HPE7-A07 Aruba Certified Campus Access Mobility Expert Written Exam Questions and Answers

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

In HPE Aruba Networking User Experience Insight (UXI), when a sensor performs continuous network and application testing, it generates packet captures as part of the diagnostic information available for download from the UXI dashboard. These captures are packaged into a compressed (.zip) file that typically contains multiple .pcap files categorized by test results and test types.

According to the Aruba UXI operational documentation, the sensor separates captured test traffic based on success or failure results for clarity and troubleshooting efficiency. The “datagrams.pcap” file includes only packet captures of successful tests that completed as expected, while the “datagrams-failed.pcap” file contains captures for failed or incomplete tests.

Therefore, if you review only the datagrams.pcap file, you will see data from tests that passed successfully and will not find the failed attempts that may reveal connectivity or performance problems. To analyze failure-related issues (for instance, packet loss, authentication failures, or latency problems), it is necessary to examine the “datagrams-failed.pcap” file included in the same downloaded archive.

This behavior ensures a logical separation between functioning and problematic test sessions and allows engineers to focus analysis on the most relevant captures without confusion between successful and failed transactions.

The provided output is from the command:

(MC2) #show auth-tracebuf mac

This command traces the authentication exchange between the access point (or mobility controller) and the RADIUS server for a specific client. The trace provides insight into the 802.1X authentication sequence and RADIUS responses.

From the exhibit:

EAPOL (Extensible Authentication Protocol over LAN) Messages Observed:

eap-id-req

eap-id-resp

eap-req

eap-resp

eap-success

These messages clearly indicate that an 802.1X (EAP-based) authentication took place. MAC authentication (MAB) or WebAuth would not include multiple EAP identity and response messages.

RADIUS Messages:

rad-req, rad-resp, rad-accept from /RADIUS1

The presence of rad-accept indicates successful authentication.

Exact extract from ArubaOS (AOS-S/AOS 10 WLAN Authentication Guide):

“When the trace output shows EAP identity requests, EAP responses, and a RADIUS Access-Accept message, the authentication method in use is 802.1X (EAP-based user authentication). The presence of EAP-Success following the Access-Accept confirms successful 802.1X authentication.”

Follow-on WPA2 Key Exchange:

Lines show wpa2-key1, wpa2-key2, wpa2-key3, and wpa2-key4.

This sequence occurs after 802.1X authentication completes and is used to establish encryption keys for a WPA2 Enterprise session.

Exact extract from Aruba WLAN Troubleshooting Guide:

“After successful 802.1X authentication (EAP-Success), the controller exchanges four WPA2 keys with the station to derive the session keys used for data encryption. This confirms WPA2-Enterprise with 802.1X was used.”

No Indication of MAC or WebAuth:

MAC authentication would show mac-auth or macauth messages instead of eap-id-req/resp.

WebAuth involves HTTP-based redirection and is not visible in auth-tracebuf as EAP transactions.

Exact extract:

“MAC authentication shows ‘macauth start’ and ‘macauth accept’ entries, not EAPOL frames. WebAuth authentication uses a web redirect and does not appear as EAP frames in the trace buffer.”

Therefore, the trace confirms a WPA2-Enterprise 802.1X user authentication, where the user’s credentials were validated by the RADIUS server, followed by the WPA2 key handshake.

Why the Other Options Are Incorrect:

A. MAC authentication:Would show MAC-based request/response entries (macauth), not eap-id-req/resp.

C. WEBauth authentication:WebAuth occurs over HTTP/HTTPS and does not involve EAP messages; thus, no eap-id or eap-success would be seen.

D. 802.1X machine authentication:Machine authentication occurs before user logon and is typically identified in logs by a computer account (e.g., host/computername$). Here, the username and context indicate a user-level session.

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS 8/10 WLAN Authentication and Security Configuration Guide – “802.1X EAP Authentication and Trace Analysis.”

Aruba WLAN Troubleshooting Guide – “Using show auth-tracebuf to validate EAP authentication.”

Aruba Campus Wireless Design Fundamentals – “Understanding WPA2-Enterprise authentication flow (EAPOL, RADIUS, WPA2 4-Way Handshake).”

Aruba Access Security and AAA Implementation Guide – “Distinguishing between MAC, WebAuth, and 802.1X authentication in debug outputs.”

In the context of ArubaOS-CX, particularly with the 6300 series switches, setting the MTU on a routed Link Aggregation Group (LAG) interface requires the interface lag id command in the configuration, specifying the LAG interface you're configuring. The ip mtu command is then used to set the desired MTU size for that LAG. Option A correctly shows this configuration process, where the MTU is set to 9198 for the LAG interface, in line with the requirements for routing larger frames, which could be necessary for certain applications or data flows that require jumbo frames.

