Drag and Drop Question Match the topics of an AOS10 Tunneled mode setup between an AP and a Gateway. (Options may be used more than once or not at all.) Answer:

Question

Exhibit

Answer Area

Explanation

AOS10 Tunneled Mode: AP-to-Gateway Setup Explained

Overview

This is a matching exercise, not a sequential ordering. Each numbered position on the left corresponds to a specific role or step in the AOS10 Tunneled mode setup. You're dragging the correct concept to the correct descriptor. The "odd" ordering (Phase 2 before Phase 1) is the #1 source of confusion - more on that below.

In AOS10 Tunneled mode, an AP establishes a secure IPsec tunnel to an Aruba Gateway and forwards all client traffic through it. Two distinct processes happen: tunnel establishment (IPsec) and client authentication (802.1X + RADIUS).

Item-by-Item Breakdown

Position 1 → Authenticator

The AP acts as the 802.1X Authenticator for wireless clients.

In 802.1X, the Authenticator is the device that:

• Intercepts client traffic until authentication completes
• Relays EAP messages between the client (Supplicant) and the RADIUS server
• Enforces access (allow/deny) based on the RADIUS response

In tunneled mode, the AP takes this role directly - it doesn't offload authentication initiation to the Gateway. The AP is the enforcement point.

Position 2 → Negotiate IPsec Phase 2

IPsec Phase 2 (IKE Phase 2 / Quick Mode) establishes the actual IPsec Security Associations (SAs) used to encrypt and protect the data tunnel between the AP and Gateway.

This negotiates:

• Encryption algorithm for the data plane (e.g., AES-256)
• Integrity/hashing (e.g., SHA-256)
• Lifetime of the data SA

This is the tunnel that client traffic flows through.

Position 3 → RADIUS proxy

The Gateway acts as a RADIUS proxy.

Once the AP has authenticated a client via 802.1X, the RADIUS request is forwarded through the IPsec tunnel to the Gateway. The Gateway:

• Receives the RADIUS Access-Request from the AP
• Proxies it to the corporate RADIUS server (e.g., ClearPass)
• Returns the RADIUS response back to the AP

This keeps the AP simple - it doesn't need a direct route to the RADIUS server.

Position 4 → Negotiate IPsec Phase 1

IPsec Phase 1 (IKE Phase 1 / Main Mode or Aggressive Mode) establishes the IKE Security Association - a secure, authenticated channel used only for control-plane negotiation between the AP and Gateway.

This negotiates:

• Diffie-Hellman group (key exchange)
• Encryption/integrity for IKE messages
• Mutual authentication (certificates or pre-shared key)

Phase 1 must complete before Phase 2 can begin.

Common Mistakes and Misconceptions

Quick Summary Table

No community discussion yet for this question.