HP HPE6-A47 Exam With Confidence Using Practice Dumps

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

The specifications for the AP models are in the format of Tx:Rx:SU-MIMO:MU-MIMO:MU-MIMO clients, where Tx is the number of transmit antennas, Rx is the number of receive antennas, SU-MIMO is the number of spatial streams supported in single-user MIMO mode, MU-MIMO is the number of spatial streams supported in multi-user MIMO mode, and MU-MIMO clients is the number of MU-MIMO clients that can be served simultaneously.

The customer requirements are:

• Support for MU-MIMO: This means the AP must have a MU-MIMO value greater than 1, as MU-MIMO is a technique that allows multiple spatial streams to be transmitted to different clients at the same time.
• Support for up to four spatial streams, both when MU-MIMO is used and when it is not used: This means the AP must have a SU-MIMO value and a MU-MIMO value of 4, as spatial streams are independent data streams that can be transmitted or received by an antenna.
• Support for transmissions to up to three MU-MIMO clients at the same time: This means the AP must have a MU-MIMO clients value of 3, as this indicates the maximum number of clients that can receive MU-MIMO transmissions from the AP at the same time.

Based on these criteria, only the AP 335 meets the customer requirements, as it has a specification of 4x4:4:4:4:3, which means it has 4 transmit and receive antennas, 4 spatial streams in both SU-MIMO and MU-MIMO modes, and can serve 3 MU-MIMO clients simultaneously. The AP 325 does not meet the customer requirements, as it has a specification of 4x4:4:4:3:3, which means it has only 3 spatial streams in MU-MIMO mode, and can only serve 2 MU-MIMO clients simultaneously.

References:

• Aruba AP-335 Wireless Access Point | Aruba
• Aruba AP-325 Wireless Access Point | Aruba
• Multi-User MIMO in WiFi 6 - Arista Networks

The customer needs a solution that can terminate VPN tunnels for Aruba RAPs, which are remote access points that connect to the corporate network over the Internet. The customer has only one public IP address, which means that they need to use NAT to forward the IPsec traffic to the device that will terminate the VPN tunnel. The customer also wants N+1 redundancy, which means that they need at least two devices that can act as backup for each other in case of failure.

The solution that meets the customer requirements is to use two Aruba MCs on the same subnet that use VRRP without clustering. VRRP stands for Virtual Router Redundancy Protocol, and it is a protocol that allows multiple devices to share a virtual IP address and act as a single gateway for the network. This way, the customer can use the virtual IP address as the public IP address for the NAT, and the IPsec traffic will be forwarded to the device that is the VRRP master. If the master device fails, the backup device will take over the role of the master and continue to terminate the VPN tunnels. This provides N+1 redundancy for the customer.

The other options are not suitable for the customer requirements:

• Option B is not suitable because a Layer 3 cluster requires two public IP addresses, one for each MC. The customer only has one public IP address, so they cannot use this option.
• Option C is not suitable because VRRP does not work across different subnets. The customer needs to have the MCs on the same subnet to use VRRP.
• Option D is not suitable because a Layer 2 cluster does not support NAT. The customer needs to use NAT to forward the IPsec traffic to the MCs.

References:

• Aruba Remote Access Point (RAP) Networks Validated Reference Design)
• Aruba Mobility Controller Virtual IP Configuration Guide)
• ArubaOS 8.5 User Guide)