ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

The Aruba Mobility Master (MM) hardware appliances are designed to manage large-scale networks. The MM-HW-10K model is capable of managing up to 10,000 devices, which would be sufficient for the customer’s requirement of supporting about 1,500 client APs and a maximum of about 20,000 wireless clients1. Two MM-HW-10K appliances would allow for an active and standby deployment, providing redundancy and ensuring network reliability2.

References:

• System Requirements - Aruba
• Mobility Master Hardware Appliance - Aruba

The Aruba SDN Controller is a software component that runs on the Mobility Master (MM) and provides centralized control and management of the network devices and applications that support the SDN services. The SDN Controller communicates with the network devices through the southbound interface (SBI) and exposes the northbound API (NBAPI) for the SDN applications to access the network resources and services1.

One of the SDN applications that can integrate with the Aruba SDN Controller is the Aruba UC and Collaboration Solution, which optimizes the performance and quality of Skype for Business traffic over the wireless network. The Aruba UC and Collaboration Solution consists of three components: the Aruba UC and Collaboration SDN Application, the Aruba UC and Collaboration Dashboard, and the Aruba UC and Collaboration Agent2.

The Aruba UC and Collaboration SDN Application is a software module that runs on the Skype for Business Front End Server and communicates with the Aruba SDN Controller through the NBAPI. The Aruba UC and Collaboration SDN Application monitors the Skype for Business sessions and events, and sends the relevant information to the Aruba SDN Controller, such as the user identity, device type, session type, codec, bandwidth, and quality of service (QoS) requirements2.

The Aruba UC and Collaboration Dashboard is a web-based graphical user interface that provides visibility and analytics of the Skype for Business sessions and events over the wireless network. The Aruba UC and Collaboration Dashboard connects to the Aruba SDN Controller through the NBAPI and displays the information collected by the Aruba UC and Collaboration SDN Application, such as the number of active sessions, session types, session quality, bandwidth consumption, and device distribution2.

The Aruba UC and Collaboration Agent is a software module that runs on the Mobility Controller (MC) and communicates with the Aruba SDN Controller through the SBI. The Aruba UC and Collaboration Agent receives the information from the Aruba UC and Collaboration SDN Application through the Aruba SDN Controller, and applies the appropriate QoS policies and actions on the wireless network, such as prioritizing the Skype for Business traffic, marking the DSCP values, reserving the bandwidth, and adjusting the airtime2.

To support high availability for the SDN services, the Aruba SDN Controller must be deployed in a redundant configuration, with a primary MM and a backup MM. The primary MM runs the active instance of the Aruba SDN Controller, while the backup MM runs the standby instance of the Aruba SDN Controller. The backup MM synchronizes the configuration and state information from the primary MM, and takes over the SDN Controller role in case of a failure or switchover of the primary MM1.

The other options do not provide high availability specifically for the SDN services, although they may provide redundancy for other aspects of the wireless network. A redundant master MC does not run the Aruba SDN Controller, and only provides backup for the master MC role, which is responsible for managing the configuration and licensing of the MCs in the network3. Backup controllers defined on the APs do not run the Aruba SDN Controller, and only provide backup for the local MC role, which is responsible for terminating and managing the APs in the network4. A cluster deployment for MCs does not run the Aruba SDN Controller, and only provides load balancing and fast failover for the APs in the network5.

References: 1: ArubaOS 8.7 User Guide - Aruba, Chapter 42: SDN Controller, pages 1049-1050. 2: Aruba UC and Collaboration Solution Guide - Aruba, Chapter 2: Aruba UC and Collaboration Solution Overview, pages 11-15. 3: ArubaOS 8.7 User Guide - Aruba, Chapter 2: ArubaOS Architecture, pages 25-26. 4: ArubaOS 8.7 User Guide - Aruba, Chapter 3: Configuring Controller Redundancy, pages 39-40. 5: ArubaOS 8.7 User Guide - Aruba, Chapter 4: Configuring Controller Clustering, pages 51-52.

The maximum bandwidth possible between the aggregation and core layers using 8 strands of OM4 Multi-Mode fiber can be up to 200 Gbps1. This is because each strand of OM4 fiber can support up to 25 Gbps of bandwidth, and with 8 strands, the total bandwidth can reach up to 200 Gbps1. However, the actual bandwidth can be influenced by various factors such as the quality of the fiber, the type of transceivers used, and the distance between the aggregation and core layers1.

References:

• What is IP and Ethernet aggregation? - Ciena
• Aruba 5400R zl2 Switch Series Data Sheet
• Aruba 5400R zl2 Switch Series Installation and Getting Started Guide
• ArubaOS-Switch and ArubaOS-CX Transceiver Guide

The Aruba 7210 Mobility Controller is designed to support up to 512 APs and 16,384 simultaneous users. In contrast, the 7205 Mobility Controller supports up to 256 APs and 8,192 simultaneous users. Therefore, for a very high density (VHD) design with 128 APs supporting 12,800 devices, the 7210 controllers would be a better fit due to their higher capacity for APs and simultaneous users.

