HPE Network Security Associate (HPE6-A78)

For Dynamic Segmentation, each AOS-CX switch that tunnels traffic to a Mobility Controller consumes an AP license, because the controller treats the tunneling switch as an AP-equivalent device. Centralized firewall policy enforcement and DPI require a PEF license as well. License consumption is per switch or switch stack, rather than per client or employee.

The local admin/root account should have a long, complex, randomly generated password that is securely stored and unavailable to ordinary users. This prevents misuse of the local administrative account while centralized TACACS or RADIUS authentication is used for normal administrative access.

An “unknown NAD” RADIUS event means ClearPass cannot associate the incoming RADIUS request with a configured network access device. The Mobility Controller’s source IP address for traffic to ClearPass must therefore match the IP address configured for that device in ClearPass.

In ArubaOS, an authenticated client is assigned a user role that determines its network privileges, and one or more firewall policies can be associated with that role. Assigning distinct faculty and student roles enables the controller to enforce the appropriate traffic rules per authenticated user group, independent of VLAN or WLAN membership.

ClearPass Policy Manager can fingerprint an endpoint from DHCP Discover and Request attributes, including the ordered parameter-request list in DHCP Option 55. That fingerprint can identify characteristics such as the device category, OS family, and device name.