HPE6-A47 Designing Aruba Solutions Questions and Answers

A customer who has an Instant AP deployment and needs to provide client-to-site VPN access for remote users would benefit from adding a controller to the deployment. A controller can act as a VPN concentrator that terminates the VPN tunnels from the remote clients and provides secure access to the corporate network. The controller can also apply firewall policies and role-based access control to the VPN traffic. An Instant AP deployment alone cannot provide this functionality, as it only supports site-to-site VPN between Instant AP clusters12. The other options do not require a controller, as they can be achieved with an Instant AP deployment. An Instant AP deployment can apply role-based firewall policies using the built-in stateful firewall on each Instant AP3. An Instant AP deployment can also provide a captive portal for guests using the internal orexternal web server options4. An Instant AP deployment can be managed by a cloud-based solution such as Aruba Central, which does not require a controller5. References:

• 1: Understanding IAP-VPN Architecture - Aruba
• 2: Configuring IAP-VPN - Aruba
• 3: Firewall Roles and Policies - Aruba
• 4: Configuring Captive Portal - Aruba
• 5: Managing Instant AP from Aruba Central - Aruba

The IRIS BOM is missing stacking modules and cables for the Aruba 2930M switches. The customer wants to flatten the architecture and avoid recabling, but also maintain connectivity to the core if one link fails. To achieve this, the architect proposed to combine the switches in each Building 2 closet as a VSF fabric and establish two 10 GbE connections to the core per fabric. However, to create a VSF fabric, the switches need to have stacking modules and cables to interconnect them. The IRIS BOM does not include these items, which are required for the VSF configuration. The part numbers for the stacking modules and cables are JL325A and J9735A, respectively.

The other options are not missing from the IRIS BOM because they are either not required or already included. Stacking licenses are not required for the Aruba 2930M switches, as they support VSF natively. 10 GbE direct attach cables are already included in the IRIS BOM as part number J9283D. An uplink module for one of the switches is not required, as the customer already has enough fiber strands to connect each switch to the core. References:

• Aruba 2930M Switch Series Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

 In local mode, the IAP cluster at the branch office has a local subnet and the master IAP of the cluster acts as the DHCP server and gateway for clients. The local mode provides access to the corporate network using the inner IP of the IPsec tunnel. The local mode is recommended for this scenario because it allows the branch office to remain functional even if the link to the main office fails, as the clients can still obtain IP addresses and access local resources. The local mode also avoids the need for additional routing or switching configuration on the MC or the branch office network12. References:

• 1: Understanding IAP-VPN Architecture - Aruba
• 2: IAP-VPN Forwarding Modes - Aruba

The Aruba 2930F Switch Series is a stackable Layer 3 switch series that provides performance and ease of use for enterprises, small and medium-sized businesses, and branch office networks1. It comes with an enterprise-grade feature set that includes static and RIP routing, IPv6, ACLs, robust security, and QoS1. The 2930F Series supports more options for class-based Quality of Service (QoS) policies than the 2540 Series2. This feature is crucial for a customer who needs a wired network solution that can recognize and prioritize a wide array of different types of traffic, including casual Web browsing, voice, video, SAP Online, and file sharing.

References:

• HPE Aruba Networking 2930F Switch Series
• Why would the architect choose the 2930F rather than the 2540 Switch Series for this customer?

The Virtual Switching Framework (VSF) is a technology that allows two or more Aruba switches to operate as a single logical device, providing high availability, simplified management, and increased performance. VSF is supported on Aruba 5400R zl2 switches, which are modular switches that can accommodate different types of line cards and power supplies1.

The VSF fabric requires two types of connections between the member switches: VSF links and VSF ports. VSF links are the physical connections that carry the VSF control and data traffic, while VSF ports are the logical interfaces that bundle the VSF links into a single logical link. VSF links can be either 10 GbE or 40 GbE, and VSF ports can be either 10 GbE or 40 GbE1.

To create a VSF fabric with two 5406R zl2 switches, the architect needs to ensure that the switches have the compatible modules, transceivers, and cables for the VSF links and ports. According to the ArubaOS-Switch Management and Configuration Guide1, the following requirements apply for the VSF fabric:

• The switches must have the same chassis model, the same number and type of modules, and the same firmware version.
• The switches must have at least one v3 module in slot A or B. The v3 modules are the ones with the letter “M” in the part number, such as J9990A, J9991A, and J9992A. The v2 modules are the ones with the letter “A” in the part number, such as J9534A, J9535A, and J9536A.
• The switches must have the same type of transceivers and cables for the VSF links. The supported transceivers are the Aruba 10G SFP+ LC SR, the Aruba 10G SFP+ LC LR, the Aruba 40G QSFP+ LC SR4, and the Aruba 40G QSFP+ MPO SR4. The supported cables are the Aruba 10G SFP+ to SFP+ 1m DAC Cable, the Aruba 10G SFP+ to SFP+ 3m DAC Cable, the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable, and the Aruba 40G QSFP+ to QSFP+ 3m DAC Cable.

