Refer to the exhibits. A company has added a new user group. Users in the group try to connect to the WLAN and receive errors that the connection has no Internet access. The users cannot reach any…

Question

Exhibit

Options

• AThe AOS device does not have the correct RADIUS dictionaries installed on it to understand the
• BThe AOS device has a server derivation rule configured on it that has overridden the role sent by
• CThe clients rejected the server authentication on their side because they do not have the root CA
• DThe role name that CPPM is sending does not match the role name configured on the AOS device.

• A
  14% (5)
• B
  31% (11)
• C
  8% (3)
• D
  47% (17)

Explanation

The scenario involves an AOS-8 Mobility Controller (MC) with a WLAN where a new user group has been added. Users in this group cannot connect to the WLAN, receiving errors indicating no Internet access and inability to reach resources. Exhibit 1 shows the ClearPass Policy Manager (CPPM) Access Tracker record for one user: CPPM sends an Access-Accept with the VSA Radius:Aruba:Aruba-User-Role user_group4. The endpoint is classified as "Known," but the user cannot access resources. Exhibit 2 (not provided but described) shows that the AOS device (MC) assigned the user's client to the "denyall" role, which likely denies all access, explaining the lack of Internet and resource access. CPPM sends the Aruba-User-Role VSA with the value "user_group4," indicating that the user should be assigned to the "user_group4" role on the MC. However, the MC assigns the client to the "denyall" role, which typically denies all traffic, resulting in no Internet or resource access. The issue lies in why the MC did not apply the "user_group4" role sent by CPPM.

No community discussion yet for this question.