Aruba Security Architecture and Solution Components
Core concepts
Understand how Aruba splits control and data planes to enforce policy. Key components: Aruba Mobility Controllers (or gateways) that terminate tunnels and enforce roles, ArubaOS-Switch/Aruba CX switches for wired access, Aruba ClearPass for policy and AAA, Aruba Central for cloud management, and the Aruba IntroSpect/network detection layer for analytics. Know that role-based enforcement can occur at the controller/gateway (tunneled traffic) or at the access switch (for local traffic).
Where policy is enforced
A user role is a named set of rules (ACL, VLAN, bandwidth, session attributes) applied after authentication. The enforcement point depends on forwarding mode: tunnel/overlay traffic is inspected at the gateway; bridge/local traffic is enforced at the edge. Firewall roles can be stateful at the gateway and stateless ACLs at the switch. Understand that ClearPass is the policy decision point while the controller/switch is the policy enforcement point.
Traps to watch
Questions mislabel ClearPass as the enforcement device; it decides, it does not forward user traffic. Another trap is assuming all traffic is tunneled - bridged traffic bypasses the gateway role. Also distinguish the management plane (admin access, SSH/HTTPS) from the control plane (protocols) and data plane (user traffic) when asked where to apply hardening.
Rule of thumb
For any "where is policy applied?" question, first identify the forwarding mode (tunnel vs. bridge/local), then name the device that sees that traffic.