Aruba Network Security Professional cheat sheet

CIA triad: Confidentiality (encryption/access control), Integrity (hashing, signatures), Availability (redundancy, DoS defense).

Threat categories: reconnaissance, spoofing, on-path (MITM), DoS/DDoS, credential theft, rogue AP/evil twin, MAC flooding, ARP poisoning.

Encryption symmetry: symmetric (AES) is fast and key-distribution-bound; asymmetric (RSA/ECDSA) solves key exchange but is slow.

TLS protects transit confidentiality/integrity; it does not authenticate the endpoint user unless mutual auth (EAP-TLS) is used.

Hashing (SHA-256) gives integrity and password storage; salting defeats rainbow tables; HMAC adds keyed integrity.

PKI trust chain: root CA -> intermediate CA -> leaf/server cert; validation checks signature, validity dates, and name/SAN match.

Risk = likelihood x impact; controls are preventive, detective, or corrective, and map to defense-in-depth layers.

Common ports to know: RADIUS 1812/1813, TACACS+ 49, HTTPS 443, LDAP 389 / LDAPS 636, Syslog 514, SNMP 161/162.

Aruba ESP pillars: unified infrastructure (AOS-CX/AOS), AIOps, security (ClearPass + Dynamic Segmentation), and unified edge (gateways).

Dynamic Segmentation separates role assignment from topology: user/device role travels with traffic across wired, wireless, and WAN.

AOS-CX role-based ACLs (RBAC) enforce policy in hardware at the switch port; AOS gateways apply policy for tunneled/WAN traffic.

ClearPass Policy Manager is the policy decision point; NADs (switches, APs/controllers, gateways) are policy enforcement points.

Aruba Central provides cloud management, monitoring, and AI-driven insights; on-prem equivalent uses controllers and ClearPass.

Roles can be statically assigned (port/VLAN) or dynamically derived (802.1X, MAC auth, device fingerprint, posture).

Tunneled node (gateway) vs. local (switch/controller) enforcement: tunneled centralizes policy but adds hairpin path considerations.

ClearPass modules: Policy Manager (AAA/policy), Onboard (certificate provisioning), OnGuard (posture), Guest, and Insight (reporting).

802.1X EAP methods: EAP-TLS (mutual certs, strongest), PEAP/EAP-TTLS (server cert + inner MSCHAPv2), EAP-TLS recommended for devices.

RADIUS flow: NAD sends Access-Request; server returns Access-Accept/Reject/Challenge; accounting uses 1813.

ClearPass service selection matches on NAD/device, SSID/port, and authentication method; ordered top-down, first match wins.

Authentication sources: AD/LDAP, local DB, SQL, token servers; authorization uses role mapping, enforcement profiles, and rules.

CoA (Change of Authorization, RFC 5176) lets ClearPass push a new role/profile to a connected session without reauthentication.

MAB (MAC authentication) is weak (spoofable) - pair with profiling and treat as fallback, not primary trust.

TACACS+ (port 49, TCP, encrypts full payload) is used for device admin AAA; RADIUS encrypts only the password field.

Certificate-based EAP-TLS requires client certs from Onboard or an enterprise PKI; server cert must chain to a trusted CA on the supplicant.

RBAC model: subject (user/device) -> role -> permissions; roles are assigned by policy, not by static port membership.

ClearPass role mapping rules evaluate authorization attributes (AD groups, posture, device type, location) to assign a role.

AOS-CX role ACLs are applied as port-access roles; each role carries permit/deny ACEs and optional QoS/redirect actions.

Enforcement profiles define the downloadable role, VLAN, or ACL returned in the RADIUS Access-Accept.

Default/fallback role applies when no rule matches - keep it least-privilege (e.g., captive portal or deny).

Policy should follow least privilege and separation: IoT, guest, corporate, and voice get distinct roles and segmentation.

Role changes take effect on next auth or via CoA; verify with show port-access role and session tables.

Conflict rule: explicit deny beats permit; ACL order matters; verify hardware resource limits for role ACLs.

WPA3-Enterprise uses 192-bit Suite-B cryptography (GCMP-256, SHA-384); WPA3-Personal replaces PSK with SAE (dictionary-attack resistant).

WPA2-Enterprise = 802.1X + AES-CCMP; WPA2-Personal uses PSK (vulnerable to offline dictionary attacks via captured handshake).

Wired port security: 802.1X (recommended), MAC auth fallback, port-security MAC limits, and DHCP snooping/DAI/ARP inspection.

Enable BPDU guard, root guard, and loop protection on access ports; disable unused ports and assign an unused VLAN.

Dynamic Segmentation on wired: port-access role from ClearPass with per-role ACLs and optional tunneled-node to gateway.

Wireless hardening: disable WEP/TKIP, use PMF (802.11w) to protect management frames, disable rogue/unauthorized SSIDs.

RADIUS server config on NAD must match shared secret and auth/accounting ports; mismatches cause silent rejects.

Guest/BYOD flows: captive portal with ClearPass Guest and Onboard for certificate enrollment; isolate guest VLAN from corporate.

ClearPass Insight provides authentication reports, audit logs, and alerting; correlate failed auths for brute-force detection.

AOS-CX/AOS logging: send syslog to a collector, enable NTP for accurate timestamps, and forward to SIEM.

Rogue AP detection: APs scan for neighboring BSSIDs; classify as rogue (on wire) vs. interfering (no wire) and contain if policy allows.

WIDS/WIPS features: detect evil twin, deauth floods, and spoofed BSSIDs; containment sends deauth to rogue clients.

Incident response lifecycle: prepare, detect, contain, eradicate, recover, lessons learned; preserve evidence and logs.

SNMP traps and streaming telemetry feed Aruba Central AIOps for anomaly detection and baseline deviation alerts.

Key indicators: spikes in EAP failures, repeated MAB rejects, CoA storms, high deauth rates, and role changes on critical ports.

802.1X failure triage: check supplicant EAP method, server cert trust, RADIUS shared secret, and ClearPass service match in order.

Use show port-access clients / show authentication sessions to confirm role, VLAN, and auth state on AOS-CX.

ClearPass Access Tracker shows the request, matched service, auth source result, and enforcement profile - start here for AAA issues.

RADIUS timeouts often = shared secret mismatch, unreachable NAD, or firewall blocking 1812/1813; check reachability first.

CoA not applying: verify RFC 5176 support, correct NAD IP/secret, and that the NAS is listening on the CoA port (3799).

Certificate errors: validate chain, expiration, SAN/CN, and that the client trusts the issuing CA; clock skew breaks validation.

Validation: test with a known-good supplicant, capture packets (EAPOL/RADIUS), and confirm policy with role ACL counters.

Common pitfalls: duplicate MAC entries, wrong VLAN in enforcement profile, stale sessions needing reauth, and DNS/NTP misconfig.