The information related to the configuration of Aruba switches is consistent with the principles and guidelines found in the technical documentation for the ArubaOS-CX 6300 series switches, which emphasizes the importance of correct MTU settings for network performance and stability.

In OSPF, when a router learns about an external network through both E1 and E2 advertisements, and if both have the same path cost, the router will prefer the E1 path. This is because E1 routes consider both the external cost to reach the external network and the internal cost to reach the ASBR, providing a more comprehensive metric. E2 routes only consider the external cost and ignore the internal cost to the ASBR, which could potentially lead to suboptimal routing. Therefore, the router will choose the E1 path due to its more accurate representation of the total path cost.

If some users are unable to connect to an SSID configured with WPA3-Enterprise GCM-256, and the "MAC Authentication Fall-Through" is disabled, it means that devices which fail 802.1X authentication will not attempt MAC authentication. If these client devices are configured to use MAC authentication as a backup method, they will fail to connect, explaining the issue faced by some users.

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

When using Downloadable User Roles (DUR) with HPE Aruba Networking ClearPass, the Aruba device (AP, gateway, or switch) must authenticate to ClearPass to retrieve and install the user role that ClearPass sends dynamically. This process differs from normal RADIUS authentication, where only the user credentials are verified.

In Aruba Central, when you configure an authentication server (ClearPass) and enable Downloadable Roles, the system requires CPPM Username and CPPM Password fields. These credentials are specifically used by the Aruba device to establish a secure HTTPS (TLS) session to the ClearPass server for DUR retrieval.

If the CPPM Username or CPPM Password values are missing, incorrect, or not synchronized with the corresponding credentials defined on ClearPass, the device will fail to authenticate to ClearPass for DUR retrieval. This results in RADIUS authentication succeeding (because LUR is still functioning), but the DUR cannot be downloaded.

Exact Extract from HPE Aruba Networking Switching and ClearPass Configuration Guides:

“When Downloadable User Roles are enabled, the Aruba device must authenticate with ClearPass using configured credentials. The device uses the CPPM Username and Password for HTTPS-based role retrieval. If the credentials are not defined or are invalid, role download will fail even if RADIUS authentication succeeds.”

“The CPPM Username and Password define the credentials the device uses to connect to ClearPass for downloadable role retrieval. These credentials must match the admin or API credentials configured on the ClearPass Policy Manager server.”

This explains why Local User Roles (LUR) work (standard RADIUS), but Downloadable User Roles (DUR) do not — the HTTPS/TLS authentication for DUR fails because the required credentials were not configured correctly.

Why the Other Options Are Incorrect:

A. Add a new Enforcement Policy of type "WEBAUTH" on ClearPass:WebAuth enforcement policies are unrelated to DUR. Downloadable User Roles are delivered using an Aruba Downloadable Role enforcement profile, not WebAuth.

“Downloadable roles are defined and enforced through the Aruba Downloadable Role profile type. WebAuth policies are used for captive portal authentication only.”

C. Uncheck the "Dynamic Authorization" checkbox:Dynamic Authorization (RFC 3576 or CoA) allows session reauthentication or role changes. Disabling this feature would not fix DUR, as DUR relies on CPPM credentials for HTTPS authentication.

“Dynamic Authorization (CoA) enables session updates but does not control role download authentication.”

D. Modify the shared secret on the switch using the 'radius-server host' command:This option applies to switch RADIUS configuration, not Aruba Central APs or gateways. The DUR process uses HTTPS with ClearPass credentials, not the RADIUS shared secret.

“The RADIUS shared secret is used for authentication requests, not for downloadable role retrieval. Downloadable roles require valid CPPM credentials.”

References of HPE Aruba Networking Switching Documents or Study Guide:

Aruba Central Management and Configuration Guide — Downloadable Roles Section(Explains CPPM Username/Password requirement and DUR HTTPS authentication process.)

Aruba ClearPass Policy Manager Configuration Guide — Aruba Downloadable Role Enforcement Profiles(Details the role download process and ClearPass credential validation.)

ArubaOS-Switch and AOS-CX Security Configuration Guide — Role-Based Access Control and ClearPass Integration(Describes the mechanism for DUR retrieval and the use of HTTPS between the Aruba device and ClearPass.)

In the provided configuration for interface 1/1/7, there are roles specified for different scenarios concerning authentication. When a voice client attempts to connect and the RADIUS server is unreachable, the role that is assigned is the one specified as the "critical-voice-role". In this case, the "CRITICAL_VOICE" role is configured to be assigned under such circumstances, ensuring that voice clients receive appropriate network access permissions even when the RADIUS server is not available to authenticate them.

