HP HPE6-A78 - Aruba Certified Network Security Associate Exam

ClearPass Onboard is part of the Aruba ClearPass suite and it provides a mechanism to deploy certificates to end-user devices, regardless of whether or not they are members of a Windows domain. ClearPass Onboard facilitates the configuration and provisioning of network settings and security, including the delivery and installation of certificates to ensure secure network access. This capability enables a bring-your-own-device (BYOD) environment where devices can be securely managed and provided with the necessary certificates for network authentication.

In an HPE Aruba Networking AOS-8 solution, the Wireless Intrusion Prevention (WIP) system is used to detect and classify rogue Access Points (APs). When a rogue AP is detected, the AOS system provides various pieces of information about the detected radio, such as the SSID, BSSID, match method, match type, confidence level, and the devices that detected the rogue AP. The goal is to locate the physical rogue device, which requires identifying its approximate location in the network environment.

Option A, "The detecting devices," is correct. The "detecting devices" refer to the authorized APs or radios that detected the rogue AP’s signal. This information is critical for locating the rogue device because it provides the physical locations of the detecting APs. By knowing which APs detected the rogue AP and their signal strength (RSSI) readings, you can triangulate the approximate location of the rogue AP. For example, if AP-1 in Building A and AP-2 in Building B both detect the rogue AP, and AP-1 reports a stronger signal, the rogue AP is likely closer to AP-1 in Building A.

Option B, "The match method," is incorrect. The match method (e.g., "Plus one," "Eth-Wired-Mac-Table") indicates how the rogue AP was classified (e.g., based on a BSSID close to a known MAC or its presence on the wired network). While this helps understand why the AP was classified as rogue, it does not directly help locate the physical device.

Option C, "The confidence level," is incorrect. The confidence level indicates the likelihood that the AP is correctly classified as rogue (e.g., 90% confidence). This is useful for assessing the reliability of the classification but does not provide location information.

Option D, "The match type," is incorrect. The match type (e.g., "Rogue," "Suspected Rogue") specifies the category of the classification. Like the match method, it helps understand the classification but does not aid in physically locating the device.

The HPE Aruba Networking AOS-8 8.11 User Guide states:

"When a rogue AP is detected by the Wireless Intrusion Prevention (WIP) system, the ‘detecting devices’ information lists the authorized APs or radios that detected the rogue AP’s signal. This is the most useful information for locating the rogue device, as it provides the physical locations of the detecting APs. By analyzing the signal strength (RSSI) reported by each detecting device, you can triangulate the approximate location of the rogue AP. For example, if AP-1 and AP-2 detect the rogue AP, and AP-1 reports a higher RSSI, the rogue AP is likely closer to AP-1." (Page 416, Rogue AP Detection Section)

Additionally, the HPE Aruba Networking Security Guide notes:

"To locate a rogue AP, use the ‘detecting devices’ information in the AOS Detected Radios page. This lists the APs that detected the rogue AP, along with signal strength data, enabling triangulation to pinpoint the rogue device’s location." (Page 80, Locating Rogue APs Section)

EAP-TLS and PEAP both provide secure authentication methods, but they differ in their requirements for client-side authentication. EAP-TLS requires both the client (supplicant) and the server to authenticate each other with certificates, thereby ensuring a very high level of security. On the other hand, PEAP requires a server-side certificate to create a secure tunnel and allows the client to authenticate using less stringent methods, such as a username and password, which are then protected by the tunnel. This makes PEAP more flexible in environments where client-side certificates are not feasible.

Creating the Certificate Signing Request (CSR) and the public/private keypair offline is recommended when deploying server certificates on multiple ArubaOS Mobility Controllers (MCs). This method enhances security by minimizing the exposure of private keys. By creating and handling these components offline, administrators can maintain better control over the keys and ensure their security before deploying them across multiple devices. This approach also simplifies the management of certificates on multiple controllers, as the same certificate can be installed more securely and efficiently.

EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) and PEAP (Protected EAP) are two EAP methods used for 802.1X authentication in wireless networks, such as those configured with WPA3-Enterprise on HPE Aruba Networking solutions. Both methods are commonly used with ClearPass Policy Manager (CPPM) for secure authentication.

EAP-TLS:

Requires both the supplicant (client) and the server (e.g., CPPM) to present a valid certificate during authentication.

Establishes a TLS tunnel to secure the authentication process, but the primary authentication mechanism is the mutual certificate exchange. The client’s certificate is used to authenticate the client, and the server’s certificate authenticates the server.

PEAP:

Requires only the server to present a certificate to authenticate itself to the client.

Establishes a TLS tunnel to secure the authentication process, within which the client authenticates using a secondary method, typically a username and password (e.g., via MS-CHAPv2 or EAP-GTC).

Option A, "EAP-TLS begins with the establishment of a TLS tunnel, but PEAP does not use a TLS tunnel as part of its process," is incorrect. Both EAP-TLS and PEAP establish a TLS tunnel. In EAP-TLS, the TLS tunnel is used for the mutual certificate exchange, while in PEAP, the TLS tunnel protects the inner authentication (e.g., username/password).

Option B, "EAP-TLS requires the supplicant to authenticate with a certificate, but PEAP allows the supplicant to use a username and password," is correct. This is a key difference: EAP-TLS mandates certificate-based authentication for the client, while PEAP allows the client to authenticate with a username and password inside the TLS tunnel, making PEAP more flexible for environments where client certificates are not deployed.

Option C, "EAP-TLS creates a TLS tunnel for transmitting user credentials, while PEAP authenticates the server and supplicant during a TLS handshake," is incorrect. Both methods use a TLS tunnel, and both authenticate the server during the TLS handshake (using the server’s certificate). In EAP-TLS, the client’s certificate is also part of the TLS handshake, while in PEAP, the client’s credentials (username/password) are sent inside the tunnel after the handshake.

Option D, "EAP-TLS creates a TLS tunnel for transmitting user credentials securely, while PEAP protects user credentials with TKIP encryption," is incorrect. PEAP does not use TKIP (Temporal Key Integrity Protocol) for protecting credentials; TKIP is a legacy encryption method used in WPA/WPA2 for wireless data encryption, not for EAP authentication. PEAP uses the TLS tunnel to protect the inner authentication credentials.

The HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide states:

"EAP-TLS requires both the supplicant and the server to present a valid certificate for mutual authentication. The supplicant authenticates using its certificate, and the process is secured within a TLS tunnel. In contrast, PEAP requires only the server to present a certificate to establish a TLS tunnel, within which the supplicant can authenticate using a username and password (e.g., via MS-CHAPv2 or EAP-GTC). This makes PEAP more suitable for environments where client certificates are not deployed." (Page 292, EAP Methods Section)

Additionally, the HPE Aruba Networking Wireless Security Guide notes:

"A key difference between EAP-TLS and PEAP is the client authentication method. EAP-TLS mandates that the client authenticate with a certificate, requiring certificate deployment on all clients. PEAP allows the client to authenticate with a username and password inside a TLS tunnel, making it easier to deploy in environments without client certificates." (Page 40, 802.1X Authentication Methods Section)

When a device like Device A contacts a secure website and receives a certificate chain from the server, the browser's primary task is to validate the web server's certificate to ensure it is trustworthy. Part of this validation includes checking that the certificate contains a DNS Subject Alternative Name (SAN) that matches the domain name of the website being accessed—in this case, arubapedia.arubanetworks.com. This ensures that the certificate was indeed issued to the entity operating the domain and helps prevent man-in-the-middle attacks where an invalid certificate could be presented by an attacker. The DNS SAN check is critical because it directly ties the digital certificate to the domain it secures, confirming the authenticity of the website to the user's browser.

The scenario involves an AOS-CX switch configured for 802.1X port-access authentication. The configuration defines several roles and their associated VLANs:

port-access role role1 vlan access 11: Role1 assigns VLAN 11.

port-access role role2 vlan access 12: Role2 assigns VLAN 12.

port-access role role3 vlan access 13: Role3 assigns VLAN 13.

port-access role role4 vlan access 14: Role4 assigns VLAN 14.

