HPE Campus CX Switching Portfolio Advancements with Yash Nagaraju

Most troubleshooting time is spent finding the problem, while much of the downtime comes from applying critical network and security updates. Join us for a discussion and live demo of the latest innovations in HPE Networking CX switches, including Dynamic Packet Capture, end-to-end application diagnostics, and enhanced In-Service Software Upgrade (ISSU) capabilities that help accelerate root-cause identification and minimize operational disruption. You’ll also see how the CX6300M combines always-on resiliency with high-density edge performance to support demanding enterprise Wi-Fi 7, video, and IoT environments. Yash Nagaraju presented the session at Networking Field Day 41.

Nagaraju said HPE treats high availability as a framework rather than a feature, which matters more as vulnerability patches pile up. Every CX switch, from the 6000 to the 9300, supports hot patching for critical fixes. In-release ISSU arrived in 2023, and HPE now offers standalone ISSU too, with no extra license required. The cloud-native AOS-CX design lets microservices restart against a database that serves as the single source of truth while the ASIC keeps forwarding. Delegates noted the industry has been burned by ISSU for decades, and Nagaraju invited lab testing and pointed to a large retailer that upgraded its whole fleet this way. He then demonstrated a major-to-major ISSU on a ten-member VSF stack, using kexec to replace the Linux OS. MAC learning, MACsec, BFD, and IPFIX export pause during the process, and it aborts if the target image or TCAM programming fails validation. Stackable ISSU is limited to the 6300 and 6400 because smaller platforms lack CPU headroom.

The second half made the case for HPE’s custom silicon, built for campus over 30 years. A common architecture scales from 10 Mbps to 100 Gbps, so features behave the same from a 6200 in a small clinic to an 8360 in the core. Flexible TCAM fits IPv4 and IPv6 entries on the same row to avoid exhaustion, and nine parallel ingress lookups plus four at egress support advanced policy without added latency. Virtual output queuing drops congested traffic at ingress instead of carrying it across the fabric. Application recognition inspects the first packets of HTTPS flows, so operators can enforce application-based policy in TCAM, and reflexive ACLs block traffic that servers initiate. The closing platform delivers 90 watts on every port. Nagaraju argued that this level of control over silicon is what makes per-client visibility and hitless upgrades possible.