The fallback role is used as a default role in the absence of a specified role or when an authentication server is not available. Given the scenario, where the test device with MAC address 81:cd:93:13:ab:31 needs to be assigned to "iot-prod" and other devices to "iot-default", and considering there is no external authentication server configured for the test, the appropriate action would be to set a global fallback role that applies to all devices connecting to the network. This ensures that any device that does not match the specific device profile will inherit the "iot-default" role. Since the configuration for a specific MAC address (81:cd:93:xx:xx:xx) to associate with the "iot-prod" role is already in place, setting the fallback role globally accommodates the requirement for other devices.

The configuration shown in Option A is a valid configuration for a multi-chassis link aggregation (MC-LAG) setup. It specifies the use of LACP (Link Aggregation Control Protocol) with a fast rate of LACP PDUs exchange, which is appropriate for creating a resilient and high-throughput link aggregation. The 'vlan trunk allowed all' command allows all VLANs across the trunk, and 'vlan trunk native 100' sets VLAN 100 as the native VLAN for untagged traffic.

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking AOS-10 Gateway and Cluster Design Documentation)

When primary and secondary gateway clusters are defined in an SSID profile in AOS-10, the Access Points (APs) dynamically distribute their tunnel termination sessions based on the availability of both clusters.

If both clusters are operational and cluster preemption is not enabled, the APs maintain their current session distribution, resulting in an approximately equal split of AP tunnels across both clusters.

Aruba Documentation Extract:

“When both primary and secondary gateway clusters are reachable and cluster preemption is disabled, APs remain distributed across both clusters to maintain balance and prevent disruption.”

“Cluster preemption, if enabled, causes APs associated with the secondary cluster to move back to the primary cluster once it becomes available, consolidating tunnel load.”

Thus:

The equal split (72 APs per cluster) indicates both clusters are active,

and cluster preemption is disabled (so APs remain distributed instead of failing back to the primary cluster).

Why the Other Options Are Incorrect:

A. Cluster homogeneity/heterogeneity does not influence AP distribution behavior.

B. If preemption were enabled, APs on the secondary cluster would fail back to the primary, not stay split.

D. The number of nodes does not determine AP load balancing or distribution.

✅ Final Verified Answer: C. The primary and secondary gateway clusters are up, but the cluster preemption is not enabled.

???? Reference Sources (HPE Aruba Official Materials):

Aruba AOS-10 Gateway Clustering and Redundancy Guide – AP Distribution and Preemption

Aruba Central Network Design Guide – SSID Profile Gateway Assignment Behavior

Aruba Certified Mobility Expert (ACMX) Study Guide – Gateway Clustering and Failover Logic

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking Wireless Documentation)

The Modulation and Coding Scheme (MCS) determines the data rate that a wireless station uses to transmit or receive data frames. The MCS index selection depends primarily on the signal quality and error conditions observed on the wireless link.

Two factors have a direct and measurable influence:

1. Signal-to-Noise Ratio (SNR)

A higher SNR means better signal quality and less interference, allowing the station to use higher-order modulations (e.g., 64-QAM, 256-QAM, 1024-QAM) corresponding to higher MCS indexes.

When SNR decreases, the client dynamically reduces its MCS rate to maintain reliability.

“Stations dynamically select the highest MCS index that the current SNR can support to maintain an acceptable frame error rate.”

2. Retry Rate

The retry rate reflects retransmissions due to poor frame reception. A high retry rate indicates a high error rate, prompting the station to step down to a lower MCS to improve link stability.

“If retransmissions increase, the MCS rate is reduced until the error rate stabilizes.”

Other Options Explanation:

B. Channel utilization: affects airtime efficiency but not MCS selection directly.

C. Number of connected clients: impacts contention and throughput, not MCS per station.

E. Frequency band: influences propagation and SNR indirectly but does not directly control MCS selection.

✅ Final Verified Answers: A and D

???? Reference Sources (HPE Aruba Official Materials):

Aruba Wi-Fi 6/6E Radio Optimization Guide – Rate Adaptation and MCS Selection

Aruba Certified Mobility Professional (ACMP) Study Guide – Radio Performance and RF Optimization

Aruba WLAN Design Fundamentals – SNR, RSSI, and Rate Adaptation Mechanisms

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

The requirement in this question is to allow IT staff to provision unique pre-shared keys (PSKs) for each IoT device on a single SSID, ensuring that one device’s PSK cannot be used by another. This is the definition of Multi-Pre-Shared Key (MPSK) functionality.

HPE Aruba Networking supports three main MPSK deployment methods:

MPSK Local – Keys are defined locally on the AP or gateway; no external integration.

MPSK with ClearPass – Keys are managed and validated via ClearPass Policy Manager.

MPSK with Cloud Authentication – Keys are generated, stored, and managed natively through Aruba Central Cloud Authentication.

In this scenario, the IT Helpdesk wants a simplified, cloud-based method to generate and manage per-device unique PSKs without needing a ClearPass deployment. This aligns directly with MPSK AES with HPE Aruba Networking Central Cloud Authentication.