References:

• Designing Aruba Solutions, Rev. 20.11, Module 4: Aruba Mobility Controller Design, page 4-16
• 7200 Series Controller Data Sheet, page 1

In the event of an MM outage, MCs continue to use their existing licenses for 30 days, and the network remains up. However, you cannot change the configuration items in the controller network. In addition, the MM manages many of the higher level functions that can cause issues in the network if the MM fails. Aruba recommends a backup MM for these situations. From an economic point of view, a backup MM for a VMM is free. If a customer has a hardware MM, the customer must purchase a backup hardware MM.

https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/vrrp/conf-stby-mm-l3red.htm

References:

• 4: https://blog.router-switch.com/2020/11/data-center-design-basic-3-layers-core-aggregation-and-access/
• 1: https://community.cisco.com/t5/data-center-and-cloud-knowledge-base/datacenter-core-and-aggregation-design/ta-p/3135946
• 2: https://www.oreilly.com/library/view/ccna-data-center/9780133860429/ch01lev3sec2.html
• 3: https://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Content/ArubaFrameStyles/VLANs/Extending_VLANs.htm

The correct answer is option C, 20-25. This is because a general rule of thumb for 802.11ac wireless deployment is to have one AP for every 200 square meters (approximately 2,000 square feet) of coverage area. This assumes a moderate user density and application demand. Therefore, for a coverage area of 4,645 square meters (approximately 50,000 square feet), the architect should have in mind about 23 APs (4,645 / 200 = 23.225). This number can be adjusted based on the actual site survey and VisualRF plan, but it serves as a good starting point. References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 4: Wireless LAN Design, where the AP count estimation and site survey methods are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Fundamentals Guide

Aruba Central Managed Portal (MSP) is a cloud-based network management platform that enables service providers to centrally manage and monitor multiple tenant accounts from a single interface1. MSP mode is a multi-tenant operational mode that Aruba Central accounts can be converted into, provided these accounts have subscribed to the Aruba Central app2. MSP mode allows service providers to provision and manage tenant accounts, assign devices to tenant accounts, manage subscription keys and perform other functions such as configuring network profiles and viewing alerts3. MSP mode is suitable for the scenario where a service provider needs to manage multiple customer networks, as it simplifies tenant network operations using capabilities such as zero-touch setup, historical data reporting, PCI compliance monitoring, and troubleshooting2. References:

• 1: MSP Overview - Aruba
• 2: MSP Architecture - Aruba
• 3: Managed Service Portal - Aruba

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

• Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.
• Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.
• Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References:

• ArubaOS 8.5 User Guide)
• ArubaOS 8.5 Security Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

Auditoriums are challenging environments for wireless design, as they often have a large number of users and devices in a relatively small area, creating high demand for bandwidth and capacity. To provide adequate RF coverage and performance, auditoriums typically require a high-density AP design, which involves deploying more APs than usual, using directional antennas, reducing transmit power, and selecting non-overlapping channels12. A high-density AP design can also help mitigate interference from other sources, such as Bluetooth devices, which operate in the 2.4 GHz band3. Auditoriums do not necessarily require the use of 80 MHz channels or DFS channels, as these options depend on the availability and regulation of the spectrum, as well as the trade-off between throughput and channel reuse . References:

• 1: High Density Wi-Fi Design Principles - Aruba
• 2: Auditorium | WBDG - Whole Building Design Guide
• 3: Bluetooth and Wi-Fi Coexistence Issues and Solutions for the 2.4 GHz ISM Band - Aruba
• [4]: 802.11ac Channel Planning - Aruba
• [5]: Dynamic Frequency Selection (DFS) - Aruba

According to the Designing Aruba Solutions course, dedicated Air Monitors (AMs) are APs that are configured to scan all channels for wireless threats and perform wireless intrusion prevention system (WIPS) functions. One of the advantages of using dedicated AMs over APs that are doing WIPS in AP mode (hybrid) is that AMs can implement wireless containment on any channel on which they detect a threat without affecting the service of legitimate clients. Wireless containment is a technique that prevents rogue APs or clients from communicating with the network by sending deauthentication or disassociation frames to them. However, if an AP that is serving clients performs wireless containment on a different channel, it will have to switch channels frequently, which will degrade the performance and user experience of the clients. Therefore, dedicated AMs are recommended for customers who need effective and efficient wireless containment without compromising client service.

References:

• Designing Aruba Solutions, Rev. 20.11, Module 5: Aruba Security Design, page 5-13
• Aruba Validated Reference Design: Wireless Intrusion Prevention System, page 10

The Aruba 2930F Switch Series is a stackable Layer 3 switch series that provides performance and ease of use for enterprises, small and medium-sized businesses, and branch office networks1. It comes with an enterprise-grade feature set that includes static and RIP routing, IPv6, ACLs, robust security, and QoS1. The 2930F Series supports more options for class-based Quality of Service (QoS) policies than the 2540 Series2. This feature is crucial for a customer who needs a wired network solution that can recognize and prioritize a wide array of different types of traffic, including casual Web browsing, voice, video, SAP Online, and file sharing.

