HPE6-A47 Designing Aruba Solutions Questions and Answers

The Aruba 2930F Switch Series is a stackable Layer 3 switch series that provides performance and ease of use for enterprises, small and medium-sized businesses, and branch office networks1. It comes with an enterprise-grade feature set that includes static and RIP routing, IPv6, ACLs, robust security, and QoS1. The 2930F Series supports more options for class-based Quality of Service (QoS) policies than the 2540 Series2. This feature is crucial for a customer who needs a wired network solution that can recognize and prioritize a wide array of different types of traffic, including casual Web browsing, voice, video, SAP Online, and file sharing.

References:

• HPE Aruba Networking 2930F Switch Series
• Why would the architect choose the 2930F rather than the 2540 Switch Series for this customer?

According to the Aruba Validated Design: Campus Wireless LAN1, MCs that are in different subnets cannot form a cluster, which is a logical group of MCs that share the same configuration and provide redundancy and load balancing for each other. However, MCs that are in different subnets can still provide backup LMS (local mobility switch) functionality for each other’s APs. This means that if the primary MC that controls an AP fails, the AP can fail over to the backup MC that is in a different subnet. However, this failover is not stateful, meaning that the user sessions and firewall states are not preserved. Therefore, option D is the correct answer.

Option A is incorrect because the MCs can provide some level of redundancy for each other without being in the same subnet, as explained above. Option B is incorrect because VRRP is not required to provide redundancy for MCs that are in different subnets. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, MCs do not act as routers, and they do not need a shared IP address to provide backup LMS functionality. Option C is incorrect because the MCs cannot be in a cluster if they are in different subnets, as explained above. Therefore, the cluster will not support any features, such as stateful failover, load balancing, or centralized configuration. References: Aruba Validated Design: Campus Wireless LAN)

The transceivers that the architect should recommend for each pair of switches are two QSPF+ MPO. This option would provide 40 Gbps bandwidth per link, which is enough to meet the customer requirement of 80 Gbps for the link aggregation. The QSPF+ MPO transceivers use a single multi-fiber connector that can support up to 12 fibers, which is compatible with the customer’s existing OM4 multi-mode fiber infrastructure. The QSPF+ MPO transceivers also support distances up to 100 meters, which is sufficient for the customer’s inter-building connections.

The other options are not optimal for the customer requirement because they either provide insufficient bandwidth or require additional fiber strands. Two QSPF+ BiDi transceivers would provide only 20 Gbps bandwidth per link, which is half of the customer requirement. Eight SFP+ LR or SR transceivers would provide 80 Gbps bandwidth per link, which is more than the customer requirement, but they would also require eight fiber strands per link, which is more than the customer’s available fiber infrastructure. References:

• Aruba Transceiver and Cable Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

802.1X authentication without tunnelled node is a form of port-based network access control that uses the Extensible Authentication Protocol (EAP) to authenticate users and devices on a wired network. This form of authentication provides several benefits, such as:

• It enables user access control and ensures only authorized users connect. This prevents unauthorized access to the network and its resources, and enhances security and compliance.
• It allows dynamic assignment of VLANs and roles based on user identity and device type. This simplifies network management and improves user experience.
• It supports multiple authentication methods, such as certificates, passwords, tokens, or biometrics. This provides flexibility and choice for users and administrators.
• It integrates with Aruba ClearPass Policy Manager (CPPM) for centralized policy enforcement and visibility. This enables granular control and monitoring of wired user traffic and devices. References:
• Aruba 2930M Switch Series - Data sheet)
• Aruba ClearPass Policy Manager - Data sheet)
• ArubaOS-Switch Wired Access with ClearPass - Configuration guide)

In the event of an MM outage, MCs continue to use their existing licenses for 30 days, and the network remains up. However, you cannot change the configuration items in the controller network. In addition, the MM manages many of the higher level functions that can cause issues in the network if the MM fails. Aruba recommends a backup MM for these situations. From an economic point of view, a backup MM for a VMM is free. If a customer has a hardware MM, the customer must purchase a backup hardware MM.

https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/vrrp/conf-stby-mm-l3red.htm

The architect should propose one LIC-MM-VA-500 license package for the customer. This license package allows the customer to deploy up to two VMMs and manage up to 500 MCs and 10,000 APs. The customer does not need any additional licenses for the MCs or the APs, as they are included in the LIC-MM-VA-500 package. The other options are either insufficient or excessive for the customer’s needs.

