The most efficient and scalable solution is to leverage the VLAN name feature in AOS-CX downloadable user roles. This involves creating a VLAN on each access switch with the same name (e.g., "reception-vlan") but assigning it the appropriate local VLAN ID (14 on switch 1, 24 on switch 2, etc.). In ClearPass, a single enforcement profile for the "reception-domain" role is created. This profile specifies the VLAN by its name rather than a numeric ID. When a switch downloads this role, it resolves the VLAN name to its locally configured VLAN ID, thus achieving the per-switch VLAN assignment requirement with a single, centralized policy.

B: This describes locally defined roles, which contradicts the explicit requirement for the switch to download role settings from CPPM.

C: Using a variable expression like %(NAS-ID]4 to dynamically construct a VLAN ID is not a standard or supported method in ClearPass enforcement profiles for this purpose.

D: Creating separate enforcement profiles and policies for each switch is operationally inefficient, creates administrative overhead, and does not scale for larger deployments.

1. ArubaOS-CX 10.12 Security Guide

Page 229

Chapter "Configuring port access"

Section "Downloadable user roles": "The VLAN ID or name to be assigned to the user role. When a VLAN name is used

the VLAN name must be configured on the switch. The VLAN ID associated with the name on the switch is assigned to the client." This directly supports using a consistent name that maps to different local IDs.

2. Aruba ClearPass Policy Manager 6.11 User Guide

Page 1

Chapter "Enforcement > Enforcement Profiles"

Section "Aruba Downloadable Role Enforcement Profile": The configuration template for this profile includes an attribute Aruba-Vlan-Name

which is used to send a VLAN name to the network access device. This confirms ClearPass's capability to send a VLAN name as part of the role.