Aruba Certified Network Security Professional (HPE7-A02)Demo

An AP that bridges wireless client traffic should be treated as a trusted infrastructure device and allowed to preserve DSCP markings so QoS classification can be maintained for traffic traversing the AP. AOS-CX port-access roles support trust-mode dscp, which explicitly trusts DSCP values while retaining 802.1p priority.

HPE Aruba Networking Central can generate Gateway IDS/IPS threat alerts when configured threat-count thresholds are exceeded and send those alerts by email to configured recipients. Global alert settings are therefore the direct way to proactively notify administrators of detected threats.

TEAP supports tunneled inner methods, including EAP-TLS. EAP-TLS performs mutual certificate-based authentication, so selecting an EAP-TLS-type method as the TEAP inner method requires clients to authenticate with certificates. A server/service certificate establishes and validates the outer TLS tunnel but does not, by itself, enforce client-certificate authentication.

CPDI can tag classified endpoints based on observed criteria, and those tags are sent to CPPM as endpoint attributes. CPPM can use the tags in role-mapping and enforcement policies, allowing it to direct the network infrastructure to quarantine endpoints associated with prohibited application use or other risky behavior.

RADIUS Dynamic Authorization enables AOS-10 APs to process RADIUS Change of Authorization (CoA) and Disconnect messages from ClearPass. ClearPass can therefore modify authorization attributes for an active client session when updated profiling or posture information requires a different enforcement profile.

The first role-mapping rule requires membership in the Managers group, which is not present. The next matching rule assigns the domain-comp role because TEAP Method 1 succeeded. Under first-match enforcement evaluation, only the rule for Tips Role EQUALS domain-comp matches, so the domain-only profile list is applied. ClearPass uses authorization-source attributes in role-mapping rules and evaluates enforcement rules against roles to return enforcement profiles.

AOS-CX maps an Aruba-Admin-Role TACACS+ VSA to the matching local user group, and this role attribute takes precedence over the privilege-level attribute. The returned value operators therefore assigns the manager the operators role, which has operator-level privileges.

ClearPass service rules determine which RADIUS requests are handled by a service. A service copied from a wireless 802.1X configuration typically has rules that match wireless request attributes; those rules must be changed so wired 802.1X requests from the AOS-CX switches match the service.

ClearPass Device Insight tags are added to classified devices as endpoint attributes and are available in role-mapping rule editors through the Endpoint namespace. The Device namespace instead represents attributes of configured network devices, while Tips contains runtime role and posture attributes.

AOS-CX applies a locally configured port-access role when ClearPass returns that role through the Aruba-User-Role RADIUS vendor-specific attribute. Returning employees selects the local role that maps access to the VLAN named employees; a downloadable-role profile is not required.

Subnet scans support device discovery and profiling in configured IP subnets. ClearPass can use WMI credentials during a subnet scan to query Windows servers and machines and retrieve additional endpoint details, such as running services and processes.

Rogue-AP detection distinguishes an unauthorized AP connected to the wired network from an RF-only interfering AP by correlating wireless observations with wired-network traffic. For this function to work, every client-facing VLAN must be trunked to at least one gateway, AP, or air monitor (AM); assigning each VLAN to at least one AP or AM port satisfies that requirement.

HPE Aruba Networking ZTNA grants authenticated users access only to authorized private applications rather than broad network access. By keeping users off the private network and avoiding direct internet exposure of applications, it reduces the reachable network footprint and attack surface.

ClearPass posture-policy rules evaluate the selected OnGuard plug-in health checks and assign a posture token, such as HEALTHY, CHECKUP, QUARANTINE, or INFECTED, based on the rule result. A service can reference a posture policy, but the conditions that produce the posture are configured in that policy’s Rules tab. Configuring Posture Policy Rules

Restricting access to a private web application by group membership requires a policy rule to use an identity object that represents the applicable user group. HPE Aruba Networking SSE policy rules use Identity conditions for users and groups; client certificates and device-security checks are configured as Device Posture conditions instead. Adding Policy Rules

Clients that still require profiling have no device category recorded in the Endpoints Repository. A Category NOT_EXISTS condition identifies those unprofiled endpoints and assigns them the profiling-cppm role so they can undergo profiling.

A RADIUS enforcement policy contains the enforcement profiles and rules that initiate RADIUS dynamic authorization actions, including CoA, based on posture results such as Healthy or Quarantine. The posture policy evaluates compliance and assigns posture tokens; it does not itself send the CoA.

SSID forwarding mode determines which VLANs must be extended to an AP uplink. Bridge forwarding sends client traffic from the AP uplink with 802.1Q VLAN tags, so the AP management VLAN and bridged user VLANs must be available on that uplink. Tunnel forwarding carries client traffic to a gateway instead, so tunneled client VLANs should not be extended to the AP uplink.

A Gateway Threat Count alert is based on the total IDPS threat-event count for an individual gateway during the configured time period. The gateway Threats List shows the detected threat records, and opening a record’s packet information provides details for the threat events that caused the threshold to be exceeded.

Session-firewall-based denylisting is triggered by the ACL/firewall rule, but denylisting must also be enabled in the WLAN SSID profile for it to take effect. Enable denylisting in the MyCompany SSID security settings.

ClearPass Insight’s Active Endpoint Security report includes the endpoint spoofing count for devices active during the selected time period, providing the relevant visibility into detected MAC spoofing attempts.

VNBT associates an authenticated client role with a role VLAN. Assigning the access VLAN that is mapped to VNI 3000 places the client’s traffic into that EVPN-VXLAN overlay segment. Gateway-zone configuration enables user-based tunneling rather than VNBT, and a VNI value does not imply an identical VLAN ID.

ClearPass Device Insight (CPDI) provides a device-level Network Activity card that displays application or protocol traffic flow in a Sankey chart. Its time-range controls allow the activity to be viewed over the last 4 hours, 8 hours, 1 day, 1 week, or 2 weeks, enabling application-usage changes to be examined across ranges.

HPE Aruba Networking SSE must inspect encrypted web traffic to detect threats such as malware in downloaded files. SSL inspection enables that decryption and inspection, and it is configured in an External Web Profile.