• Option A is insufficient because six LIC-MM-VA-50 licenses only allow the customer to manage up to 300 MCs and 6,000 APs. The customer needs to manage 300 APs and six MCs, so this option does not meet the requirement.
• Option B is excessive because one LIC-MC-VA-250 and one LIC-MC-VA-50 licenses allow the customer to deploy up to 300 MCs and 6,000 APs, which is more than what the customer needs. Moreover, one LIC-MM-VA-500 license allows the customer to deploy up to two VMMs and manage up to 500 MCs and 10,000 APs, which is also more than what the customer needs. Therefore, this option is wasteful and unnecessary.
• Option D is also excessive because one LIC-MC-VA-250 and one LIC-MC-VA-50 licenses allow the customer to deploy up to 300 MCs and 6,000 APs, which is more than whatthe customer needs. Additionally, six LIC-MM-VA-500 licenses allow the customer to deploy up to 12 VMMs and manage up to 3,000 MCs and 60,000 APs, which is way more than what the customer needs. Therefore, this option is also wasteful and unnecessary.

References:

• ArubaOS 8.5 Licensing Guide)
• Aruba Mobility Master Data Sheet)
• Aruba 7000 Series Mobility Controllers Data Sheet)

A customer who has an Instant AP deployment and needs to provide client-to-site VPN access for remote users would benefit from adding a controller to the deployment. A controller can act as a VPN concentrator that terminates the VPN tunnels from the remote clients and provides secure access to the corporate network. The controller can also apply firewall policies and role-based access control to the VPN traffic. An Instant AP deployment alone cannot provide this functionality, as it only supports site-to-site VPN between Instant AP clusters12. The other options do not require a controller, as they can be achieved with an Instant AP deployment. An Instant AP deployment can apply role-based firewall policies using the built-in stateful firewall on each Instant AP3. An Instant AP deployment can also provide a captive portal for guests using the internal orexternal web server options4. An Instant AP deployment can be managed by a cloud-based solution such as Aruba Central, which does not require a controller5. References:

• 1: Understanding IAP-VPN Architecture - Aruba
• 2: Configuring IAP-VPN - Aruba
• 3: Firewall Roles and Policies - Aruba
• 4: Configuring Captive Portal - Aruba
• 5: Managing Instant AP from Aruba Central - Aruba

The Virtual Switching Framework (VSF) is a technology that allows two or more Aruba switches to operate as a single logical device, providing high availability, simplified management, and increased performance. VSF is supported on Aruba 5400R zl2 switches, which are modular switches that can accommodate different types of line cards and power supplies1.

The VSF fabric requires two types of connections between the member switches: VSF links and VSF ports. VSF links are the physical connections that carry the VSF control and data traffic, while VSF ports are the logical interfaces that bundle the VSF links into a single logical link. VSF links can be either 10 GbE or 40 GbE, and VSF ports can be either 10 GbE or 40 GbE1.