Based on the exhibit, the architect has planned to use the Aruba 40G QSFP+ to QSFP+ 1m DAC Cable (JH234A) for the VSF links, which is a supported option. However, the architect has also selected the Aruba 24p 10GBASE-T v2 zl Module (J9536A) and the Aruba 20p 10GbE SFP+ v2 zl Module (J9535A) for the switches, which are not compatible with the VSF fabric. The architect should change these v2 modules to v3 modules, such as the Aruba 24p 10GBASE-T v3 zl2 Module (J9996A) and the Aruba 20p 10GbE SFP+ v3 zl2 Module (J9990A), to meet the VSF requirements.

The other options are not issues with the plan. Adding two QSPF+ MP0 SR4 transceivers (A) is not necessary, as the DAC cable already provides the 40 GbE connection for the VSF links. Adding stacking modules and cables © is not required, as the VSF fabric does not use the traditional stacking technology. Changing the power supply type (D) is not relevant, as the VSF fabric does not impose any restrictions on the power supply type.

References: 1: ArubaOS-Switch Management and Configuration Guide - Aruba, Chapter 12: Virtual Switching Framework, pages 219-227.

 Aruba Instant APs are a simple, easy to deploy, and cost-effective solution for small office buildings that need wireless access. Aruba Instant APs can form a self-organizing and self-healing mesh network that supports basic rogue AP detection and provides a stateful firewall with role-based policies. Aruba Instant APs do not require a separate controller or license, and can be managed from the cloud or a mobile app. Aruba remote APs are designed for branch or home offices that need to connect to a central controller over a WAN link. Aruba campus APs and a Virtual Mobility Controller are suitable for larger or more complex deployments that need more scalability and flexibility. Aruba campus APs and an Aruba 7005 Mobility Controller are also more expensive and require additional hardware and licensing. References: Aruba Instant Access Points), Aruba Validated Design: Campus Wireless LAN)

whether the MC needs to support advanced 8.x features. This is because the Aruba 7000 Series MCs are based on the older hardware platform and can only run up to ArubaOS 6.5.x, while the Aruba 7200 Series MCs are based on the newer hardware platform and can run ArubaOS 8.x and above. ArubaOS 8.x introduces many advanced features, such as clustering, MultiZone, AirMatch, and dynamic segmentation, that are not supported by the Aruba 7000 Series MCs. Therefore, if the architect needs to design a solution that leverages these features, the Aruba 7200 Series MCs are the better choice.

Option A is incorrect because the number of wireless devices that the MC needs to support is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs.Both series can support a similar number of devices, depending on the model and license.

Option B is incorrect because whether the MC needs to terminate VPN tunnels is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can terminate VPN tunnels, such as IPSec, GRE, and RAP, depending on the model and license.

Option C is incorrect because the need to deploy controllers in a cluster is not a key criteria to choose between the Aruba 7000 Series or 7200 Series MCs. Both series can participate in a cluster, as long as they run the same ArubaOS version and have the same license.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 6: Wireless Network Design, where the MC selection and ArubaOS 8.x features are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Controller Data Sheet ArubaOS 8.7 User Guide

The correct answer is option C, 20-25. This is because a general rule of thumb for 802.11ac wireless deployment is to have one AP for every 200 square meters (approximately 2,000 square feet) of coverage area. This assumes a moderate user density and application demand. Therefore, for a coverage area of 4,645 square meters (approximately 50,000 square feet), the architect should have in mind about 23 APs (4,645 / 200 = 23.225). This number can be adjusted based on the actual site survey and VisualRF plan, but it serves as a good starting point. References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 4: Wireless LAN Design, where the AP count estimation and site survey methods are discussed. Designing Aruba Solutions Official Certification Study Guide Aruba Mobility Fundamentals Guide

 References:https://www.arubanetworks.com/assets/ds/DS_7200Series.pdf

• Aruba Mobility Controller Data Sheet (Aruba Networks)
• Designing Aruba Solutions Study Guide (HPE Press)

The traditional guideline limits a wired VLAN to a /24 subnet, which provides enough IP addresses for 253 endpoints. You might have suggested one of three approaches: one VLAN per floor, one VLAN per building, or one VLAN per campus. The one VLAN per floor approach is not recommended because it interferes with roaming and adds complexity. If you did take this approach, the /24 subnets are not large enough for the requirements on every floor. You would need to ask for /23 subnets. The one VLAN per building approach would work if you considered each building its own RF domain. It provides roaming within a building and, if you are using a single cluster at the data center, between buildings. Ifyou deployed two MCs or clusters, one at each building, though, GRE tunneling would be required to support roaming between buildings.