Exact Extract from HPE Aruba Networking Switching and Central Documentation:

“MPSK with Cloud Authentication allows administrators to configure a single SSID where each device is assigned a unique PSK. The PSKs are securely stored and validated using Aruba Central’s cloud-based authentication service.”

“Each PSK is tied to a specific client identity. If another device attempts to connect using the same PSK, the authentication will fail.”

“This method simplifies onboarding of IoT and headless devices while maintaining security equivalent to 802.1X.”

Thus, the correct recommendation is MPSK AES with Aruba Central Cloud Authentication, which fully supports per-device key uniqueness, centralized management, and cloud-based authentication—ideal for IoT device onboarding.

Why the Other Options Are Incorrect:

A. MPSK AES with ClearPass:Valid and secure, but requires an on-prem ClearPass Policy Manager deployment. The question specifies a simpler method for IT Helpdesk to manage keys directly, which Cloud Authentication provides natively.

“ClearPass MPSK requires policy manager integration; Aruba Central Cloud Authentication provides a simpler cloud-native alternative.”

C. MPSK Local:Suitable for small static environments, but not scalable and requires manual key creation on the AP or gateway. Does not allow IT staff to easily generate new keys per device via Central.

“MPSK Local does not support centralized lifecycle management or key revocation.”

D. MPSK AES with MAC Auth:MPSK already handles per-device authentication via unique keys; MAC authentication is unnecessary and less secure.

“MAC authentication is an alternate method for non-802.1X devices but is not required with MPSK.”

References of HPE Aruba Networking Switching Documents or Study Guide:

Aruba Central Cloud Authentication and MPSK Deployment Guide – “Configuring MPSK AES with Cloud Authentication.”

Aruba Wi-Fi 6 and IoT Integration Best Practices Guide – “Securing IoT with Cloud-Managed MPSK.”

ArubaOS 10 WLAN Configuration Guide – “MPSK Modes (Local, ClearPass, Cloud Authentication) and Use Cases.”

Given that the ACME company's concern is about UDP traffic potentially encountering packet drops due to uplink oversubscription, they need a strategy that prioritizes critical UDP traffic to minimize loss.

Option D, edge mark critical UDP traffic with AF42, is the correct answer. Assured Forwarding (AF) classes provide a way to assign different levels of delivery assurance for IP packets. AF42 is typically used for traffic that requires low latency and low loss, such as voice and video, which often use UDP. Marking critical UDP traffic with AF42 will help ensure that this traffic is treated with higher priority over the network.

Option A (edge mark lower priority TCP traffic with AF12) and Option C (edge mark lower priority TCP traffic with AF11) suggest marking lower priority TCP traffic, which does not directly address the concern for critical UDP traffic.

Option B (edge mark critical UDP Traffic with CS5) suggests using Class Selector 5 for critical UDP traffic, which is also a valid approach but does not match the existing configuration that is focused on Assured Forwarding (AF) classes.

During the testing of RadSec authentication over VXLAN, if the RadSec connection fails during the digital certificate exchange, it typically indicates an issue with the establishment of the TLS tunnel, which is required for RadSec's secure communication. The failure of TLS tunnel establishment can occur due to RADIUS TCP packets being dropped, preventing the secure exchange of digital certificates necessary for RadSec authentication. The other options, such as IPv6 address reachability, tracking mode settings, and proxy server misconfiguration, are not directly related to the failure of the TLS tunnel establishment during the certificate exchange process

In 802.11ax (Wi-Fi 6), OFDMA (Orthogonal Frequency Division Multiple Access) subdivides a channel into resource units, enabling simultaneous uplink and downlink transmissions for multiple clients. This is specifically optimized for many small packets (typical of IoT), reducing contention and improving efficiency. MU-MIMO (UL/DL) helps with multiple spatial streams for larger frames and strong SNR clients, while HE TXBF improves range/data rate for individual links; neither addresses small-packet concurrency as directly as OFDMA.

In BGP, the route marked with a ">" symbol is the best route that is chosen based on BGP attributes in the following order: highest weight (Cisco-specific), highest local preference, originated by BGP running on the local router, shortest AS path, lowest origin type, lowest MED, eBGP over iBGP, closest IGP neighbor, and lowest BGP router ID. Based on the table provided, Option E would be marked with a ">" symbol as it has the highest local preference of 100 which is a decisive factor in the BGP best path selection process.

The event log showing PMK (Pairwise Master Key) and OKC (Opportunistic Key Caching) key add/update and delete operations is indicative of normal client behavior in a WLAN environment. These events are part of the standard process for maintaining client session security and do not necessarily indicate any issue.

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking Mobility and Switching Documentation)

In Aruba mobility deployments, traffic prioritization and QoS are key to maintaining performance for latency-sensitive applications like Remote Desktop Protocol (RDP) when the mobility gateway uplinks become congested.

