A user attempts to connect to an SSID configured on an AOS-8 mobility architecture with Mobility Controllers (MCs) and APs. The SSID enforces WPA3-Enterprise security and uses HPE Aruba Networking…

Question

Options

• AApplies the rules in the logon role, then guest role, and the contractor role
• BApplies the rules in the contractor role
• CApplies the rules in the contractor role and the logon role
• DApplies the rules in the contractor role and guest role

• A
  2% (1)
• B
  80% (37)
• C
  11% (5)
• D
  7% (3)

Explanation

In an AOS-8 mobility architecture, the Mobility Controller (MC) manages user roles and policies for wireless clients connecting to SSIDs. When a user connects to an SSID with WPA3-Enterprise security, the MC uses 802.1X authentication to validate the user against an authentication server, in this case, HPE Aruba Networking ClearPass Policy Manager (CPPM). The SSID is configured with specific roles: Initial role: Applied before authentication begins (not specified in the question, but typically used for pre-authentication access). Logon role: Applied during the authentication process to allow access to authentication services (e.g., DNS, DHCP, or RADIUS traffic). 802.1X default role (guest): Applied if 802.1X authentication fails or if no specific role is assigned by the RADIUS server after successful authentication. In this scenario, the user successfully authenticates, and CPPM sends an Access-Accept message with an Aruba-User-Role Vendor-Specific Attribute (VSA) set to "contractor." The "contractor" role exists on the MC, meaning it is a predefined role in the MC's configuration. When the MC receives the Aruba-User-Role VSA, it applies the specified role ("contractor") to the user session, overriding the default 802.1X role ("guest"). The MC does not combine the contractor role with other roles like logon or guest; it applies only the role specified by the RADIUS server (CPPM) in the Aruba-User-Role VSA. This is the standard behavior in AOS-8 for role assignment after successful authentication when a VSA specifies a role.

No community discussion yet for this question.