Aruba Network Security Associate cheat sheet

CIA triad: Confidentiality (encryption, access control), Integrity (hashing, checksums), Availability (redundancy, DDoS mitigation).

Threat vs. vulnerability vs. risk: a threat is a potential cause of harm, a vulnerability is a weakness, and risk is the likelihood of a threat exploiting a vulnerability times impact.

Encryption types: symmetric (AES, same key both ends, fast) vs. asymmetric (RSA/ECDSA, public/private key pair, used for key exchange and signatures).

Hashing (SHA-256, SHA-1) is one-way and detects tampering; it does not provide confidentiality.

Common attack categories: reconnaissance, social engineering (phishing, pretexting), on-path (MITM), DoS/DDoS, and credential attacks (brute force, password spraying).

Evil twin and rogue AP attacks exploit the fact that clients trust SSIDs; a rogue AP is an unauthorized AP on the wired network, an evil twin impersonates a legitimate SSID.

Zero Trust principle: never trust implicitly, verify explicitly, and enforce least privilege regardless of network location.

Defense in depth layers controls: physical, network (segmentation, firewall), endpoint, application, and data, so no single control failure is fatal.

PCI DSS, HIPAA, and GDPR are compliance drivers that mandate encryption of cardholder/PHI data in transit and at rest.

802.1X roles: supplicant (client), authenticator (switch/controller), and authentication server (RADIUS). EAP is the framework; EAP-TLS uses certificates on both sides, PEAP uses a server cert plus inner MS-CHAPv2.

EAPOL frames carry 802.1X messages between supplicant and authenticator; RADIUS carries them between authenticator and server (UDP 1812 auth, 1813 accounting).

MAB (MAC Authentication Bypass) authenticates non-supplicant devices by MAC address; it is weak because MACs can be spoofed, so use it only for devices that cannot run 802.1X.

Port states in 802.1X: unauthorized, authenticated, and the critical/VLAN fallback state when the RADIUS server is unreachable.

RADIUS attributes drive authorization: Tunnel-Type, Tunnel-Medium-Type, and Tunnel-Private-Group-ID assign a client VLAN; Filter-Id can reference a role or ACL.

WPA2-Personal uses PSK; WPA2-Enterprise uses 802.1X/EAP. WPA3 adds SAE (resistant to offline dictionary attacks) and mandatory PMF (802.11w).

Captive portal authentication intercepts HTTP/HTTPS before authorization and can combine with a guest role; it is weaker than 802.1X because it authenticates users, not devices.

RADIUS shared secret authenticates the authenticator to the server; mismatched secrets are a common cause of 802.1X failures.

Certificate-based EAP-TLS requires a client cert and a server cert trusted by the supplicant; a missing or expired cert breaks authentication.

A role is a named set of permissions/ACLs assigned to a user or device after authentication; a VLAN is a Layer 2 segment. Role assignment can be static or dynamic (from RADIUS attributes).

Policy enforcement points on Aruba are typically the mobility controller/AP (wireless) and the access switch (wired); the policy decision point is the RADIUS/AAA server.

Role derivation sources: 802.1X/RADIUS attributes, MAC-based rules, device fingerprinting, captive portal, and default/unauthenticated role.

Role-based ACLs are applied at the edge (controller or switch port) and should default-deny with explicit permit rules to least-privilege destinations.

RBAC follows least privilege and separation of duties; roles should be scoped by function (guest, employee, IoT, admin) rather than by individual.

A user role and a VLAN can be decoupled: role-based policies allow the same VLAN to carry multiple roles with different ACLs, improving flexibility over VLAN-per-role.

Default roles must be restrictive; an unauthenticated role typically permits only DHCP, DNS, and captive-portal access.

Role assignment should be auditable: log the role, the derivation source, and the time of assignment for incident review.

WPA2-Enterprise configuration requires: RADIUS server reachable from the controller, correct shared secret, server certificate trusted by clients, and an EAP method supported by both sides.

WPA3-Enterprise (192-bit mode) requires stronger ciphers (GCMP-256) and PMF; WPA3-Personal uses SAE instead of PSK.

SSID security best practices: disable WEP/TKIP, prefer WPA2/WPA3, disable SSID broadcast only as a minor obscurity measure (not a security control).

WIPS/WIDS detects and can contain rogue APs, evil twins, and deauth floods; containment sends deauth frames to clients on the offending AP.

Wired port security: enable 802.1X on access ports, disable unused ports, and use DHCP snooping plus Dynamic ARP Inspection to block spoofing.

Management plane hardening: use HTTPS/SSH not HTTP/Telnet, disable unused services, and restrict management access by source subnet.

Guest networks should be isolated (separate VLAN, client isolation enabled) and rate-limited to limit lateral movement.

For IoT and headless devices, use MAB with a dedicated restricted role and VLAN rather than open access.

Log sources: controller/AP syslog, RADIUS authentication logs, switch port events, and DHCP/DNS logs; centralize with syslog (UDP/TCP 514) or SIEM.

Key events to monitor: repeated 802.1X failures, MAB fallback spikes, rogue AP detections, deauth floods, and role changes.

NTP synchronization is required for correlating timestamps across devices; unsynchronized clocks break incident timelines.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, and lessons learned.

Containment options include disabling the port, blacklisting the MAC, changing the shared secret, and revoking certificates.

Authentication logs should record username, MAC, AP/switch, result, and reason code; RADIUS reason codes distinguish bad credentials from unreachable servers.

Retention and integrity: logs should be stored off-device, protected from tampering, and retained per compliance requirements (e.g., PCI DSS 1 year, 3 months readily available).

Alerting thresholds should baseline normal failure rates; a sudden spike in 802.1X rejects often indicates a misconfiguration or credential attack.