By default, Aruba gateways treat all user traffic equally unless QoS policies are applied. The best way to ensure critical applications such as RDP are prioritized is by defining Access Control Lists (ACLs) with traffic classification and queue assignments within the user role.

The command:

user-role Employee

access-control-list position 3

and corresponding ACL entries can assign RDP (TCP port 3389) to high-priority queues and relegate less time-sensitive traffic (like FTP or email) to lower-priority queues.

ArubaOS and Gateway Documentation Extract:

“When user roles are configured with ACLs that include QoS queue assignment, the mobility gateway can prioritize latency-sensitive applications (e.g., RDP, voice, video) by assigning traffic to higher priority queues. This ensures responsiveness during uplink congestion.”

Changing the WLAN from tunneled to bridged (Option B) could bypass gateway bottlenecks but would also remove centralized security and traffic control, which is not a best practice for enterprise-managed WLANs.

Disabling spanning tree (Option D) has no effect on QoS or congestion; it affects loop prevention only.

Setting the WMM voice DSCP value (Option C) would only influence wireless airtime QoS, not gateway uplink queuing.

Option Analysis:

A. ✅ Correct – ACL-based traffic prioritization in the employee role directly addresses congestion by ensuring RDP traffic is queued higher.

B. Incorrect – Changing SSID mode removes central visibility and security.

C. Incorrect – WMM controls radio-level prioritization, not gateway uplink congestion.

D. Incorrect – Spanning tree setting is unrelated to uplink queuing or throughput.

✅ Final Verified Answer: A

???? Reference Sources (HPE Aruba Official Materials):

ArubaOS 10 Mobility and Policy Enforcement Guide – User Roles, ACLs, and QoS Prioritization

Aruba Certified Mobility Professional (ACMP) Study Guide – Traffic Management and Application Prioritization

Aruba Mobility Gateway Configuration Guide – QoS Queuing and Traffic Classification

The capture shows messages related to WPA key management, indicating WPA2-PSK is being used. Also, the capture includes a DHCP request from the client but no corresponding DHCP ACK, suggesting the client is not receiving an IP address, which could explain the connectivity failure.

When configuring an 802.1X supplicant for wireless network access with Microsoft Windows 10, enabling server certificate validation is a critical step to ensure the security of the authentication process. Server certificate validation helps prevent man-in-the-middle attacks by ensuring the RADIUS server presenting the certificate is the correct server that the client expects to communicate with.

In Aruba AOS-CX, OSPF neighbors that reach EXSTART/EXCHANGE but fail to advance typically indicate a database description (DD) negotiation issue, most commonly caused by an MTU mismatch on the link. The OSPF header carries the interface MTU; if the values do not match, the peer rejects DD packets and the adjacency remains stuck at EXSTART (often shown as EXSTART/DR or EXSTART/BDR).

Aruba’s OSPF guidance states:

“If neighbors remain in EXSTART/EXCHANGE, verify that the Layer-3 MTU matches on both ends of the adjacency. An MTU mismatch causes DD packets to be rejected and prevents the adjacency from reaching FULL.”

Recommended corrective action is to align or remove custom L3 MTU settings on the participating interfaces (or use the mtu-ignore feature where appropriate).

In this scenario, removing the custom Layer-3 MTU configuration so both sides use the same default MTU allows DD packet negotiation to succeed and the adjacency to progress to FULL.

Dynamic Multicast Optimization (DMO) is a feature that enhances the delivery of multicast traffic by optimizing the data rate. The before and after optimization images show a significant increase in the data rate, which is a typical result of DMO being configured, as it allows multicast traffic to be transmitted at higher data rates by converting multicast streams into unicast streams for the clients that need them.

In HPE Aruba ClearPass Guest configuration, the “Address” field defines the Fully Qualified Domain Name (FQDN) of the captive portal server that users are redirected to when accessing the guest network.

When a wildcard certificate is used, such as *.aruba-training.com, the derived FQDN for the captive portal redirection automatically becomes:

captiveportal-login.aruba-training.com

This naming convention is required so that the Common Name (CN) or Subject Alternative Name (SAN) in the SSL certificate matches the domain presented to the client browser during HTTPS redirection.

If the “Address” field is incorrectly configured with just aruba-training.com, the certificate and the redirection URL will not match, causing the browser to block or fail the authentication process. This results in users being unable to browse after pressing Connect on the portal page.

HPE Aruba documentation states:

“When using a wildcard certificate (for example CN = *.domain.com) on ClearPass Guest, the web login redirection address must be configured as captiveportal-login.domain.com to ensure the HTTPS certificate name matches the redirection hostname.”

“If the address field does not match the derived hostname of the certificate, browser trust validation fails and users cannot proceed beyond the captive portal page.”

Additionally, the ArubaOS and ClearPass Guest deployment guide clarifies that wildcard certificates are fully supported for guest portals, provided that the Address field follows the proper naming pattern.

