A company has AOS-CX switches and HPE Aruba Networking APs, which run AOS-10 and bridge their SSIDs. Company security policies require 802.1X on all edge ports, some of which connect to APs. How…

Question

Options

• ALeave all edge ports in client auth-mode and configure device auth-mode in the AP role.
• BConfigure all edge ports in client auth-mode.
• CConfigure all edge ports in device auth-mode.
• DLeave all edge ports in device auth-mode and configure client auth-mode in the AP role.

• A
  67% (38)
• B
  19% (11)
• C
  5% (3)
• D
  9% (5)

Explanation

Option A is correct because AOS-CX edge ports default to client auth-mode, where each connected device authenticates individually via 802.1X - the right behavior for standard wired clients. However, APs bridging SSIDs serve multiple wireless clients over a single wired port, so once an AP authenticates and is placed into its AP role, that role is configured with device auth-mode, which authenticates the AP as a single network device and allows its associated wireless clients to pass traffic without each needing a separate 802.1X challenge from the switch.

B fails because leaving all ports in client auth-mode with no role-based override means the switch would expect every wireless client to independently 802.1X authenticate to the switch port - a broken workflow when an AP is bridging multiple SSIDs. C is wrong because putting every edge port in device auth-mode undermines per-client 802.1X enforcement on standard wired ports, violating the security policy. D reverses the logic entirely - assigning client auth-mode inside the AP role would undo the device-level treatment the AP port needs, while defaulting everything to device auth-mode neglects proper per-client authentication elsewhere.

Memory tip: Think of it as "default strict, relax for infrastructure." Start all ports in client mode (strictest), then use the AP role to switch to device mode - because roles apply after authentication, letting the AP prove itself first before being trusted to forward for its clients.

No community discussion yet for this question.