The scenario involves an AOS-CX switch configured for 802.1X port-access authentication. The

configuration defines several roles and their associated VLANs:

port-access role role1 vlan access 11: Role1 assigns VLAN 11.

port-access role role2 vlan access 12: Role2 assigns VLAN 12.

port-access role role3 vlan access 13: Role3 assigns VLAN 13.

port-access role role4 vlan access 14: Role4 assigns VLAN 14.

The switch has 802.1X authentication enabled globally (aaa authentication port-access dot1x

authenticator enable). Two ports are configured:

Interface 1/1/1:

vlan access 1: Default VLAN is 1.

aaa authentication port-access critical-role role1: If the RADIUS server is unavailable, assign role1

(VLAN 11).

aaa authentication port-access preauth-role role2: Before authentication, assign role2 (VLAN 12).

aaa authentication port-access auth-role role3: After successful authentication, assign role3 (VLAN

13) unless overridden by a VSA.

Interface 1/1/2: Same configuration as 1/1/1.

Client1 on port 1/1/1:

Client1 authenticates successfully, and CPPM sends an Access-Accept with the VSA Aruba-User-Role:

role4.

In AOS-CX, the auth-role (role3) is applied after successful authentication unless the RADIUS server

specifies a different role via the Aruba-User-Role VSA. Since CPPM sends Aruba-User-Role: role4, and

role4 exists on the switch, Client1 is assigned role4 (VLAN 14), overriding the default auth-role

(role3).

Client2 on port 1/1/2:

Client2 does not attempt to authenticate (i.e., does not send 802.1X credentials).

In AOS-CX, if a client does not attempt authentication and no other authentication method (e.g.,

MAC authentication) is configured, the client is placed in the preauth-role (role2, VLAN 12). This role

is applied before authentication or when authentication is not attempted, allowing the client limited

access (e.g., to perform authentication or access a captive portal).

Option A, "Client1 = role3; Client2 = role2," is incorrect because Client1 should be assigned role4

(from the VSA), not role3.

Option B, "Client1 = role4; Client2 = role1," is incorrect because Client2 should be assigned the

preauth-role (role2), not the critical-role (role1), since the RADIUS server is reachable (Client1

authenticated successfully).

Option C, "Client1 = role4; Client2 = role2," is correct. Client1 gets role4 from the VSA, and Client2

gets the preauth-role (role2) since it does not attempt authentication.

Option D, "Client1 = role3; Client2 = role1," is incorrect for the same reasons as Option A and Option

B.

The HPE Aruba Networking AOS-CX 10.12 Security Guide states:

"After successful 802.1X authentication, the AOS-CX switch assigns the client to the auth-role

configured for the port (e.g., aaa authentication port-access auth-role role3). However, if the RADIUS

server returns an Aruba-User-Role VSA (e.g., Aruba-User-Role: role4), and the specified role exists on

the switch, the client is assigned that role instead of the auth-role. If a client does not attempt

authentication and no other authentication method is configured, the client is assigned the preauth-

role (e.g., aaa authentication port-access preauth-role role2), which provides limited access before

authentication." (Page 132, 802.1X Authentication Section)

Additionally, the guide notes:

"The critical-role (e.g., aaa authentication port-access critical-role role1) is applied only when the

RADIUS server is unavailable. The preauth-role is applied when a client connects but does not

attempt 802.1X authentication." (Page 134, Port-Access Roles Section)

:

HPE Aruba Networking AOS-CX 10.12 Security Guide, 802.1X Authentication Section, Page 132.

HPE Aruba Networking AOS-CX 10.12 Security Guide, Port-Access Roles Section, Page 134.

===========