HPE6-A47 Exam Dumps : Designing Aruba Solutions

whether the MC needs to support advanced 8.x features. This is because the Aruba 7000 Series MCs are based on the older hardware platform and can only run up to ArubaOS 6.5.x, while the Aruba 7200 Series MCs are based on the newer hardware platform and can run ArubaOS 8.x and above. ArubaOS 8.x introduces many advanced features, such as clustering, MultiZone, AirMatch, and dynamic segmentation, that are not supported by the Aruba 7000 Series MCs. Therefore, if the architect needs to design a solution that leverages these features, the Aruba 7200 Series MCs are the better choice.

Option A is incorrect because the number of wireless devices that the MC needs to support is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs.Both series can support a similar number of devices, depending on the model and license.

Option B is incorrect because whether the MC needs to terminate VPN tunnels is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can terminate VPN tunnels, such as IPSec, GRE, and RAP, depending on the model and license.

Option C is incorrect because the need to deploy controllers in a cluster is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can participate in a cluster, as long as they run the same ArubaOS version and have the same license.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 6: Wireless Network Design, where the MC selection and ArubaOS 8.x features are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Controller Data Sheet ArubaOS 8.7 User Guide

The customer needs a solution that can terminate VPN tunnels for Aruba RAPs, which are remote access points that connect to the corporate network over the Internet. The customer has only one public IP address, which means that they need to use NAT to forward the IPsec traffic to the device that will terminate the VPN tunnel. The customer also wants N+1 redundancy, which means that they need at least two devices that can act as backup for each other in case of failure.

The solution that meets the customer requirements is to use two Aruba MCs on the same subnet that use VRRP without clustering. VRRP stands for Virtual Router Redundancy Protocol, and it is a protocol that allows multiple devices to share a virtual IP address and act as a single gateway for the network. This way, the customer can use the virtual IP address as the public IP address for the NAT, and the IPsec traffic will be forwarded to the device that is the VRRP master. If the master device fails, the backup device will take over the role of the master and continue to terminate the VPN tunnels. This provides N+1 redundancy for the customer.

The other options are not suitable for the customer requirements:

• Option B is not suitable because a Layer 3 cluster requires two public IP addresses, one for each MC. The customer only has one public IP address, so they cannot use this option.
• Option C is not suitable because VRRP does not work across different subnets. The customer needs to have the MCs on the same subnet to use VRRP.
• Option D is not suitable because a Layer 2 cluster does not support NAT. The customer needs to use NAT to forward the IPsec traffic to the MCs.

References:

• Aruba Remote Access Point (RAP) Networks Validated Reference Design)
• Aruba Mobility Controller Virtual IP Configuration Guide)
• ArubaOS 8.5 User Guide)

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf