HPE Aruba Architecture & Aruba Central — AOS 8 vs 10, Cloud vs Controller

The wrong answer everyone gives first

Ask a fresher "what is Aruba's architecture?" and they say: "controller + access points, like Cisco." That was true in 2018. It is half-wrong in 2026. Aruba now ships two operating systems with two completely different control planes, and confusing them is the fastest way to fail an interview or break a migration.

Here is the truth in one line. AOS 8 = an on-prem brain (Mobility Conductor) commanding controllers. AOS 10 = a cloud brain (Aruba Central) commanding lightweight gateways. Same APs can run either OS — the OS decides who is the boss.

Quick warm-up — 3 predictions before we dive

Answer these from gut feel. You'll see all three again, fully explained, by the end.

① The AOS 8 stack — the on-prem hierarchy

AOS 8 is a top-down hierarchy. At the top sits the Mobility Conductor, which stores one master configuration and pushes it down a tree of Mobility Controllers. The controllers terminate the AP tunnels, run firewall/role policy, and handle client roaming. APs are relatively thin — they trust the controller for almost everything.

The catch: this model assumes everything lives in your data centre. The Conductor, the controllers and the APs all need to reach each other with SNMP, AMON (Aruba's telemetry) and IPsec. That's a lot of east-west trust inside one site, and it does not stretch cleanly across the internet.

② AOS 10 + Aruba Central — the cloud-native model

AOS 10 throws out the on-prem brain. Aruba Central becomes the single management plane. There is no Mobility Conductor and no Mobility Controller. Instead you have two device roles: APs and gateways. Gateways form clusters purely for data-plane termination and redundancy — they no longer hold the master config.

The headline win is Zero-Touch Provisioning. Plug an AP into PoE, it reaches Central over TCP 443, and Central streams down its config. No console cable, no maintenance window.

③ Forwarding modes — the choice that defines your data plane

This is the single most tested AOS 10 design topic. Once Central is your brain, you still must decide where client packets go. AOS 10 gives three answers per SSID/VLAN.

④ Cloud vs Controller — the decision & the traps

So which architecture do you actually deploy? AOS 10 is HPE Aruba's strategic direction, but AOS 8 is far from dead — and some hardware (7000/7200 controllers) only ever runs AOS 8. The honest answer is "it depends on hardware, connectivity and compliance".

The security gotcha you cannot skip — PAPI / UDP 8211

Architecture isn't just boxes — it's attack surface. Aruba's internal management protocol PAPI rides on UDP 8211, and it has been a repeat target.

(MC) [mynode] (config) #firewall enable-per-packet-logging
(MC) [mynode] (config) #control-plane-security
(MC) [mynode] (cps) #cluster-member-custom-cert
(MC) [mynode] (config) #papi enhanced-security
(MC) [mynode] (config) #papi enhanced-security-key <non-default-key>

Enhanced PAPI security: Enabled
PAPI key source: custom (non-default)
Warning: all cluster members must share the same key
         before commit, or control-plane sessions will drop.

The certification map — where this lesson lands

This architecture knowledge is foundational across the HPE Aruba Networking track: from ACA (associate), up through ACP – Campus Access (HPE7-A01) which explicitly tests gateway clusters, tunnel/mixed mode, MPSK and Central resiliency, to the expert ACX – Campus Access Mobility (HPE7-A07). The wired-switching cousin is ACSP (HPE6-A73) on AOS-CX. Nail AOS 8 vs 10 and you've cleared the highest-frequency exam topic in the whole track.