HPE6-A47 Exam Dumps : Designing Aruba Solutions

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

whether the MC needs to support advanced 8.x features. This is because the Aruba 7000 Series MCs are based on the older hardware platform and can only run up to ArubaOS 6.5.x, while the Aruba 7200 Series MCs are based on the newer hardware platform and can run ArubaOS 8.x and above. ArubaOS 8.x introduces many advanced features, such as clustering, MultiZone, AirMatch, and dynamic segmentation, that are not supported by the Aruba 7000 Series MCs. Therefore, if the architect needs to design a solution that leverages these features, the Aruba 7200 Series MCs are the better choice.

Option A is incorrect because the number of wireless devices that the MC needs to support is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs.Both series can support a similar number of devices, depending on the model and license.

Option B is incorrect because whether the MC needs to terminate VPN tunnels is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can terminate VPN tunnels, such as IPSec, GRE, and RAP, depending on the model and license.

Option C is incorrect because the need to deploy controllers in a cluster is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can participate in a cluster, as long as they run the same ArubaOS version and have the same license.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 6: Wireless Network Design, where the MC selection and ArubaOS 8.x features are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Controller Data Sheet ArubaOS 8.7 User Guide

The customer wants to use certificates to authenticate user devices, which means that they need a strong and secure method of verifying the identity of the devices that connect to the employee WLAN. The best option for this is to use EAP-TLS instead of PEAP-MSCHAPv2. EAP-TLS stands for Extensible Authentication Protocol-Transport Layer Security, and it is a protocol that uses certificates on both the client and the server side to establish a mutual authentication and a secure channel for data exchange. EAP-TLS is considered the most secure EAP method, as it prevents common attacks such as dictionary attacks, man-in-the-middle attacks, and replay attacks.

The other options are not suitable for the customer requirements:

• Option B is incorrect because TKIP encryption is weaker than AES encryption. TKIP stands for Temporal Key Integrity Protocol, and it is an older encryption method that was designed to replace WEP, which had serious security flaws. However, TKIP also has some vulnerabilities, and it is not recommended for modern WLANs. AES stands for Advanced Encryption Standard, and it is a newer and stronger encryption method that provides better security and performance for WLANs.
• Option C is incorrect because WPA2-PSK is less secure than WPA2-Enterprise. WPA2-PSK stands for Wi-Fi Protected Access 2-Pre-Shared Key, and it is a security mode that uses a common passphrase or key to authenticate all devices that connect to the WLAN. However, this passphrase or key can be easily compromised or shared, and it does not provide individual authentication or encryption for each device. WPA2-Enterprise stands for Wi-Fi Protected Access 2-Enterprise, and it is a security mode that uses a RADIUS server to authenticate each device individually and dynamically generate encryption keys for each session. WPA2-Enterprise provides better security and scalability for WLANs.
• Option D is incorrect because TTLS does not use certificates to authenticate user devices. TTLS stands for Tunneled Transport Layer Security, and it is a protocol that uses certificates only on the server side to establish a secure tunnel for data exchange. The client side can use different methods to authenticate, such as passwords, tokens, or certificates. However, TTLS does not require certificates on the client side, and it is less secure than EAP-TLS.

References:

• ArubaOS 8.5 User Guide)
• ArubaOS 8.5 Security Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))