Wired and Wireless Security Enforcement (Dynamic Segmentation, Tunnels, Device Profiles)
Dynamic segmentation
Role-based policy applied at the enforcement point lets one infrastructure serve many trust levels. On Aruba fabrics, user roles and policies are applied at the edge or gateway; traffic may be tunneled to a gateway for centralized inspection. Understand tunneled vs. local/bridged forwarding: tunneling centralizes policy and inspection at the cost of hairpinning traffic; local forwarding reduces latency and WAN load but pushes policy to the edge.
Device profiles and enforcement
Device profiles group endpoints by type and assign roles and VLANs. Wired enforcement uses 802.1X, MAB, or device-mode with downloadable roles. Port-based vs. user-based authentication changes behavior when multiple devices share a port - the classic trap: a downstream hub or IP phone means the first device to authenticate may lock the port to its role.
Traps
- Assuming tunneled traffic automatically gets inspected - inspection must be configured.
- Confusing authentication role with VLAN assignment; role can carry VLAN but they are distinct.
- Ignoring multi-device ports and voice VLAN interactions.
- Forgetting that a failed authentication may leave a port in a default or closed state depending on configuration.
Rule of thumb
Choose tunneled mode when centralized policy and inspection outweigh latency; choose local when the branch link is constrained. Document the trade-off, because exam questions often ask which mode fits a stated constraint.