I85PREP
⌘ K
Aruba Network Security Expert (Written) study materials
Aruba Network Security Expert (Written) study resources

Aruba Network Security Expert (Written): Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

Aruba Network Security Expert (Written) · Work through your exam, one topic at a time.

All guide sections

Identity, Authentication, and Access Control (AAA, 802.1X, RADIUS, Roles)

The AAA chain

Authentication proves identity, authorization decides permission, accounting records activity. In 802.1X, the supplicant (endpoint) authenticates to the authenticator (switch/AP/controller), which relays to the authentication server (RADIUS, typically ClearPass) inside EAP. Know EAP method families: PEAP and EAP-TLS use server certificates; EAP-TLS also requires client certificates; EAP-TTLS and PEAP commonly tunnel an inner method. MSCHAPv2 inner methods are password-based and weaker than certificate-based.

Roles and derivation

Authorization can be driven by returned RADIUS attributes, device posture, or endpoint profiling. A role is a policy container applied to a user or device session; it should be derived from identity plus context, not from static port configuration. Understand RADIUS message types (Access-Request, Access-Challenge, Access-Accept, Access-Reject) and that a challenge is not a failure.

Traps

  • Assuming EAP-TLS works without a client certificate - it cannot.
  • Treating a RADIUS timeout as an authentication rejection; timeouts usually fall to a failover or default role.
  • Forgetting that MAC authentication (MAB) is weak and should be a fallback, not a primary control.
  • Mixing up which side initiates: the supplicant initiates, the authenticator relays.

Worked example

A laptop presents a valid certificate but no user credential. If the policy requires user identity, the session may still authenticate at the machine level and receive a restricted role until user login completes - design for that transitional state rather than rejecting it outright.