References:

• HPE Aruba Networking 2930F Switch Series
• Why would the architect choose the 2930F rather than the 2540 Switch Series for this customer?

it meets the customer’s requirements for wired network upgrade. By combining the switches in each Building 2 closet as a Virtual Switching Framework (VSF) fabric, the architect can reduce the number of logical devices within the network, simplifying management and reducing complexity, aligning with the goal of flattening architecture. Establishing two 10 GbE connections to the core per fabric ensures redundancy and resilience, maintaining connectivity even if one link fails, without necessitating additional cabling. This also provides sufficient bandwidth and scalability for the network traffic.

The other options are incorrect because:

• A. Using two additional 2930F switches to act as an aggregation layer for Building 2 adds another layer of devices and complexity to the network, contradicting the goal of flattening architecture. It also requires additional cabling and ports to connect the switches to the core and the access layer.
• B. Connecting each Building 2 switch directly to the core on a single fiber strand through the use of SFP±SR transceivers does not provide redundancy and resilience, as one link failure would disconnect the switch from the core. It also limits the bandwidth and scalability of the network, as each switch would have only one 10 GbE connection to the core.
• D. Extending additional fiber between the buildings so that each Building 2 switch can have a direct 10 GbE connection to the core requires recabling, which the customer wants to avoid. It also increases the cost and complexity of the network, as more fiber strands and ports would be needed.

References:

• Aruba 2930M Switch Series - Data sheet)
• Aruba Validated Reference Design: Campus Wired LAN - Chapter 3)
• ArubaOS-Switch Virtual Switching Framework - Configuration guide)

The traditional guideline limits a wired VLAN to a /24 subnet, which provides enough IP addresses for 253 endpoints. You might have suggested one of three approaches: one VLAN per floor, one VLAN per building, or one VLAN per campus. The one VLAN per floor approach is not recommended because it interferes with roaming and adds complexity. If you did take this approach, the /24 subnets are not large enough for the requirements on every floor. You would need to ask for /23 subnets. The one VLAN per building approach would work if you considered each building its own RF domain. It provides roaming within a building and, if you are using a single cluster at the data center, between buildings. Ifyou deployed two MCs or clusters, one at each building, though, GRE tunneling would be required to support roaming between buildings.

The Virtual Switching Framework (VSF) is a technology that allows two or more Aruba switches to operate as a single logical device, providing high availability, simplified management, and increased performance. VSF is supported on Aruba 5400R zl2 switches, which are modular switches that can accommodate different types of line cards and power supplies1.

The VSF fabric requires two types of connections between the member switches: VSF links and VSF ports. VSF links are the physical connections that carry the VSF control and data traffic, while VSF ports are the logical interfaces that bundle the VSF links into a single logical link. VSF links can be either 10 GbE or 40 GbE, and VSF ports can be either 10 GbE or 40 GbE1.

To create a VSF fabric with two 5406R zl2 switches, the architect needs to ensure that the switches have the compatible modules, transceivers, and cables for the VSF links and ports. According to the ArubaOS-Switch Management and Configuration Guide1, the following requirements apply for the VSF fabric:

• The switches must have the same chassis model, the same number and type of modules, and the same firmware version.
• The switches must have at least one v3 module in slot A or B. The v3 modules are the ones with the letter “M” in the part number, such as J9990A, J9991A, and J9992A. The v2 modules are the ones with the letter “A” in the part number, such as J9534A, J9535A, and J9536A.
• The switches must have the same type of transceivers and cables for the VSF links. The supported transceivers are the Aruba 10G SFP+ LC SR, the Aruba 10G SFP+ LC LR, the Aruba 40G QSFP+ LC SR4, and the Aruba 40G QSFP+ MPO SR4. The supported cables are the Aruba 10G SFP+ to SFP+ 1m DAC Cable, the Aruba 10G SFP+ to SFP+ 3m DAC Cable, the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable, and the Aruba 40G QSFP+ to QSFP+ 3m DAC Cable.

Based on the exhibit, the architect has planned to use the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable (JH234A) for the VSF links, which is a supported option. However, the architect has also selected the Aruba 24p 10GBASE-T v2 zl Module (J9536A) and the Aruba 20p 10GbE SFP+ v2 zl Module (J9535A) for the switches, which are not compatible with the VSF fabric. The architect should change these v2 modules to v3 modules, such as the Aruba 24p 10GBASE-T v3 zl2 Module (J9996A) and the Aruba 20p 10GbE SFP+ v3 zl2 Module (J9990A), to meet the VSF requirements.

The other options are not issues with the plan. Adding two QSPF+ MP0 SR4 transceivers (A) is not necessary, as the DAC cable already provides the 40 GbE connection for the VSF links. Adding stacking modules and cables © is not required, as the VSF fabric does not use the traditional stacking technology. Changing the power supply type (D) is not relevant, as the VSF fabric does not impose any restrictions on the power supply type.

References: 1: ArubaOS-Switch Management and Configuration Guide - Aruba, Chapter 12: Virtual Switching Framework, pages 219-227.