Network Security and Segmentation
Segmentation models
Aruba supports multiple segmentation approaches: VLAN-based segmentation (traditional), role-based access via Aruba ClearPass and downloadable user roles, and microsegmentation using AOS-CX and Aruba Central. Understand the difference between VLAN-centric design and role-centric design - the latter decouples policy from topology and is preferred for dynamic environments.
ClearPass and policy
ClearPass Policy Manager is the policy engine: it performs 802.1X, MAC authentication, profiling, and posture. Key concepts: enforcement profiles, enforcement policies, role mapping, and CoA (Change of Authorization). Aruba's role-based access control (RBAC) on AOS-CX uses user roles and policies applied at the port. Understand how ClearPass returns a role to the switch or gateway, and how that role maps to a policy.
Traffic controls
Know ACLs, port security, DHCP snooping, dynamic ARP inspection, and storm control. For wireless, understand how roles apply to clients and how firewall policies are enforced at the gateway or AP.
Traps
- Confusing authentication (who you are) with authorization (what you can do).
- Assuming ClearPass enforces policy itself - it returns attributes; the switch/gateway enforces.
- Forgetting that CoA is needed to re-apply policy after a change.
- Mixing up downloadable roles (wireless/gateway) with AOS-CX local user roles.
Rule of thumb
If a question asks where policy is enforced, the answer is the network device (switch, gateway, AP), not ClearPass. ClearPass is the decision point; the network is the enforcement point.