HPE6-A47 Designing Aruba Solutions Questions and Answers

802.1X authentication without tunnelled node is a form of port-based network access control that uses the Extensible Authentication Protocol (EAP) to authenticate users and devices on a wired network. This form of authentication provides several benefits, such as:

It enables user access control and ensures only authorized users connect. This prevents unauthorized access to the network and its resources, and enhances security and compliance.

It allows dynamic assignment of VLANs and roles based on user identity and device type. This simplifies network management and improves user experience.

It supports multiple authentication methods, such as certificates, passwords, tokens, or biometrics. This provides flexibility and choice for users and administrators.

It integrates with Aruba ClearPass Policy Manager (CPPM) for centralized policy enforcement and visibility. This enables granular control and monitoring of wired user traffic and devices.  References :

Aruba 2930M Switch Series - Data sheet)

Aruba ClearPass Policy Manager - Data sheet)

ArubaOS-Switch Wired Access with ClearPass - Configuration guide)

Jitter is the variation in the delay of packets arriving at the destination. It is caused by network congestion, routing changes, or other factors that affect the transmission quality. Jitter can affect the quality of VoIP calls, as it can cause gaps, distortion, or echo in the audio. According to the Aruba Validated Reference Design for Voice and Video over Wi-Fi, the recommended maximum jitter for VoIP calls is 30 ms. Therefore, a jitter of 100 ms would typically cause a poor experience for users.

The other options are incorrect because:

A. The packet loss is the percentage of packets that are lost or discarded during transmission. Packet loss can affect the quality of VoIP calls, as it can cause missing or corrupted audio. However, according to the Aruba Validated Reference Design for Voice and Video over Wi-Fi, the recommended maximum packet loss for VoIP calls is 1 percent. Therefore, a packet loss of 0.3 percent would not typically cause a poor experience for users.

B. The throughput is the amount of data that can be transferred per unit of time. Throughput can affect the quality of VoIP calls, as it determines the bandwidth available for the audio. However, according to the Aruba Validated Reference Design for Voice and Video over Wi-Fi, the typical throughput for VoIP calls is 64 Kbps. Therefore, a throughput of 67 Kbps would not typically cause a poor experience for users.

C. The latency is the delay between the sender and the receiver of packets. Latency can affect the quality of VoIP calls, as it can cause delays or out-of-sync audio. However, according to the Aruba Validated Reference Design for Voice and Video over Wi-Fi, the recommended maximum latency for VoIP calls is 150 ms. Therefore, a latency of 100 ms would not typically cause a poor experience for users.

References :

Aruba Validated Reference Design: Voice and Video over Wi-Fi - Chapter 2)

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47) - Chapter 7)

A customer who has an Instant AP deployment and needs to provide client-to-site VPN access for remote users would benefit from adding a controller to the deployment. A controller can act as a VPN concentrator that terminates the VPN tunnels from the remote clients and provides secure access to the corporate network. The controller can also apply firewall policies and role-based access control to the VPN traffic.  An Instant AP deployment alone cannot provide this functionality, as it only supports site-to-site VPN between Instant AP clusters 1 2 . The other options do not require a controller, as they can be achieved with an Instant AP deployment.  An Instant AP deployment can apply role-based firewall policies using the built-in stateful firewall on each Instant AP 3 .  An Instant AP deployment can also provide a captive portal for guests using the internal or external web server options 4 .  An Instant AP deployment can be managed by a cloud-based solution such as Aruba Central, which does not require a controller 5 .  References :

1 : Understanding IAP-VPN Architecture - Aruba

2 : Configuring IAP-VPN - Aruba

3 : Firewall Roles and Policies - Aruba

4 : Configuring Captive Portal - Aruba

5 : Managing Instant AP from Aruba Central - Aruba

The Aruba MC 7010 and 7024 are both designed for small to mid-sized campuses and branches, but they have some differences in their features and specifications. One of the main differences is the number and type of ports they offer.  The MC 7010 has 16 10/100/1000BASE-T ports, while the MC 7024 has 8 10/100/1000BASE-T ports and 8 1000BASE-X SFP ports 1 .  This means that the MC 7024 can support more APs that require fiber connections, such as the AP-387 or the AP-535 2 .  The MC 7024 also supports 10G ports, which can provide higher bandwidth and performance for the network backbone 3 .

