HP HPE6-A47 - Designing Aruba Solutions

An active site survey is a method of measuring and validating the wireless coverage, capacity, and performance of a network in a specific environment. It involves deploying temporary APs in the proposed locations, collecting data using a survey tool, and analyzing the results to optimize the network design. A heat map is a graphical representation of the wireless signal strength, interference, noise, or other metrics in different areas of the site. A heat map with proposed AP locations and actual tested coverage is a deliverable that shows the customer the expected performance of the new 802.11ac-based solution, and allows the architect to fine-tune the AP placement, channel selection, transmit power, and antenna orientation. This deliverable also helps the customer to verify that the network meets their requirements for coverage, capacity, and quality of service. References:

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47) - Chapter 5)

Aruba Validated Reference Design: Wireless LAN Site Surveys - Chapter 3)

Aruba Validated Reference Design: 802.11ac Networks - Chapter 4)

According to the Aruba Validated Design: Campus Wireless LAN1, MCs that are in different subnets cannot form a cluster, which is a logical group of MCs that share the same configuration and provide redundancy and load balancing for each other. However, MCs that are in different subnets can still provide backup LMS (local mobility switch) functionality for each other’s APs. This means that if the primary MC that controls an AP fails, the AP can fail over to the backup MC that is in a different subnet. However, this failover is not stateful, meaning that the user sessions and firewall states are not preserved. Therefore, option D is the correct answer.

Option A is incorrect because the MCs can provide some level of redundancy for each other without being in the same subnet, as explained above. Option B is incorrect because VRRP is not required to provide redundancy for MCs that are in different subnets. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, MCs do not act as routers, and they do not need a shared IP address to provide backup LMS functionality. Option C is incorrect because the MCs cannot be in a cluster if they are in different subnets, as explained above. Therefore, the cluster will not support any features, such as stateful failover, load balancing, or centralized configuration. References: Aruba Validated Design: Campus Wireless LAN)

 In local mode, the IAP cluster at the branch office has a local subnet and the master IAP of the cluster acts as the DHCP server and gateway for clients. The local mode provides access to the corporate network using the inner IP of the IPsec tunnel. The local mode is recommended for this scenario because it allows the branch office to remain functional even if the link to the main office fails, as the clients can still obtain IP addresses and access local resources. The local mode also avoids the need for additional routing or switching configuration on the MC or the branch office network12. References:

1: Understanding IAP-VPN Architecture - Aruba

2: IAP-VPN Forwarding Modes - Aruba

SmartLink is a technology that provides fast failover for access switches connected to the core VSF fabric. It detects link failures on the uplink ports and switches to the backup link within 50 ms. It also shuts down the primary link to prevent loops. SmartLink works with any routing protocol and does not require any additional configuration on the core switches. OSPF graceful restart is a feature that allows OSPF to continue forwarding traffic during a planned or unplanned restart of the routing process. However, it does not provide fast failover for link or device failures. BGP is a routing protocol that is mainly used for inter-domain routing and does not provide fast failover for link or device failures. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, it does not provide fast failover for link or device failures. References: ArubaOS-Switch Management and Configuration Guide for WC.16.10), Aruba Validated Design: Campus Wired LAN)

 A metal firewall is a significant RF obstacle that can be difficult to see visually and might require access to blueprints. A metal firewall is a type of fire-resistant barrier that is made of metal or metal-clad materials and is used to separate different sections of a building or a network. A metal firewall can block or attenuate RF signals that pass through it, causing coverage gaps, signal degradation, or interference in the wireless deployment. A metal firewall can also reflect RF signals, creating multipath fading or distortion in the wireless environment. Therefore, an architect needs to identify the location and thickness of any metal firewalls in the building and account for their impact on the RF design. A metal firewall may require additional access points, antennas, or cabling to provide adequate coverage and performance across the wireless deployment. A metal firewall may also affect the channel planning, transmit power settings, and antenna orientation of the access points and radios. A metal firewall can be difficult to see visually, as it may be hidden behind walls, ceilings, or floors, or blended with other materials.Therefore, an architect might need access to blueprints or other sources of information to locate and measure any metal firewalls in the building. References:

RF Design | Validated Solution Guide - Aruba

Managing and Optimizing RF Spectrum for Aruba WLANs | PDF - SlideShare

RF Optimization - Aruba

Advanced RF Design & Troubleshooting | PPT - SlideShare

The solution that the architect should recommend on the 2930M switches to authenticate and control wired employee devices is 802.1X on edge ports and no tunneled node. This solution would provide strong authentication and authorization for the wired devices using certificates, which can be issued and managed by ClearPass. The 802.1X protocol would allow the switches to communicate with ClearPass and enforce user roles and policies based on the device identity and context. The no tunneled node option would allow the wired traffic to be forwarded locally on the access layer switches, as the customer prefers, without tunneling it to the MCs. This option would also reduce the bandwidth consumption and latency on the network core.

The other solutions are not optimal for the customer requirements because they either provide weak authentication or require tunneling the wired traffic to the MCs. MAC-Authon edge ports and no tunneled node would provide weak authentication based on the MAC address of the device, which can be easily spoofed or bypassed. MAC-Auth on edge ports and per-user tunneled node would also provide weak authentication and require tunneling the wired traffic to the MCs, which the customer does not want. 802.1X on edge ports and per-user tunneled node would provide strong authentication but also require tunneling the wired traffic to the MCs, which the customer does not want. References:

Aruba 2930M Switch Series Data Sheet (Aruba Networks)

Designing Aruba Solutions Study Guide (HPE Press)

In the event of an MM outage, MCs continue to use their existing licenses for 30 days, and the network remains up. However, you cannot change the configuration items in the controller network. In addition, the MM manages many of the higher level functions that can cause issues in the network if the MM fails. Aruba recommends a backup MM for these situations. From an economic point of view, a backup MM for a VMM is free. If a customer has a hardware MM, the customer must purchase a backup hardware MM.

https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/vrrp/conf-stby-mm-l3red.htm

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.

It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.

It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm

2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

The Aruba 7210 Mobility Controller is designed to support up to 512 APs and 16,384 simultaneous users. In contrast, the 7205 Mobility Controller supports up to 256 APs and 8,192 simultaneous users. Therefore, for a very high density (VHD) design with 128 APs supporting 12,800 devices, the 7210 controllers would be a better fit due to their higher capacity for APs and simultaneous users.

References:

Designing Aruba Solutions, Rev. 20.11, Module 4: Aruba Mobility Controller Design, page 4-16

7200 Series Controller Data Sheet, page 1