Incorrect Configurations:

Setting “Address” to aruba-training.com causes SSL mismatch errors.

Leaving the “Address” blank defaults to a local IP or hostname mismatch.

Correct Configuration:

“Address” should be set to captiveportal-login.aruba-training.com when the wildcard certificate is *.aruba-training.com.

Option Explanations:

A. Incorrect – this does not follow the certificate’s derived FQDN format.

B. Correct – matches the expected derived FQDN for wildcard certificates.

C. Incorrect – HTTPS certificates are required for secure guest portals.

D. Incorrect – Wildcard certificates are supported by ClearPass Guest and ArubaOS.

Final Verified Answer: B

Reference Sources (HPE Aruba Networking Official Materials):

Aruba ClearPass Guest Configuration and Deployment Guide

ArubaOS 8.x User Guide – Captive Portal and Authentication Configuration

HPE Aruba ClearPass Certificates 101 Technical Note

ArubaOS-Switch and ClearPass Integration Guide

In the provided frame capture, we can clearly observe the following sequence of events:

802.11 Association and 4-Way Handshake:

The client (MAC 20:0d:b0:41:5d:b6) associates with the AP (b8:3a:5a:84:24:30).

The EAPOL 4-way handshake successfully completes (Key Messages 1–4), indicating that the client has successfully joined the secured SSID.

This rules out authentication issues or WPA3 key management errors.

DHCP Exchange:

The client sends a DHCP Request, and the server responds with a DHCP ACK, confirming that the client has successfully obtained an IP address.

Example in the capture:

DHCP Request – Transaction ID 0xd3da62ef

DHCP ACK – Transaction ID 0xd3da62ef

This confirms that DHCP negotiation completed successfully.

ARP Requests and Replies:

After DHCP completion, an ARP broadcast is seen:

Who has 192.168.10.17? Tell 192.168.10.158

This is a normal ARP request from another device trying to reach 192.168.10.17.

However, we also see ARP replies for:

192.168.10.1 is at 00:1c:7f:7b:d2:4d

This indicates the default gateway responding with its MAC address.

Analysis of the Connectivity Issue:Even though the gateway is sending ARP replies, the repeated ARP responses for 192.168.10.1 in the capture suggest that the client is not caching or acknowledging the ARP entry for the default gateway. This behavior is consistent with a client that does not have a valid or populated ARP entry for its default gateway, leading to traffic failures beyond the local subnet.

This could be due to:

Incorrect ARP response handling on the client.

Firewall or driver issues preventing the ARP reply from being processed.

Power-save or roaming conditions where the ARP table did not update properly.

Exact Extract from HPE Aruba Networking Switching and WLAN Troubleshooting Documentation:

“If a client successfully completes the 4-way handshake and DHCP exchange but fails to pass traffic beyond the local subnet, check for ARP resolution issues.

Missing or invalid ARP entries for the default gateway can prevent Layer 3 connectivity even though the wireless association is successful.”

“Wireshark traces showing repeated ARP replies from the gateway indicate that the gateway is responding, but the client may not be updating its ARP cache, leading to connectivity failures.”

Hence, the conclusion is that the client’s ARP entry for the default gateway is missing or invalid, explaining why connectivity fails despite successful association and DHCP negotiation.

Why the Other Options Are Incorrect:

B. The SSID is using WPA3-Enterprise key management:The handshake shown (EAPOL 4 messages) uses the standard WPA2/AES (EAPOL-Key) exchange. There are no SAE or WPA3 transition frames present.

“WPA3 uses SAE or 802.1X with PMF indicators; the frame capture shows standard WPA2 key exchange.”

C. The client has not obtained an IP address on this network previously:The DHCP Request and ACK exchange confirm that the client has obtained an IP address (192.168.10.158). This option is invalid.

“A completed DHCP ACK indicates the client successfully received an IP address.”

D. The AP is using 20MHz wide 5GHz channels:The frame capture shows VHT/HE announcements, which indicate High Efficiency (HE) capabilities and channel sounding, not 20MHz restrictions. Channel width has no relation to the connectivity failure described.

“VHT/HE frames are part of 802.11ac/ax operation and do not indicate channel width problems.”

References of HPE Aruba Networking Switching Documents or Study Guide:

Aruba WLAN Troubleshooting and Analysis Guide – “ARP, DHCP, and Gateway Reachability Troubleshooting.”

ArubaOS 10 Wireless Fundamentals and Diagnostics Guide – “802.11 Association, 4-Way Handshake, and ARP Behavior.”

Aruba Client Connectivity Troubleshooting Guide (AOS-10 and AOS-8) – “Identifying ARP Cache Issues Post-DHCP Assignment.”

Aruba Network Access and Layer 2 Troubleshooting Guide – “Role of ARP in Wireless Client Connectivity.”

