I85PREP
⌘ K
Aruba Associate study materials
Aruba Associate study resources

Aruba Associate: Network Security and Guest Access

Aruba Associate · Work through your exam, one topic at a time.

All guide sections

Network Security and Guest Access

Network Security and Guest Access tests whether you can choose the right authentication and encryption for a WLAN and then enforce the right access after login. Expect questions on WPA2/WPA3, 802.1X, roles, captive portal, and guest self-registration.

Encryption and authentication

  • Open networks provide no encryption. WEP is obsolete and should not be deployed.
  • WPA2-Personal uses a pre-shared key (PSK); every user shares the same secret, so it does not identify individual users.
  • WPA2-Enterprise uses 802.1X with a RADIUS server (for example, ClearPass) and supports per-user credentials and certificates.
  • WPA3-Personal replaces PSK with SAE, which resists offline dictionary attacks. WPA3-Enterprise offers stronger cryptography in its 192-bit mode. OWE provides encryption on open networks without credentials.
  • Protected Management Frames (PMF) protects management frames; WPA3 requires PMF, and WPA2 can use it optionally.

Role-based access

  • Aruba uses user roles to apply firewall policies. A role can be derived from the AAA profile, from server attributes, or from role-mapping rules.
  • The initial role often allows DHCP, DNS, and the captive portal, but not general Internet access. After authentication, the client is reclassified into a post-authentication role.
  • Roles are enforced by the controller or gateway; a VLAN assignment alone does not provide a security policy.

Guest access

  • ClearPass Guest and Aruba Central guest services support self-registration, sponsor approval, account expiry, and MAC caching.
  • A captive portal design needs a walled garden: pre-authentication access to DNS, DHCP, the portal, and any identity provider endpoints.
  • MAC caching lets a returning guest device skip re-registration for a configured period, but it is not the same as 802.1X.

Worked example

A guest SSID uses an external captive portal on ClearPass. The pre-auth role permits DHCP, DNS, and HTTPS to the ClearPass portal; everything else is denied. The guest registers, ClearPass returns an Aruba-User-Role attribute, and the controller places the client in the guest role, which permits Internet access. The reasoning is that the portal must be reachable before authentication, and the post-auth role must be explicitly mapped; otherwise the client authenticates but still has no access.

Traps that cost marks

  • Thinking PSK provides per-user accountability.
  • Forgetting the walled garden and breaking the portal.
  • Confusing a role with a VLAN.
  • Assuming WPA3 transition mode is as strong as WPA3-only.
  • Leaving the implicit deny or default role too permissive.