Therefore, if the customer needs to connect 20 APs directly to the MC, and some of them require fiber or 10G connections, the MC 7024 is a better choice than the MC 7010.  The other options (A, B, and C) are not relevant for choosing between the MC 7010 and 7024, as both models can support up to 64 APs and 4096 users or devices, and both models can provide PoE+ on 12 ports 1 .

References :

Aruba 7000 Series Mobility Controllers Data Sheet

Aruba Access Points Data Sheet

Aruba 7000 Series Mobility Controllers and Gateways

The customer needs to upgrade their wireless network, which has a single large building with four floors. The customer requires 30 APs on each floor, totaling 120 APs for the whole building. The customer also wants to use a MM-based architecture, and deploy one Aruba 7030 MC on each floor, with the MCs combined in a cluster for seamless client failover and roaming. However, the proposed solution does not meet the customer’s requirements, because the Aruba 7030 MC does not support enough APs for the customer’s needs. Each Aruba 7030 MC can only support up to 64 APs, which means that deploying one on each floor would not be enough to support all the required APs. The architect should explain this limitation to the customer, and suggest a different solution that can support more APs, such as using a higher-capacity MC model, or deploying more MCs per floor.

References :

Aruba 7000 Series Mobility Controllers Data Sheet)

ArubaOS 8.5 User Guide)

Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

To plan a wireless solution upgrade for printers, the architect needs to know whether the printers support 802.1X and the 802.11 standards supported by the printer. These two factors are important for ensuring the compatibility, security, and performance of the wireless network.

802.1X is a standard for network access control that provides authentication, authorization, and encryption for devices that connect to a wireless network 1 . It prevents unauthorized devices from accessing the network resources and protects the data transmission from eavesdropping or tampering. If the printers support 802.1X, the architect can design a wireless solution that leverages this feature to enhance the security and compliance of the network.  If the printers do not support 802.1X, the architect may need to consider alternative methods of securing the wireless access, such as MAC address filtering, VPN, or WPA2-PSK 2 .

802.11 is a set of standards that define the specifications and protocols for wireless communication 3 . Different 802.11 standards have different characteristics, such as frequency, bandwidth, data rate, range, and compatibility.  For example, 802.11a operates at 5 GHz and offers up to 54 Mbps, while 802.11b operates at 2.4 GHz and offers up to 11 Mbps 3 . If the printers support the same or higher 802.11 standards as the wireless network, the architect can design a wireless solution that ensures the optimal performance and reliability of the wireless communication.  If the printers support lower or different 802.11 standards than the wireless network, the architect may need to consider the impact of the compatibility issues, such as interference, congestion, or degradation 4 .

The other options are not as relevant for planning a wireless solution upgrade for printers. Whether the printers are physically locked down or not does not affect the wireless connectivity, unless the lock interferes with the antenna or signal reception. The identity of users who need to access printers is more related to the access control and user management policies, rather than the wireless solution design. Whether the printers support PoE or not does not affect the wireless connectivity, unless the power source is unreliable or insufficient.

References :

1 : https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/802.1x.htm

2 : https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/securing-wireless-access.htm

3 : https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/802.11-standards.htm

4 : https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/1-overview/compatibility-issues.htm

According to the Designing Aruba Solutions course, dedicated Air Monitors (AMs) are APs that are configured to scan all channels for wireless threats and perform wireless intrusion prevention system (WIPS) functions. One of the advantages of using dedicated AMs over APs that are doing WIPS in AP mode (hybrid) is that AMs can implement wireless containment on any channel on which they detect a threat without affecting the service of legitimate clients. Wireless containment is a technique that prevents rogue APs or clients from communicating with the network by sending deauthentication or disassociation frames to them. However, if an AP that is serving clients performs wireless containment on a different channel, it will have to switch channels frequently, which will degrade the performance and user experience of the clients. Therefore, dedicated AMs are recommended for customers who need effective and efficient wireless containment without compromising client service.

