Authentication, Authorization, and Security
AAA architecture
Master the roles of RADIUS, 802.1X/EAP, MAC authentication, and captive portal, plus Aruba's role-based access control where a user role derives from server attributes or rules. Understand AAA profiles, server groups, fail-through behavior, and CoA/Disconnect messages for dynamic policy changes.
Security controls
Know WPA2/WPA3-Enterprise, Protected Management Frames (PMF), and Enhanced Open (OWE). Understand dynamic segmentation and role derivation from RADIUS attributes (e.g., Aruba-User-Role). Familiarize yourself with tunneled EAP (PEAP/TTLS) inner/outer identity handling and certificate validation traps.
Traps
Questions often confuse authentication success with authorization outcome - a user can authenticate but land in a deny role. Another trap: MAC auth is not strong authentication and is easily spoofed. Watch for fail-through vs. fail-closed server group behavior and the order of authentication methods in a AAA profile.
Worked example
A guest SSID using captive portal with MAC caching: first connection requires portal login; subsequent connections use cached MAC until expiry. If the RADIUS server is unreachable, fail-through to the next server group determines access - misconfigured fail-through can lock out or over-permit users.
Best practice
Enforce certificate validation on supplicants and prefer WPA3-Enterprise where possible.