To create a VSF fabric with two 5406R zl2 switches, the architect needs to ensure that the switches have the compatible modules, transceivers, and cables for the VSF links and ports. According to the ArubaOS-Switch Management and Configuration Guide1, the following requirements apply for the VSF fabric:

• The switches must have the same chassis model, the same number and type of modules, and the same firmware version.
• The switches must have at least one v3 module in slot A or B. The v3 modules are the ones with the letter “M” in the part number, such as J9990A, J9991A, and J9992A. The v2 modules are the ones with the letter “A” in the part number, such as J9534A, J9535A, and J9536A.
• The switches must have the same type of transceivers and cables for the VSF links. The supported transceivers are the Aruba 10G SFP+ LC SR, the Aruba 10G SFP+ LC LR, the Aruba 40G QSFP+ LC SR4, and the Aruba 40G QSFP+ MPO SR4. The supported cables are the Aruba 10G SFP+ to SFP+ 1m DAC Cable, the Aruba 10G SFP+ to SFP+ 3m DAC Cable, the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable, and the Aruba 40G QSFP+ to QSFP+ 3m DAC Cable.

Based on the exhibit, the architect has planned to use the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable (JH234A) for the VSF links, which is a supported option. However, the architect has also selected the Aruba 24p 10GBASE-T v2 zl Module (J9536A) and the Aruba 20p 10GbE SFP+ v2 zl Module (J9535A) for the switches, which are not compatible with the VSF fabric. The architect should change these v2 modules to v3 modules, such as the Aruba 24p 10GBASE-T v3 zl2 Module (J9996A) and the Aruba 20p 10GbE SFP+ v3 zl2 Module (J9990A), to meet the VSF requirements.

The other options are not issues with the plan. Adding two QSPF+ MP0 SR4 transceivers (A) is not necessary, as the DAC cable already provides the 40 GbE connection for the VSF links. Adding stacking modules and cables © is not required, as the VSF fabric does not use the traditional stacking technology. Changing the power supply type (D) is not relevant, as the VSF fabric does not impose any restrictions on the power supply type.

References: 1: ArubaOS-Switch Management and Configuration Guide - Aruba, Chapter 12: Virtual Switching Framework, pages 219-227.

it meets the customer’s requirements for wired network upgrade. By combining the switches in each Building 2 closet as a Virtual Switching Framework (VSF) fabric, the architect can reduce the number of logical devices within the network, simplifying management and reducing complexity, aligning with the goal of flattening architecture. Establishing two 10 GbE connections to the core per fabric ensures redundancy and resilience, maintaining connectivity even if one link fails, without necessitating additional cabling. This also provides sufficient bandwidth and scalability for the network traffic.

The other options are incorrect because:

• A. Using two additional 2930F switches to act as an aggregation layer for Building 2 adds another layer of devices and complexity to the network, contradicting the goal of flattening architecture. It also requires additional cabling and ports to connect the switches to the core and the access layer.
• B. Connecting each Building 2 switch directly to the core on a single fiber strand through the use of SFP±SR transceivers does not provide redundancy and resilience, as one link failure would disconnect the switch from the core. It also limits the bandwidth and scalability of the network, as each switch would have only one 10 GbE connection to the core.
• D. Extending additional fiber between the buildings so that each Building 2 switch can have a direct 10 GbE connection to the core requires recabling, which the customer wants to avoid. It also increases the cost and complexity of the network, as more fiber strands and ports would be needed.

References:

• Aruba 2930M Switch Series - Data sheet)
• Aruba Validated Reference Design: Campus Wired LAN - Chapter 3)
• ArubaOS-Switch Virtual Switching Framework - Configuration guide)

This answer is correct because it matches the scenario for which the Aruba backplane stacking technology is designed. Aruba backplane stacking technology allows up to 10 switches to be interconnected using high-speed backplane cables, creating a single logical device with a single IP address and configuration. This simplifies the management and operation of the network, as well as the redundancy design, as the stack can operate in ring or chain topology and provide fast failover in case of link or switch failure. This technology is suitable for customers who need to deploy a pair of aggregation switches in the same closet, as it reduces the number of devices and links to manage, and provides high availability and scalability for the network.

