HPE7-A02 Exam Dumps : Aruba Certified Network Security Professional Exam

To prevent rogue OSPF routers in the network shown in the exhibit, the preferred configuration on Switch-2 is to configure OSPF authentication on Lag 1 in MD5 mode. This setup enhances security by ensuring that only routers with the correct MD5 authentication credentials can participate in the OSPF routing process. This method protects the OSPF sessions against unauthorized devices that might attempt to introduce rogue routing information into the network.

1.OSPF Authentication: Implementing MD5 authentication on Lag 1 ensures that OSPF updates are secured with a cryptographic hash. This prevents unauthorized OSPF routers from establishing peering sessions and injecting potentially malicious routing information.

2.Secure Communication: MD5 authentication provides a higher level of security compared to simple password authentication, as it uses a more robust hashing algorithm.

3.Applicability: Lag 1 is the primary link between Switch-1 and Switch-2, and securing this link helps protect the integrity of the OSPF routing domain.

Policy Analysis:

Rule Evaluation Order: Rules are applied in sequential order until a match is found.

Key Points:

DHCP traffic (UDP 67) is permitted.

DNS traffic (UDP 53) is permitted.

Traffic to 10.5.5.0/24 is explicitly denied.

HTTP traffic (TCP 80) is allowed only to 10.5.0.0/16.

HTTPS traffic (TCP 443) is allowed only to 10.5.0.0/16.

All other traffic to 10.5.0.0/16 is denied.

Any other traffic not matching the above rules is permitted.

Scenario Analysis:

The client IP 10.2.2.2 does not fall within the 10.5.0.0/16 subnet.

Rule 3 denies traffic to 10.5.5.5, regardless of the source IP.

Option A: Correct. HTTPS traffic to 10.5.5.5 is explicitly denied by Rule 3.

Option B: Incorrect. Traffic to 203.0.113.12 is permitted due to the final "permit any" rule.

Option C: Incorrect. The client (10.2.2.2) does not belong to the subnet 10.5.0.0/16, so traffic to 10.5.3.3 is not permitted by Rule 5.

Option D: Incorrect. HTTP traffic to 198.51.100.12 is allowed by the last "permit any" rule.

User-Based Tunneling (UBT) with VRRP:

UBT allows traffic from authenticated users to be tunneled to an HPE Aruba Networking gateway.

In the case of VRRP, where two gateways are configured for redundancy, the AOS-CX switch will always send the traffic to the primary gateway defined in the UBT zone configuration.

The VRRP state (master/backup) does not impact the UBT decision; the UBT primary configuration takes precedence.

Option Analysis:

Option A: Incorrect. UBT does not strictly follow the VRRP master; it adheres to the UBT primary gateway configuration.

Option B: Correct. The switch tunnels all traffic to the primary gateway configured in the UBT zone.

Option C: Incorrect. UBT does not load-share traffic between gateways.

Option D: Incorrect. UBT uses the primary gateway configured in the UBT zone, not dynamically determined active devices.