References :

Designing Aruba Solutions, Rev. 20.11 , Module 5: Aruba Security Design, page 5-13

Aruba Validated Reference Design: Wireless Intrusion Prevention System , page 10

 Aruba AirWare is a network management solution that provides real time statistics and assessment of call quality for Skype for Business UC solution. It integrates with Skype for Business SDN API to monitor and troubleshoot voice and video calls, and optimize network performance and user experience. It also provides visibility into network health, application performance, and user behavior across wired and wireless networks. Aruba Central is a cloud-based network management solution that does not support Skype for Business integration. Aruba Mobility Master (MM) is a network controller that manages Aruba access points and switches, but does not provide call quality statistics or assessment. Aruba ClearPass is a network access control solution that provides secure authentication and policy enforcement, but does not monitor or optimize Skype for Business calls.  References : Aruba AirWave Network Management), Aruba AirWave and Microsoft Skype for Business Integration Guide)

 In local mode, the IAP cluster at the branch office has a local subnet and the master IAP of the cluster acts as the DHCP server and gateway for clients. The local mode provides access to the corporate network using the inner IP of the IPsec tunnel. The local mode is recommended for this scenario because it allows the branch office to remain functional even if the link to the main office fails, as the clients can still obtain IP addresses and access local resources.  The local mode also avoids the need for additional routing or switching configuration on the MC or the branch office network 1 2 .  References :

1 : Understanding IAP-VPN Architecture - Aruba

2 : IAP-VPN Forwarding Modes - Aruba

The IRIS BOM is missing stacking modules and cables for the Aruba 2930M switches. The customer wants to flatten the architecture and avoid recabling, but also maintain connectivity to the core if one link fails. To achieve this, the architect proposed to combine the switches in each Building 2 closet as a VSF fabric and establish two 10 GbE connections to the core per fabric. However, to create a VSF fabric, the switches need to have stacking modules and cables to interconnect them. The IRIS BOM does not include these items, which are required for the VSF configuration. The part numbers for the stacking modules and cables are JL325A and J9735A, respectively.

The other options are not missing from the IRIS BOM because they are either not required or already included. Stacking licenses are not required for the Aruba 2930M switches, as they support VSF natively. 10 GbE direct attach cables are already included in the IRIS BOM as part number J9283D. An uplink module for one of the switches is not required, as the customer already has enough fiber strands to connect each switch to the core.  References :

Aruba 2930M Switch Series Data Sheet (Aruba Networks)

Designing Aruba Solutions Study Guide (HPE Press)

ClearPass Access licenses are required for each unique endpoint that authenticates to ClearPass using any supported protocol, such as 802.1X, MAC authentication, web authentication, or VPN authentication 1 .  ClearPass Onboard licenses are required for each unique endpoint that is provisioned with a certificate using the ClearPass Onboard service 2 . In this scenario, the customer has 900 employees and up to 30 guests a day, which means there are at most 930 users who need to authenticate to the network. Assuming each user has about two or three devices, the maximum number of devices that need Access licenses is 930 x 3 = 2790, which can be rounded up to 3000. The customer also wants to use certificates to authenticate user devices, which means they need Onboard licenses as well. However, the customer only issues laptops to the employees, which means only 900 devices need Onboard licenses. Therefore, the architect should include 3000 Access licenses and 1000 Onboard licenses in the proposal.  References :

1 : ClearPass Licensing Guide - Aruba

2 : ClearPass Onboard Data Sheet - Aruba

The frequency of the radio wave is one of the most important factors that determines the antenna performance and compatibility. The antenna must be designed to operate at the same frequency band as the radio, otherwise the impedance mismatch will cause signal loss and reflection. The frequency also affects the size, shape, and radiation pattern of the antenna. For example, a lower frequency requires a larger antenna to achieve the same gain and directivity as a higher frequency antenna.  The frequency also determines the available bandwidth and channel spacing for the wireless communication 1 2 . Therefore, it is essential to ensure that the antenna is designed for the frequency used by the radio.  References :

1 : Antenna selection guidelines - STMicroelectronics

2 : Guide to Selecting the Right Antenna - Telco Antennas

To route at the core and extend some of the same VLANs in different buildings, the architect should recommend creating a backplane stack at the aggregation layer and a VSF fabric at the core. A backplane stack is a logical switch that combines multiple physical switches into a single unit, using dedicated stacking cables or ports. A VSF fabric is a virtual switch that combines multiple physical switches into a single unit, using standard Ethernet links.  Both technologies provide high availability, scalability, and simplified management for the network 1 2 .