The other options are incorrect because:

• B. The customer needs to simplify the deployment of core switches which are located in different closets for redundancy purposes. This scenario is not suitable for Aruba backplane stacking technology, as it requires the switches to be physically close to each other and connected with backplane cables. A better option for this scenario would be to use Aruba Virtual Switching Framework (VSF) technology, which allows up to twoswitches to be interconnected using standard Ethernet links, creating a virtual switch that can span across different closets or racks.
• C. The customer needs to expand the network and make it possible for the current core switches to support more MAC forwarding and ARP entries. This scenario is not suitable for Aruba backplane stacking technology, as it does not increase the MAC or ARP table size of the switches. The MAC and ARP table size is determined by the hardware specifications of each switch model, and stacking them together does not change that. A better option for this scenario would be to upgrade the core switches to a higher-end model that supports more MAC and ARP entries, or to segment the network into smaller subnets to reduce the MAC and ARP traffic.
• D. The customer needs to deploy a switch at a branch office and have the switch automatically discover and join the network stack at the main office. This scenario is not suitable for Aruba backplane stacking technology, as it requires the switches to be on the same LAN and connected with backplane cables. A better option for this scenario would be to use Aruba Central, which is a cloud-based management platform that allows remote provisioning and monitoring of Aruba switches and other devices. Aruba Central can automatically discover and join the switch to the network, and apply the configuration and policies from the main office.

References:

• Aruba 2930M Switch Series - Data sheet)
• ArubaOS-Switch Virtual Switching Framework - Configuration guide)
• Aruba Central - Data sheet)

The customer needs to upgrade their wireless network, which has a single large building with four floors. The customer requires 30 APs on each floor, totaling 120 APs for the whole building. The customer also wants to use a MM-based architecture, and deployone Aruba 7030 MC on each floor, with the MCs combined in a cluster for seamless client failover and roaming. However, the proposed solution does not meet the customer’s requirements, because the Aruba 7030 MC does not support enough APs for the customer’s needs. Each Aruba 7030 MC can only support up to 64 APs, which means that deploying one on each floor would not be enough to support all the required APs. The architect should explain this limitation to the customer, and suggest a different solution that can support more APs, such as using a higher-capacity MC model, or deploying more MCs per floor.

References:

• Aruba 7000 Series Mobility Controllers Data Sheet)
• ArubaOS 8.5 User Guide)
• Aruba Certified Design Professional Official Certification Study Guide (HPE6-A47))

The solution that the architect should recommend on the 2930M switches to authenticate and control wired employee devices is 802.1X on edge ports and no tunneled node. This solution would provide strong authentication and authorization for the wired devices using certificates, which can be issued and managed by ClearPass. The 802.1X protocol would allow the switches to communicate with ClearPass and enforce user roles and policies based on the device identity and context. The no tunneled node option would allow the wired traffic to be forwarded locally on the access layer switches, as the customer prefers, without tunneling it to the MCs. This option would also reduce the bandwidth consumption and latency on the network core.

The other solutions are not optimal for the customer requirements because they either provide weak authentication or require tunneling the wired traffic to the MCs. MAC-Authon edge ports and no tunneled node would provide weak authentication based on the MAC address of the device, which can be easily spoofed or bypassed. MAC-Auth on edge ports and per-user tunneled node would also provide weak authentication and require tunneling the wired traffic to the MCs, which the customer does not want. 802.1X on edge ports and per-user tunneled node would provide strong authentication but also require tunneling the wired traffic to the MCs, which the customer does not want. References:

• Aruba 2930M Switch Series Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

whether the MC needs to support advanced 8.x features. This is because the Aruba 7000 Series MCs are based on the older hardware platform and can only run up to ArubaOS 6.5.x, while the Aruba 7200 Series MCs are based on the newer hardware platform and can run ArubaOS 8.x and above. ArubaOS 8.x introduces many advanced features, such as clustering, MultiZone, AirMatch, and dynamic segmentation, that are not supported by the Aruba 7000 Series MCs. Therefore, if the architect needs to design a solution that leverages these features, the Aruba 7200 Series MCs are the better choice.

