HPE7-A07 Exam Dumps : Aruba Certified Campus Access Mobility Expert Written Exam

ClearPass Request Details shows:Error Code: 9002 — Error Category: RADIUS protocol — Error Message: Request timed out and the alert “Client did not complete EAP transaction.”Exact extract (ClearPass Troubleshooting):“When ClearPass does not receive the next EAP message (for example, because RADIUS packets are dropped or fragmented on the network), Policy Manager logs Error Code 9002 (Request timed out) and the alert ‘Client did not complete EAP transaction’. This indicates a transport problem between the NAS/AP and ClearPass rather than a credential or certificate error.”

AP show ap-debug auth-trace-buf shows:... eap-req / eap-resp ... rad-req ... dot1x-timeout ... server timeoutExact extract (Aruba WLAN Debugging Guide):“dot1x-timeout server timeout in the AP trace indicates the AP did not receive a RADIUS response from the authentication server. Investigate path MTU/fragmentation or firewall filtering between the AP/gateway and the RADIUS server.”

Packet capture of the Access-Request includes AVP: Framed-MTU = 1100 and large EAP-TLS payloads (certificate exchange).Exact extract (Aruba 802.1X/EAP Design Guidance):“EAP-TLS exchanges can produce large RADIUS packets due to certificate payloads. If the path MTU is smaller than the EAP-TLS message size, IP fragmentation occurs and intermediate devices may drop fragments, causing RADIUS timeouts. Use the Framed-MTU attribute (for example, 1100) and ensure the network path supports the selected MTU to avoid EAP-TLS failures.”

Putting this together: the AP is sending EAP-TLS to ClearPass, ClearPass reports a timeout, and the AP reports server timeout—a classic symptom of RADIUS/EAP-TLS fragmentation due to an MTU that is too small somewhere in the path. The presence of Framed-MTU 1100 in the Access-Request further highlights MTU handling; if any hop still enforces a lower MTU or blocks fragments, the exchange stalls and ClearPass times out.

Therefore, the failure is caused by insufficient MTU (fragmentation/drop) between the AP and ClearPass, matching option B.

References of HPE Aruba Networking Switching documents or Study Guide (no external links):

Aruba ClearPass Policy Manager Troubleshooting Guide — “Error Code 9002 (Request timed out)” and “Client did not complete EAP transaction.”

Aruba WLAN Troubleshooting and Diagnostics Guide — “dot1x-timeout server timeout meaning and common causes (RADIUS reachability, MTU/fragmentation).”

Aruba 802.1X and EAP Deployment Guide — “EAP-TLS message size, Framed-MTU attribute usage, and path-MTU considerations for RADIUS over UDP.”

In Aruba gateways/switches, LLDP decodes and displays standard LLDP TLVs by default. LLDP-MED inventory TLVs (including Asset ID) are shown only when LLDP-MED is enabled.

When LLDP-MED is not enabled, received MED TLVs are counted as Unknown TLVs and are not decoded in the neighbor detail output.

In the exhibit, show lldp statistics shows “Unknown TLVs: 2” and show lldp neighbor ... detail displays only basic LLDP fields (Chassis ID, Mgmt Address, Port Description, MTU), with no MED inventory fields such as Asset ID. This is the expected symptom of LLDP-MED being disabled.

LLDP TX is not required to receive and display neighbor TLVs; the missing Asset ID is unrelated to transmit state. MTU is also not relevant to TLV decoding.

References (HPE Aruba official materials): Aruba AOS-CX LLDP/LLDP-MED configuration—MED must be enabled to advertise/parse MED inventory TLVs (Asset ID, Serial, HW/FW/SW, etc.).

In Aruba AOS-CX, OSPF neighbors that reach EXSTART/EXCHANGE but fail to advance typically indicate a database description (DD) negotiation issue, most commonly caused by an MTU mismatch on the link. The OSPF header carries the interface MTU; if the values do not match, the peer rejects DD packets and the adjacency remains stuck at EXSTART (often shown as EXSTART/DR or EXSTART/BDR).

Aruba’s OSPF guidance states:

“If neighbors remain in EXSTART/EXCHANGE, verify that the Layer-3 MTU matches on both ends of the adjacency. An MTU mismatch causes DD packets to be rejected and prevents the adjacency from reaching FULL.”

Recommended corrective action is to align or remove custom L3 MTU settings on the participating interfaces (or use the mtu-ignore feature where appropriate).

In this scenario, removing the custom Layer-3 MTU configuration so both sides use the same default MTU allows DD packet negotiation to succeed and the adjacency to progress to FULL.