A customer is planning to add loT devices that connect wirelessly to the existing 802.1X SSID. The customer will use HPE Aruba Networking ClearPass to authenticate the loT devices by MAC address but…

Question

Exhibit

Options

• ARemove mac-authentication from the WLAN configuration
• BModify max-authentication failures to 0
• CAdd 12-auth-failthrough to the WLAN configuration
• DModify opmode wpa3-aes-gcm-256 to opmode wpa2-aes

• A
  8% (2)
• B
  4% (1)
• C
  84% (21)
• D
  4% (1)

Explanation

Option C is correct because when MAC authentication is added to an SSID, the controller attempts MAC auth first for all connecting devices. Without l2-auth-failthrough, a 802.1X client whose MAC isn't registered in ClearPass will fail MAC auth and be rejected entirely - never given the chance to complete 802.1X. Adding l2-auth-failthrough tells the controller: "if Layer 2 MAC auth fails, don't drop the client - fall through to the next configured method (802.1X)." This allows both populations to coexist on the same SSID.

Why the distractors are wrong:

• A - Removing MAC authentication would fix 802.1X clients but break IoT device authentication, defeating the whole purpose of the new design.
• B - max-authentication failures controls client lockout behavior, not the authentication method cascade; changing it to 0 doesn't resolve the failthrough problem.
• D - Changing opmode from WPA3 to WPA2 adjusts the encryption cipher suite, which is unrelated to how authentication methods are ordered or chained.

Memory tip: Think of l2-auth-failthrough as a waterfall - MAC auth is the first tier. IoT devices (registered MACs) are caught there. 802.1X devices miss that tier and fall through to the 802.1X tier below. Without the waterfall structure, missed devices just hit the floor and disconnect.

No community discussion yet for this question.