The switch has 802.1X authentication enabled globally (aaa authentication port-access dot1x authenticator enable). Two ports are configured:

Interface 1/1/1:

vlan access 1: Default VLAN is 1.

aaa authentication port-access critical-role role1: If the RADIUS server is unavailable, assign role1 (VLAN 11).

aaa authentication port-access preauth-role role2: Before authentication, assign role2 (VLAN 12).

aaa authentication port-access auth-role role3: After successful authentication, assign role3 (VLAN 13) unless overridden by a VSA.

Interface 1/1/2: Same configuration as 1/1/1.

Client1 on port 1/1/1:

Client1 authenticates successfully, and CPPM sends an Access-Accept with the VSA Aruba-User-Role: role4.

In AOS-CX, the auth-role (role3) is applied after successful authentication unless the RADIUS server specifies a different role via the Aruba-User-Role VSA. Since CPPM sends Aruba-User-Role: role4, and role4 exists on the switch, Client1 is assigned role4 (VLAN 14), overriding the default auth-role (role3).

Client2 on port 1/1/2:

Client2 does not attempt to authenticate (i.e., does not send 802.1X credentials).

In AOS-CX, if a client does not attempt authentication and no other authentication method (e.g., MAC authentication) is configured, the client is placed in the preauth-role (role2, VLAN 12). This role is applied before authentication or when authentication is not attempted, allowing the client limited access (e.g., to perform authentication or access a captive portal).

Option A, "Client1 = role3; Client2 = role2," is incorrect because Client1 should be assigned role4 (from the VSA), not role3.

Option B, "Client1 = role4; Client2 = role1," is incorrect because Client2 should be assigned the preauth-role (role2), not the critical-role (role1), since the RADIUS server is reachable (Client1 authenticated successfully).

Option C, "Client1 = role4; Client2 = role2," is correct. Client1 gets role4 from the VSA, and Client2 gets the preauth-role (role2) since it does not attempt authentication.

Option D, "Client1 = role3; Client2 = role1," is incorrect for the same reasons as Option A and Option B.

The HPE Aruba Networking AOS-CX 10.12 Security Guide states:

"After successful 802.1X authentication, the AOS-CX switch assigns the client to the auth-role configured for the port (e.g., aaa authentication port-access auth-role role3). However, if the RADIUS server returns an Aruba-User-Role VSA (e.g., Aruba-User-Role: role4), and the specified role exists on the switch, the client is assigned that role instead of the auth-role. If a client does not attempt authentication and no other authentication method is configured, the client is assigned the preauth-role (e.g., aaa authentication port-access preauth-role role2), which provides limited access before authentication." (Page 132, 802.1X Authentication Section)

Additionally, the guide notes:

"The critical-role (e.g., aaa authentication port-access critical-role role1) is applied only when the RADIUS server is unavailable. The preauth-role is applied when a client connects but does not attempt 802.1X authentication." (Page 134, Port-Access Roles Section)

An ArubaOS user role determines the firewall policies and bandwidth contracts that apply to the client’s traffic. When a user is authenticated, they are assigned a role, and this role has associated policies that govern network access rights, Quality of Service (QoS), Layer 2 forwarding, Layer 3 routing behaviors, and bandwidth contracts for users or devices.

MAC authentication, also known as MAC-Auth, is a method used to authenticate devices based on their Media Access Control (MAC) address. It is often employed in both wired and wireless networks to grant network access based solely on the MAC address of a device. While MAC-Auth is straightforward and doesn’t require complex configuration, it has significant security limitations primarily because MAC addresses can be easily spoofed. Attackers can change the MAC address of their device to match an authorized one, thereby gaining unauthorized access to the network. This susceptibility to MAC address spoofing makes MAC-Auth a weaker security mechanism compared to more robust authentication methods like 802.1X, which involves mutual authentication and encryption protocols.