Wireless Security, Authentication, Encryption, Roles, and Policies
Authentication and encryption
WPA2-Personal uses a pre-shared key (PSK) with CCMP/AES. WPA2-Enterprise uses 802.1X: the supplicant, the AP/controller as authenticator, and a RADIUS server as authentication server; EAP methods include PEAP, EAP-TLS, and EAP-TTLS. WPA3-Personal replaces the PSK handshake with SAE, resisting offline dictionary attacks; WPA3-Enterprise adds stronger cryptographic suites, including a 192-bit mode. WPA3 requires protected management frames (802.11w PMF). Captive portal provides web-based authentication for guests or BYOD, often combined with a pre-auth role and a post-auth role.
Roles and policies
Aruba uses role-based access control. A client receives an initial role before authentication, then a derived role from the AAA profile-server attributes, user rules, or authentication type. The role maps to a stateful firewall policy that permits or denies traffic; the policy is enforced at the controller/gateway in tunnel mode and at the AP in bridge mode where supported. Default-deny behavior means an unauthenticated client should reach only the captive portal or DHCP/DNS as explicitly allowed.
Traps
WPA3-Personal is SAE, not "WPA2 with a longer PSK." 802.1X uses RADIUS, not TACACS+. PMF is optional in WPA2 but mandatory in WPA3. A role is not a VLAN; a role controls policy, while VLAN placement is separate.
Worked example
Guest design: initial role "guest-logon" permits DHCP/DNS and the captive portal; after portal authentication the user is placed in "guest" with an Internet-only policy. If guests get an IP but no portal, check the initial role's policy before changing the SSID encryption.