Role-Based Access Control and Policy Enforcement
Core concepts
RBAC in Aruba centers on user roles derived from authentication and context. Understand role derivation sources: 802.1X identity, MAC, device type, posture, location, and time. A role carries an ACL (permit/deny rules), VLAN assignment, bandwidth contract, and session attributes. Know the difference between a role (logical policy container) and a user-role ACL (the actual permit/deny list).
Policy structure
Policies can be stateful firewall policies at the gateway (session-aware, application-aware with deep packet inspection) or stateless ACLs at the switch. Understand that role assignment happens after authentication, and that unauthenticated users can receive a "guest" or "logon" role. Captive portal flows assign a pre-auth role, then a post-auth role. Know that role changes can be triggered by CoA (Change of Authorization) from ClearPass without reconnecting.
Traps to watch
Questions confuse role with VLAN - a role may assign a VLAN, but they are not the same object. Another trap: assuming ACLs are bidirectional; many are directional and must be written both ways. Do not assume a denied role means no connectivity - a default or pre-auth role may still apply. CoA is a RADIUS feature, not a supplicant feature.
Rule of thumb
For policy questions, answer in order: Who is the user? What role results? What does that role permit? Where is it enforced? Each step narrows the correct option.