It is a common practice to separate successful and failed test results into different files for ease of troubleshooting. If the "datagrams.pcap" file shows no issues, it's likely because it only contains successful test data, and the failed tests that could explain the poor user experience would be in a different file, such as "datagrams-failed.pcap."

In a multi-site deployment with a mix of bridged and tunneled SSIDs, if there are session sync errors between different areas, it could be due to connectivity issues with the central management platform, which in the case of Aruba, is likely HPE Aruba Networking Central. This interruption could cause inconsistencies in session states across the network.

To address connectivity issues when students are working outdoors, increasing the transmission (TX) power range for the 5GHz radios can help improve signal strength and coverage. The setting shown indicates a conservative approach to power settings, which might not provide sufficient coverage for outdoor areas. By increasing the power range, you can extend the wireless signal reach, which aligns with best practices for outdoor wireless coverage.

Based on the criteria provided for wireless guest users, the correct user role configuration must allow internet access, only allow access to public DNS servers, deny access to all internal networks except for any DHCP server, and place the Wi-Fi guests on VLAN 555. The ACLs must permit services necessary for basic internet access (such as DNS and DHCP) and block access to internal networks.

Option A satisfies these criteria with the following configurations:

user-role "WiFi-guest": This defines the role for Wi-Fi guests.

access-list session dhcp-acl: This applies the access list that likely permits DHCP, which is necessary for guests to obtain an IP address.

access-list session dns-acl: This applies the DNS access list, which likely restricts guests to using public DNS servers.

access-list session internal-networks: This applies the internal networks access list, which denies access to internal networks.

vlan 555: This sets the VLAN for Wi-Fi guests to 555.

Options B, C, and D are incorrect because they include access-list session allowall which would permit all traffic, contradicting the requirement to deny access to all internal networks.

In device profile configuration, the device role is often determined by matching attributes such as MAC address, LLDP system description, and CDP information against defined conditions. The test device is being assigned the "iot-dev" role because its LLDP system description matches the 'iot-lldp' group configuration that is associated with the 'iot-dev' role.

Understanding the error:

The key line in the error message is:

fatal alert by server - unknown_ca

tls_process_client_certificate:certificate verify failed

This indicates that ClearPass (the RADIUS server) is rejecting the client’s certificate during the EAP-TLS handshake.

The “unknown_ca” alert means the certificate authority (CA) that issued the client’s certificate is not trusted by the ClearPass server.

Why Option D is correct:

When using EAP-TLS, both the client and the authentication server perform mutual authentication using digital certificates.

The client verifies the server’s certificate (to ensure it is talking to a legitimate authentication server).

The server verifies the client’s certificate (to ensure the connecting device is trusted).

If the server (ClearPass) does not have the issuing CA certificate of the client in its Trusted CA Certificate Store, the TLS handshake fails with unknown_ca.

Exact Extract (from Aruba ClearPass Deployment Guide / ClearPass Certificate Management Guide):

“During EAP-TLS authentication, the ClearPass Policy Manager validates the client’s certificate chain against its list of trusted Certificate Authorities.

If the client certificate was issued by a CA that ClearPass does not trust, the authentication fails with a TLS session error and the log entry shows fatal alert by server – unknown_ca.”

“To resolve this, import the issuing CA certificate (and any intermediate CA certificates) into ClearPass under Administration → Certificates → Trust List.”

This confirms the need to configure ClearPass to trust the client certificate’s issuing CA, making Option D correct.

Why the other options are incorrect:

A. Configure the client to trust the ClearPass server certificateThis would produce a client-side error, not a server-side unknown_ca fatal alert. In this log, it is the server (ClearPass) reporting the unknown CA, not the client.

Extract:

“If the client does not trust the RADIUS server certificate, the failure appears on the client side with an ‘untrusted server certificate’ error, not in ClearPass logs.”

B. Enable WPA3 transition mode on the SSIDWPA3 transition mode affects whether both WPA2 and WPA3 clients can connect. It does not affect EAP-TLS or certificate verification.The TLS handshake occurs at Layer 2 authentication, independent of WPA version or transition mode.

Extract:

“Transition mode is unrelated to 802.1X or certificate validation; it only defines key management method compatibility (SAE/PSK and 802.1X coexistence).”

C. Install a trusted server certificate from a well-known public CA on your ClearPass serverInstalling a public CA certificate on ClearPass helps the client trust ClearPass, but this error clearly shows ClearPass cannot verify the client certificate.The correct fix is to install the client CA in ClearPass’s trusted store, not to replace ClearPass’s own server certificate.

Extract:

“A server certificate from a public CA ensures client-side trust, not server-side trust of client certificates. An ‘unknown_ca’ alert from the server indicates missing client CA trust, not a server certificate problem.”