Option A is incorrect because the number of wireless devices that the MC needs to support is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs.Both series can support a similar number of devices, depending on the model and license.

Option B is incorrect because whether the MC needs to terminate VPN tunnels is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can terminate VPN tunnels, such as IPSec, GRE, and RAP, depending on the model and license.

Option C is incorrect because the need to deploy controllers in a cluster is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can participate in a cluster, as long as they run the same ArubaOS version and have the same license.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 6: Wireless Network Design, where the MC selection and ArubaOS 8.x features are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Controller Data Sheet ArubaOS 8.7 User Guide

 This answer is correct because it meets the customer’s requirements for wired authentication and traffic forwarding. By assigning wired users to different VLANs from wireless users, the architect can ensure that the wired traffic is not tunneled to the MCs, but forwarded locally on the access layer switches. This reduces the load on the MCs and the network bandwidth. By using port or role assignments on the access layer switches, the architect can also implement 802.1X authentication without tunnelled node, which enables user access control and dynamic VLAN assignment based on user identity and device type. By extending the VLANs to the core, the architect can ensure that the wired users can reach the data center and other network resources through the Layer 3 switch connected to the firewall. References:

• Aruba 2930M Switch Series - Data sheet)
• Aruba ClearPass Policy Manager - Data sheet)
• ArubaOS-Switch Wired Access with ClearPass - Configuration guide)

The specifications for the AP models are in the format of Tx:Rx:SU-MIMO:MU-MIMO:MU-MIMO clients, where Tx is the number of transmit antennas, Rx is the number of receive antennas, SU-MIMO is the number of spatial streams supported in single-user MIMO mode, MU-MIMO is the number of spatial streams supported in multi-user MIMO mode, and MU-MIMO clients is the number of MU-MIMO clients that can be served simultaneously.

The customer requirements are:

• Support for MU-MIMO: This means the AP must have a MU-MIMO value greater than 1, as MU-MIMO is a technique that allows multiple spatial streams to be transmitted to different clients at the same time.
• Support for up to four spatial streams, both when MU-MIMO is used and when it is not used: This means the AP must have a SU-MIMO value and a MU-MIMO value of 4, as spatial streams are independent data streams that can be transmitted or received by an antenna.
• Support for transmissions to up to three MU-MIMO clients at the same time: This means the AP must have a MU-MIMO clients value of 3, as this indicates the maximum number of clients that can receive MU-MIMO transmissions from the AP at the same time.

Based on these criteria, only the AP 335 meets the customer requirements, as it has a specification of 4x4:4:4:4:3, which means it has 4 transmit and receive antennas, 4 spatial streams in both SU-MIMO and MU-MIMO modes, and can serve 3 MU-MIMO clients simultaneously. The AP 325 does not meet the customer requirements, as it has a specification of 4x4:4:4:3:3, which means it has only 3 spatial streams in MU-MIMO mode, and can only serve 2 MU-MIMO clients simultaneously.

References:

• Aruba AP-335 Wireless Access Point | Aruba
• Aruba AP-325 Wireless Access Point | Aruba
• Multi-User MIMO in WiFi 6 - Arista Networks

Aruba Central Managed Portal (MSP) is a cloud-based network management platform that enables service providers to centrally manage and monitor multiple tenant accounts from a single interface1. MSP mode is a multi-tenant operational mode that Aruba Central accounts can be converted into, provided these accounts have subscribed to the Aruba Central app2. MSP mode allows service providers to provision and manage tenant accounts, assign devices to tenant accounts, manage subscription keys and perform other functions such as configuring network profiles and viewing alerts3. MSP mode is suitable for the scenario where a service provider needs to manage multiple customer networks, as it simplifies tenant network operations using capabilities such as zero-touch setup, historical data reporting, PCI compliance monitoring, and troubleshooting2. References:

• 1: MSP Overview - Aruba
• 2: MSP Architecture - Aruba
• 3: Managed Service Portal - Aruba