By creating a backplane stack at the aggregation layer, the architect can reduce the number of routing interfaces and routing protocols needed at the core layer, as well as simplify the configuration and maintenance of the aggregation switches. By creating a VSF fabric at the core layer, the architect can enable Layer 2 connectivity across different buildings, as well as provide redundancy and load balancing for the core switches.  The VSF fabric can use Multi-Chassis Link Aggregation (MC-LAG) to extend the same VLANs to different aggregation stacks, without creating loops or blocking ports 3 .

The other options are not suitable for the customer’s requirements. Implementing broadcast filtering on switch-to-switch links across all of the buildings would not enable Layer 2 connectivity across different buildings, as it would prevent the propagation of Layer 2 control traffic, such as Spanning Tree Protocol (STP) and VLAN Trunking Protocol (VTP). Combining all switches in the aggregation layer and core into a single backplane stack would not be feasible, as it would require compatible switches and sufficient stacking ports or cables, as well as create a single point of failure for the entire network. Using VRRP on the core and aggregation switches, with the aggregation switches acting as standby, would not eliminate the routing at the aggregation layer, as it would still require the aggregation switches to participate in the routing process and maintain routing tables.

References :

ArubaOS-Switch Stacking Guide

ArubaOS-Switch Virtual Switching Framework Configuration Guide

Aruba Validated Reference Design: Campus Wired LAN

 The number of devices used by each user is an important factor for creating the RF plan, as it affects the network capacity, bandwidth demand, and interference level. The architect should estimate the average number of devices per user and the types of applications they use, such as voice, video, or data. This will help the architect to determine the optimal number and placement of access points, the channel width and selection, the transmit power and data rates, and the radio resource management settings.

The OS used on wireless devices, whether BLE wayfinding is required, and the software version on MCs are not directly relevant for creating the RF plan, as they do not affect the physical layer characteristics of the wireless network. However, they may have implications for other aspects of the network design, such as security, compatibility, and features.

References :

RF Design | Validated Solution Guide - Aruba

Enterprise Mobility 8.5 Design Guide - WLAN RF Design Considerations [Cisco 5500 Series Wireless Controllers] - Cisco

whether the MC needs to support advanced 8.x features. This is because the Aruba 7000 Series MCs are based on the older hardware platform and can only run up to ArubaOS 6.5.x, while the Aruba 7200 Series MCs are based on the newer hardware platform and can run ArubaOS 8.x and above. ArubaOS 8.x introduces many advanced features, such as clustering, MultiZone, AirMatch, and dynamic segmentation, that are not supported by the Aruba 7000 Series MCs. Therefore, if the architect needs to design a solution that leverages these features, the Aruba 7200 Series MCs are the better choice.

Option A is incorrect because the number of wireless devices that the MC needs to support is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can support a similar number of devices, depending on the model and license.

Option B is incorrect because whether the MC needs to terminate VPN tunnels is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can terminate VPN tunnels, such as IPSec, GRE, and RAP, depending on the model and license.

Option C is incorrect because the need to deploy controllers in a cluster is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can participate in a cluster, as long as they run the same ArubaOS version and have the same license.

References : The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 6: Wireless Network Design, where the MC selection and ArubaOS 8.x features are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Controller Data Sheet ArubaOS 8.7 User Guide

 The correct answer is option C, voice. Voice applications have the greatest potential impact on RF design because they are sensitive to latency, jitter, and packet loss. Voice applications also require a minimum signal strength and signal-to-noise ratio to ensure good voice quality. Therefore, an architect needs to consider the number of voice devices, the codec used, the roaming behavior, and the call admission control when planning the RF coverage for voice applications.  References : The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 3: Wireless LAN Technologies and Standards, where the RF design considerations for voice applications are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Fundamentals Guide