HPE Campus Access Mobility Expert (HPE7-A07)Demo

A captive-portal login hostname is resolved and redirected by the captive-portal infrastructure for a client associated with the captive guest WLAN. The post-registration login action must therefore be tested while connected to that guest SSID; from another network, the virtual login hostname is not publicly resolvable and produces a server-not-found error. Certificate-chain configuration affects TLS trust, not DNS resolution.

BGP first prefers the highest local preference. Routes B, D, and E tie at 100; the route with no AS-path distance is preferred as the locally originated or shortest-AS-path candidate. Origin code and MED are considered only afterward, so route B is selected as the best path.

Seamless roaming in a gateway deployment requires all APs in the roaming domain to tunnel to the same gateway cluster and requires the client VLANs and broadcast domains to be common across the cluster. L2 forwarding with the client VLANs permitted on the gateway uplinks preserves a client’s VLAN, IP address, and default gateway during an intra-wing roam. Adding a second 7210 to each cluster provides the clustered stateful failover required for a business-critical service; a 7210 supports up to 2,048 devices per gateway, covering both 1,600-AP and 1,200-AP wings. HPE Aruba Networking gateway deployments, AOS 10 gateway capacity planning

OSPF database-description packet exchange requires compatible interface MTUs. The configured Layer 3 MTUs are 9100 on R1 and 9102 on R2, causing an MTU mismatch that prevents the adjacency from progressing beyond ExStart. Removing the Layer 3 MTU configuration restores the same default MTU on both interfaces.

An 802.1X/EAP authentication exchange succeeds through RADIUS, and the subsequent WPA2 four-way handshake completes key negotiation and installation for encrypted wireless traffic. Together, these operations constitute Layer 2 authentication and encryption. Cisco documents that WPA/WPA2-EAP authentication derives key material before the four-way handshake, which generates the encryption keys.

A secondary gateway cluster provides redundancy for an SSID. If some APs cannot reach the primary gateway cluster even though it remains operational, those APs can connect through the secondary cluster; this can result in an equal split of AP connections between the clusters.

A secondary gateway cluster serves as a failover target when the primary cluster is unavailable or unreachable. With cluster preemption disabled, APs that have failed over to the secondary cluster do not automatically switch back when the primary cluster becomes available, so APs can remain divided across the two clusters. Cluster preemption is the feature that returns APs to the primary cluster.

OSPF prefers external Type 1 (E1) routes over external Type 2 (E2) routes in its route-selection order. An E1 metric includes the external metric plus the internal cost to reach the advertising ASBR, whereas an E2 route is ranked lower regardless of an equal path cost.

WPA-PSK with TKIP permits the TKIP cipher suite, and TKIP is RC4-based. Therefore, the WLAN supports RC4 encryption. Neighbor reports are an IEEE 802.11k function and require 802.11k to be enabled; 802.11ac clients require the 5 GHz band, not a 2.4 GHz WLAN. Microsoft documents TKIP as an RC4-based cipher suite. DOT11_CIPHER_ALGORITHM enumeration

HPE Aruba Networking Central Cloud Authentication supports admin-managed MPSK for organization-owned devices, including IoT devices. It uses MPSK-AES on one SSID and enables administrators to create a unique MPSK for a single device or a device group. MPSK-AES and MAC authentication are mutually exclusive.

The LLDP system description matches lldp-group iot-lldp, which is associated with the iot-dev device profile. When criteria match multiple device profiles, AOS-CX gives LLDP matches precedence over CDP and local MAC matches; therefore, the LLDP-based iot-dev profile overrides the MAC-based iot-prod profile.

On a client’s initial connection, ClearPass Device Insight tags are not yet available, so Cloud Authentication and Policy enforces the role mapped to the fallback Unprofiled/Unspecified client-profile tag. The fallback mapping assigns the unmatched-device role; after profiling and reconnection, a Mobile & Gadgets tag could instead apply its mapped role.

GRE encapsulation preserves the client Layer 2 frame and its VLAN tag, allowing the VLAN assignment to be inspected in the GRE tunnel capture. IPsec encrypts the payload, and an upstream switch-port mirror exposes the outer transport traffic rather than the encapsulated client VLAN.

The profile applies a WRED action to LAG1’s queue 5 for yellow responsive traffic. Responsive traffic is TCP, and WRED probabilistically drops the selected yellow packets as queue utilization rises from 40% to 80%, signaling congestion before the queue is exhausted. This preferential dropping helps preserve queue-5 voice traffic from congestion; protocols, TCP traffic, and queues outside that configured class and queue are not universally affected.

critical-voice-role specifies the role applied to a voice client when the RADIUS server is unreachable during authentication. Its configured value is CRITICAL_VOICE.

WPA3-Enterprise (GCM 256) requires WPA3 GCM-256-capable clients and does not offer a WPA2 transition mode for legacy clients. Consequently, devices without that capability cannot connect, while compatible devices can. Aruba documents that this mode requires new key management, ciphers, and protected management frames, and that legacy clients are unsupported.

In an AOS-10 AP-only bridged deployment, APs establish DTLS tunnels with one another for client session-state synchronization and cleanup. If APs in the secure lab and public areas cannot maintain those DTLS connections, session synchronization between those areas fails.

Uplink MU-MIMO allows multiple clients to transmit to the access point simultaneously on the same frequency spectrum. It improves throughput for applications uploading large amounts of data and permits spatially separated clients to access the channel at the same time. Aruba documents support for uplink MU-MIMO on AP-535 access points.

An Asset ID is an LLDP-MED Inventory TLV. The received unknown-TLV count shows that the gateway is receiving, but not recognizing, the optional LLDP-MED information. LLDP-MED must be enabled for the gateway to interpret and display the Asset ID.

PEAP with EAP-MSCHAPv2 uses a server certificate to authenticate the RADIUS/NPS server to the client. Windows provides the PEAP option to verify the server’s identity by validating that certificate, which satisfies the required server-certificate validation. Smart Card or other certificate selects EAP-TLS instead of EAP-MSCHAPv2.

The AP-635 requires a higher PoE budget than IEEE 802.3at Class 4 to avoid restricted-power operation when powering USB peripherals. The AP-635 supports IEEE 802.3bt, and its USB host interface can be disabled when the PoE source has an insufficient power budget. A Class 6 PoE switch supplies the required higher-power 802.3bt service, allowing the USB dongles to operate. The AP-615 can use Class 4 PoE, so the mixed AP models do not require separate configuration groups. HPE Aruba Networking 630 Series Campus Access Point Installation Guide

EVPN route type 2 advertises a locally learned MAC/IP binding, whereas route type 5 advertises an IP prefix. The L3VNI section for RD 172.21.10.1 contains only type-5 routes and no type-2 MAC/IP routes, indicating that this switch has no active fabric clients. The 10.203.1.100 MAC/IP binding is advertised through next hop 172.21.11.3, not 172.21.11.2.