Final Summary:

Error Source

Meaning

Corrective Action

unknown_ca reported by server

Server (ClearPass) does not trust client’s CA

Import client’s CA certificate into ClearPass trusted store

unknown_ca reported by client

Client does not trust RADIUS server’s certificate

Install proper server certificate or CA chain on ClearPass

Answer: D — Configure ClearPass to trust the client certificate

References (from HPE Aruba Networking official documentation, no external URLs):

Aruba ClearPass Policy Manager 6.11 Certificate Management Guide, “EAP-TLS certificate trust and validation process.”

Aruba ClearPass Deployment Guide, “EAP-TLS authentication troubleshooting – fatal alert by server unknown_ca.”

ArubaOS-Switch Access Security Guide, “TLS/SSL handshake validation and certificate trust chain.”

Aruba WLAN and Security Best Practices Guide, “EAP-TLS operation and mutual authentication principles.”

The error message "User not found" indicates that the authentication source, in this case, Active Directory (AD), is not able to locate the user account based on the current search parameters. This often occurs when the User Principal Name (UPN) that the client is using to authenticate is not included in the search parameters of the AD authentication source within ClearPass. By modifying the AD authentication source to include the UPN in the search, ClearPass will be able to correctly locate the user account and proceed with the authentication using the valid client certificates.

In a high availability setup where both primary and secondary gateway clusters are present, APs are typically designed to connect to the primary cluster. If the APs are equally split between the primary and secondary, this may indicate that some APs cannot reach the primary cluster due to connectivity issues or reachability constraints, thus falling back to the secondary cluster.

Comprehensive and Detailed Explanation From Exact Extract of HPE Aruba Networking Switching:

The VSX synchronization feature provides per-feature synchronization from the primary to the secondary VSX peer. For multi-chassis LAGs (MC-LAGs), the command that ensures both VSX peers maintain consistent LAG interface associations and attributes is entered under the VSX configuration context:

• Command syntax: vsx-sync mclag-interfaces

• Command context: config-vsx

Description (extract): Enables VSX synchronization of VSX LAG interface associations and attributes from the primary VSX switch to the secondary peer switch.

In a campus design with two aggregation switches in a VSX pair and access switches dual-homed using MC-LAG, enabling vsx-sync mclag-interfaces under the VSX context ensures consistent LAG membership, attributes, and behavior across the pair—avoiding configuration drift and aggregation inconsistencies.

When an SSID profile is configured with both primary and secondary gateway clusters, access points (APs) form IPsec tunnels to one of these clusters based on reachability and preemption logic.

How Aruba gateway cluster selection works:

The AP first attempts to connect to the primary gateway cluster.

If the primary cluster is unreachable, the AP establishes a tunnel with the secondary cluster.

Once both clusters are reachable again, the preemption setting determines whether APs should move back to the primary cluster or remain connected to the secondary.

Exact Extract (from Aruba AOS 10 Gateway and WLAN Deployment Guide):

“When both primary and secondary gateway clusters are configured on an SSID, access points distribute across both clusters depending on availability and preemption configuration. If preemption is disabled, access points that have joined the secondary cluster remain there even after the primary cluster becomes available, potentially leading to an even split across both clusters.”

“Preemption ensures APs automatically reconnect to the primary cluster when it is back online. If preemption is not enabled, APs stay attached to whichever cluster they joined first.”

This means that if preemption is not enabled, some APs that previously connected to the secondary cluster (during a temporary network or reachability issue) will remain there after recovery, resulting in a balanced or equal distribution between primary and secondary clusters.

Why the Other Options Are Incorrect:

A. The secondary gateway cluster is a heterogeneous cluster with four nodes:Cluster type (homogeneous or heterogeneous) does not cause APs to split evenly. Aruba does not recommend heterogeneous clustering.

“Cluster node homogeneity affects compatibility and performance, not AP distribution.”

B. The primary gateway cluster is a homogeneous cluster with four nodes:Cluster size or node count (homogeneous or heterogeneous) does not influence the AP split behavior.

“Cluster node count determines capacity, not tunnel distribution.”

C. The primary and secondary gateway clusters are up, and cluster preemption is enabled:With preemption enabled, APs connected to the secondary cluster automatically move back to the primary once it’s reachable — eliminating an even split.

“Preemption ensures all APs return to the primary cluster, maintaining centralized control.”

References of HPE Aruba Networking Switching Documents or Study Guide:

ArubaOS 10 WLAN and Gateway Deployment Guide – “AP tunnel distribution behavior with primary/secondary gateway clusters and preemption settings.”

Aruba High Availability and Redundancy Best Practices Guide – “Impact of preemption on AP failover and cluster load balancing.”

Aruba Mobility Gateway Configuration Guide – “Gateway clustering, AP tunnel association logic, and preemption operation.”

Aruba Campus Wireless Design Fundamentals – “Cluster redundancy, AP tunnel behavior, and balanced AP distribution across clusters.”