In the event of an MM outage, MCs continue to use their existing licenses for 30 days, and the network remains up. However, you cannot change the configuration items in the controller network. In addition, the MM manages many of the higher level functions that can cause issues in the network if the MM fails. Aruba recommends a backup MM for these situations. From an economic point of view, a backup MM for a VMM is free. If a customer has a hardware MM, the customer must purchase a backup hardware MM.

https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/vrrp/conf-stby-mm-l3red.htm

To route at the core and extend some of the same VLANs in different buildings, the architect should recommend creating a backplane stack at the aggregation layer and a VSF fabric at the core. A backplane stack is a logical switch that combines multiple physical switches into a single unit, using dedicated stacking cables or ports. A VSF fabric is a virtual switch that combines multiple physical switches into a single unit, using standard Ethernet links. Both technologies provide high availability, scalability, and simplified management for the network12.

By creating a backplane stack at the aggregation layer, the architect can reduce the number of routing interfaces and routing protocols needed at the core layer, as well as simplify the configuration and maintenance of the aggregation switches. By creating a VSF fabric at the core layer, the architect can enable Layer 2 connectivity across different buildings, as well as provide redundancy and load balancing for the core switches. The VSF fabric can use Multi-Chassis Link Aggregation (MC-LAG) to extend the same VLANs to different aggregation stacks, without creating loops or blocking ports3.

The other options are not suitable for the customer’s requirements. Implementing broadcast filtering on switch-to-switch links across all of the buildings would not enable Layer 2 connectivity across different buildings, as it would prevent the propagation of Layer 2 control traffic, such as Spanning Tree Protocol (STP) and VLAN Trunking Protocol (VTP). Combining all switches in the aggregation layer and core into a single backplane stack would not be feasible, as it would require compatible switches and sufficient stacking ports or cables, as well as create a single point of failure for the entire network. Using VRRP on the core and aggregation switches, with the aggregation switches acting as standby, would not eliminate the routing at the aggregation layer, as it would still require the aggregation switches to participate in the routing process and maintain routing tables.

References:

• ArubaOS-Switch Stacking Guide
• ArubaOS-Switch Virtual Switching Framework Configuration Guide
• Aruba Validated Reference Design: Campus Wired LAN

 To ensure that wireless voice traffic is properly prioritized for Microsoft Skype for Business, the architect should set up firewall policies and SDN to mark voice on the MCs or MM. Firewall policies are used to classify and prioritize traffic based on the application, user role, device type, and location. SDN is used to integrate with the Skype for Business SDN API, which provides real-time information about voice and video sessions, such as source and destination IP addresses, ports, codecs, and quality metrics. By using firewall policies and SDN, the MCs or MM can dynamically mark voice traffic with the appropriate DSCP values and queue them in the highest priority queue on the wireless and wired network12.

The other options are not sufficient or relevant for ensuring wireless voice traffic prioritization for Skype for Business. Broadcast suppression combined with AirGroup is used to reduce the network overhead and improve the user experience for wireless devices that use multicast or broadcast protocols, such as Apple Bonjour or Microsoft UPnP3. Airtime Fairness set to fair-access is used to balance the airtime usage among clients with different capabilities and data rates, such as 802.11ac and 802.11n4. Voice-aware Layer 3 roaming is used to enable seamless handoff of voice sessions across different subnets without dropping the call5. While these features may enhance the overall wireless performance and reliability, they do not directly prioritize voice traffic for Skype for Business.

References:

• Aruba Validated Reference Design: 802.11ac Networks
• Aruba Validated Reference Design: Skype for Business
• Aruba Validated Reference Design: AirGroup
• Aruba Validated Reference Design: Adaptive Radio Management
• Aruba Validated Reference Design: Voice over Wireless LAN

 Aruba AirWare is a network management solution that provides real time statistics and assessment of call quality for Skype for Business UC solution. It integrates with Skype for Business SDN API to monitor and troubleshoot voice and video calls, and optimize network performance and user experience. It also provides visibility into network health, application performance, and user behavior across wired and wireless networks. Aruba Central is a cloud-based network management solution that does not support Skype for Business integration. Aruba Mobility Master (MM) is a network controller that manages Aruba access points and switches, but does not provide call quality statistics or assessment. Aruba ClearPass is a network access control solution that provides secure authentication and policy enforcement, but does not monitor or optimize Skype for Business calls. References: Aruba AirWave Network Management), Aruba AirWave and Microsoft Skype for Business Integration Guide)

The Aruba 7210 Mobility Controller is designed to support up to 512 APs and 16,384 simultaneous users. In contrast, the 7205 Mobility Controller supports up to 256 APs and 8,192 simultaneous users. Therefore, for a very high density (VHD) design with 128 APs supporting 12,800 devices, the 7210 controllers would be a better fit due to their higher capacity for APs and simultaneous users.

References:

• Designing Aruba Solutions, Rev. 20.11, Module 4: Aruba Mobility Controller Design, page 4-16
• 7200 Series Controller Data Sheet, page 1

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf