
provides configuration automation for campus networks
•Remote intelligent mirroring
Mirrors selected ingress/egress traffic based on ACL, port, MAC address, or VLAN to a local or remote HPE 8200 zl, 6600,
6200 yl, 5400 zl, 5400R, 3500, or 3800 Switch located anywhere on the network
•RMON, XRMON, and sFlow
Provide advanced monitoring and reporting capabilities for statistics, history, alarms, and events
• IEEE 802.1AB Link Layer Discovery Protocol (LLDP)
management applications
• Unidirectional link detection (UDLD)
Monitors the link between two switches and blocks the ports on both ends of the link if the link goes down at any point
between the two devices
• Management simplicity
Provides common software features and CLI implementation across all HPE ProVision-based switches (including the zl and
yl switches)
• Command authorization
Leverages RADIUS to link a custom list of CLI commands to an individual network administrator's login; an audit trail
documents activity
• Friendly port names
Allow assignment of descriptive names to ports
• Dual flash images
Provides independent primary and secondary operating system files for backup while upgrading
• Multiple configuration files
• IEEE 802.3az Energy Efficient Ethernet
lowers power consumption in periods of low link usage (supported on v2 and higher 10/100/1000 and 10/100 modules)
•IEEE 802.3at Power over Ethernet (PoE+)
provides up to 30 W per port that allows support of the latest PoE+ capable devices such as IP phones, wireless access
points, and security cameras, as well as any IEEE 802.3af-compliant end device; eliminates the cost of additional electrical
cabling and circuits that would otherwise be necessary in IP phone and WLAN deployments
• Support for pre-standard PoE
detects and provides power to pre-standard PoE devices
•High-density port connectivity
provides up to 12 interface module slots and up to 288 wire-speed 10/100/1000 PoE-enabled ports, 96 10-GbE ports , or
96 Smart Rate multi-gigabit ports per system
• Jumbo frames
support high-performance remote backup and disaster-recovery services
•Auto-MDIX
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
4
Resiliency and high availability
allows groups of two routers to dynamically back each other up to create highly available routed environments for IPv4 and
provides easy-to-configure link redundancy of active and standby links
Performance
requirements of the network applications
Software-defined networks
troubleshooting.
• Virtual Switching Framework (VSF)
creates one virtual resilient switch from two switches; servers or switches can be attached using standard LACP for
automatic load balancing and high availability; simplify network operation by reduce the need for complex protocols like
Spanning Tree Protocol (STP), Equal-Cost Multipath (ECMP), and VRRP (requires v3 modules).
• Fast Software Upgrade
reduces downtime of the VSF stack during an upgrade by sequentially upgrading the members in the stack shrinking the
downtime to a few seconds (requires v3 modules).
• Virtual Router Redundancy Protocol (VRRP)
IPv6 networks
• Nonstop switching
improves network availability to better support critical applications such as unified communication and mobility; interface
and fabric modules continue switching traffic during failover from active to standby management module
•Nonstop routing
enhances Layer 3 high availability; OSPFv2/v3 and VRRP will continue to operate and route network traffic during failover
from an active to a standby management module
• Redundant management and power
provide enhanced system availability and continuity of operations
•IEEE 802.1s Multiple Spanning Tree Protocol
provides high link availability in multiple VLAN environments by allowing multiple spanning trees; encompasses IEEE
802.1D Spanning Tree Protocol and IEEE 802.1w Rapid Spanning Tree Protocol
• IEEE 802.3ad Link Aggregation Control Protocol (LACP) and Hewlett Packard Enterprise port trunking
support up to 144 trunks, each with up to eight links (ports) per trunk
• Distributed trunking
enables loop-free and redundant network topology without using Spanning Tree Protocol; allows a server or switch to
connect to two switches using one logical trunk for redundancy and load sharing
• Optional redundant power supply
provides uninterrupted power and allows hot-swapping of the redundant power supplies when installed
•Hot-swappable modules
allows dissimilar modules, and power supplies in a redundant power supply configuration to be added or swapped without
interrupting the network
• Sparing simplicity
with zl-common accessories (interface modules and power supplies)
•Uplink Failure Detection
provides active-standby network path redundancy for servers that are configured for active-standby NIC teaming
• SmartLink
• High-speed, high-capacity architecture
2 Tbps crossbar switching fabric provides intra-module and inter-module switching with 785.7 million pps throughput on
the purpose-built ProVision ASICs
• Selectable queue configurations
allows for increased performance by selecting the number of queues and associated memory buffering that best meet the
• Multiple programmatic interfaces
Supports REST APIs, Openflow 1.0 and 1.3, and more, to enable automation of network operations, monitoring, and
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
5
Quality of Service (QoS)
VLAN
Unified Wired and Wireless Support
Automatically configures switch for different settings such as VLAN, CoS, PoE max power, and PoE priority when an Aruba
Node, users are authenticated with ClearPass Policy Manager which can direct the traffic to be tunneled
Provides a way for ClearPass to do accounting for clients with static IP addresses
Layer 3 routing
• provides IPv4 Border Gateway Protocol routing, which is scalable, robust, and flexible
• Advanced classifier-based QoS
Classifies traffic using multiple match criteria based on Layer 2, 3, and 4 information; applies QoS policies such as setting
priority level and rate limit to selected traffic on a per-port or per-VLAN basis
• Traffic prioritization
Allows real-time traffic classification into eight priority levels mapped to eight queues
uses an access control list (ACL) to enforce increased bandwidth for ingress traffic on each port
− Supports per-port, per-queue
egress-based reduced bandwidth
• Class of Service (CoS)
Sets the IEEE 802.1p priority tag based on IP address, IP Type of Service (ToS), Layer 3 protocol, TCP/UDP port number,
source port, and DiffServ
• Unknown Unicast Rate Limiting throttles unicast packets with unknown destination addresses and limits flooding on the
• Supports unified wired and wireless policies
Using Aruba ClearPass Policy Manager
•Switch auto-configuration
access point is detected.
•User role
Defines a set of switch-based policies in areas such as security, authentication, and QoS. A user role can be assigned to a
group of users or devices, using switch-based local user role or download from ClearPass.
• Improved network simplicity and security
• Aruba Dynamic Segmentation automatically enforces user, device and application-aware policies on Aruba wired and
wireless networks. Automated device profiling, role-based access control, and Layer 7 firewall features deliver enhanced
visibility and performance for a better overall experience for both IT and end-users alike.
•Dynamic segregation
Provides a secured tunnel to transport network traffic on a per-port or per-user-role basis to an Aruba Controller. In peruser-role Tunneled
to Aruba controller or switch locally.
• Static IP visibility
• Static IP routing
provides manually configured routing for both IPv4 and IPv6 networks
•Routing Information Protocol (RIP)
provides RIPv1, RIPv2, and RIPng routing
• OSPF
provides OSPFv2 for IPv4 routing and OSPFv3 for IPv6 routing
• Policy-based routing
uses a classifier to select traffic that can be forwarded based on policy set by the network administrator (requires v2 or
higher modules)
• Border Gateway Protocol (BGP)
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
6
Layer 3 services
centralizes and reduces the cost of IPv4 address management
IPv6
provides RA guard, DHCPv6 protection, dynamic IPv6 lockdown, and ND snooping
Layer 2 switching
concurrent Layer 3 routing with v2 or higher modules
• Bidirectional Forwarding Detection (BFD)
monitor link connectivity and reduces network convergence time for OSPFv2, and VRRP (requires v3 modules)
• User Datagram Protocol (UDP) helper function
allows UDP broadcasts to be directed across router interfaces to specific IP unicast or subnet broadcast addresses and
prevents server spoofing for UDP services such as DHCP
• Loopback interface address
defines an address in Routing Information Protocol (RIP) and Open Standard Path First (OSPF), improving diagnostic
capability
• Route maps
provide more control during route redistribution; allow filtering and altering of route metrics
• DHCP server
• IPv6 host
• enables switch management in an IPv6 network
• Dual stack (IPv4 and IPv6)
• transitions IPv4 to IPv6, supporting connectivity for both protocols
• MLD snooping
• forwards IPv6 multicast traffic to the appropriate interface
• supports encapsulation of IPv6 traffic in IPv4 packets
• Security
• VLAN support and tagging
supports the IEEE 802.1Q standard and 4094 VLANs simultaneously
• IEEE 802.1v protocol VLANs
isolate select non-IPv4 protocols automatically into their own VLANs
• VxLAN
encapsulation (tunneling) protocol for overlay network that enables a more scalable virtual network deployment (requires
v3 modules)
• GVRP and MVRP
allows automatic learning and dynamic assignment of VLANs
•IEEE 802.1ad Q-in-Q
increases the scalability of an Ethernet network by providing a hierarchical structure; connects multiple LANs on a highspeed campus or metro network
•MAC-based VLAN
provides granular control and security; uses RADIUS to map a MAC address/user to specific VLANs (requires v2 or higher
modules)
•Rapid Per-VLAN Spanning Tree (RPVST+)
allows each VLAN to build a separate spanning tree to improve link bandwidth usage; is compatible with PVST+
• Hewlett Packard Enterprise switch meshing
dynamically load balances across multiple active redundant links to increase available aggregate bandwidth; allows
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
7
Security
source/destination TCP/UDP port number
s per switch port accepts up to 32 sessions of IEEE
e with other ports in the same community and/or an uplink port, regardless of VLAN ID or
• Secure Sockets Layer (SSL)
• Control plane policing
sets rate limit on control protocols to protect CPU overload from DOS attacks
• Access control lists (ACLs)
provide filtering based on the IP field, source/destination IP address/subnet, and
on a per-VLAN or per-port basis
• Multiple user authentication methods
– uses an IEEE 802.1X supplicant on the client in conjunction with a RADIUS server to authenticate in accordance
with industry standards
– Web-based authentication provides a browser-based environment, similar to IEEE 802.1X, to authenticate clients
that do not support IEEE 802.1X
– Supports MAC-based client authentication MAC-based authentication
– Concurrent IEEE 802.1X, Web, and MAC authentication scheme
802.1X, Web, and MAC authentications
• Private VLAN
provides network security by restricting peer-to-peer communication to prevent a variety of malicious attacks; typically a
switch port can only communicat
destination MAC address
• DHCP protection
blocks DHCP packets from unauthorized DHCP servers, preventing denial-of-service attacks
• Secure management access
delivers secure encryption of all access methods (CLI, GUI, or MIB) through SSHv2, SSL, and/or SNMPv3
•Switch CPU protection
provides automatic protection against malicious network traffic trying to shut down the switch
• ICMP throttling
defeats ICMP denial-of-service attacks by enabling any switch port to automatically throttle ICMP traffic
•Identity-driven ACL
enables implementation of a highly granular and flexible access security policy and VLAN
• assignment specific to each authenticated network user
• STP BPDU port protection
blocks Bridge Protocol Data Units (BPDUs) on ports that do not require BPDUs, preventing forged BPDU attacks
• Dynamic IP lockdown
works with DHCP protection to block traffic from unauthorized hosts, preventing IP source address spoofing
• Dynamic ARP protection
blocks ARP broadcasts from unauthorized hosts, preventing eavesdropping or theft of network data
• STP Root Guard
protects the root bridge from malicious attacks or configuration mistakes
• Detection of malicious attacks
monitors 10 types of network traffic and sends a warning when an anomaly that potentially can be caused by malicious
attacks is detected
• Port security
allows access only to specified MAC addresses, which can be learned or specified by the administrator
• MAC address lockout
prevents particular configured MAC addresses from connecting to the network
•Source-port filtering
allows only specified ports to communicate with each other
•RADIUS/TACACS+
eases switch management security administration by using a password authentication server
• Secure Shell
encrypts all transmitted data for secure remote CLI access over IP networks
• Radius over TLS (RadSec)
allows users to use a more secure and reliable mode of communications between switch and radius servers over unsecure
networks
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
8
encrypts all HTTP traffic, allowing secure access to the browser-based management GUI in the switch
enrollment and renewal
Convergence
• Secure FTP
allows secure file transfer to and from the switch; protects against unwanted file downloads or unauthorized copying of a
switch configuration file
• Open Authentication Role
simplifies first-time deployment of AAA in brownfield deployments by allowing full network access for failed clients and
provides instant connectivity as soon as a client is plugged-in
• Critical Authentication Role
ensures that important infrastructure devices such as IP phones are allowed network access even in the absence of a
RADIUS server
•MAC Pinning
allows non-chatty legacy devices to stay authenticated by pinning client MAC addresses to the port until the clients logoff
or get disconnected
• Management Interface Wizard
helps secure management interfaces such as SNMP, telnet, SSH, SSL, Web, and USB at the desired level
• Switch management logon security
helps secure switch CLI logon by optionally requiring either RADIUS or TACACS+ authentication
• Security banner
displays a customized security policy when users log in to the switch
•IEEE 802.1AE MACsec
provides security on a link between two switch ports (1Gbps or 10Gbps) using standard encryption and authentication
based on pre-shared key. MACsec software support not yet available for modules with Smart Rate ports (requires v3
modules)
• Enrollment over Secure Transport (EST)
enhances the switch PKI infrastructure with a simpler, scalable and more secure method of certificate provisioning, re-
• IP multicast routing
• IP multicast snooping (data-driven IGMP)
• Protocol Independent Multicast for IPv6
• LLDP-MED (Media Endpoint Discovery)
• PoE allocations
• Auto VLAN configuration for voice
• Local MAC Authentication
includes PIM Sparse and Dense modes to route IP multicast traffic
automatically prevents flooding of IP multicast traffic
supports one-to-many and many-to-many media casting use cases such as IPTV over IPv6 networks
defines a standard extension of LLDP that stores values for parameters such as QoS and VLAN to configure automatically
network devices such as IP phones
support multiple methods (automatic, IEEE 802.3af class, LLDP-MED, or user specified) to allocate PoE power for more
efficient energy savings
– RADIUS VLAN: uses a standard RADIUS attribute and LLDP-MED to automatically configure a VLAN for IP
phones
– CDPv2: uses CDPv2 to configure legacy IP phones
assigns attributes such as VLAN and QoS using locally configured profile that can be a list of MAC prefixes
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Standard Features
9
Warranty, Services and Support
• Limited Lifetime Warranty
See https://www.arubanetworks.com/support-services/ product-warranties/
included with your product purchase
• For Software Releases and Documentation, refer to https://asp.arubanetworks.com/downloads
• For support and services information, visit https://www.arubanetworks.com/support-services/arubacare/
for warranty and support information
Page
QuickSpecs
Aruba 5400R zl2 Switch Series
Configuration
Information
10
Build To Order:
BTO is a standalone unit with no integration. BTO products ship standalone are not part of a CTO or Rack-Shippable solution.