Class of Service (CoS) operates at Layer 2, utilizing the 3-bit Priority Code Point (PCP) field within the 802.1Q Ethernet header to define 8 priority levels (0–7). Differentiated Services (DiffServ) functions at Layer 3. It re-purposes the ToS byte in the IPv4 header (or Traffic Class in IPv6) to use the 6-bit Differentiated Services Code Point (DSCP), allowing for 2^6 = 64 distinct traffic classifications. Best Effort Service is the default behavior where no QoS mechanisms are applied. Network devices forward packets in the order they arrive (First-In, First-Out) without guarantees for bandwidth or latency.

WMM (Wi-Fi Multimedia) is a subset of the IEEE 802.11e standard adapted by the Wi-Fi Alliance. It prioritizes wireless traffic into four Access Categories (AC): Voice, Video, Best Effort, and Background.

RFC 2474, "Definition of the Differentiated Services Field (DS Field) in the IPv4 and IPv6 Headers," Internet Engineering Task Force (IETF), December 1998. (Defines Layer 3 DiffServ and the 6-bit DSCP field).

IEEE Std 802.1Q-2018, "IEEE Standard for Local and Metropolitan Area Networks—Bridges and Bridged Networks," IEEE Computer Society, Section 6.9.3 "Priority Code Point (PCP) encoding". (Defines Layer 2 classification using the 3-bit field for 8 priority levels).

Cisco Systems, "Quality of Service (QoS) Configuration Guide, Cisco IOS XE 17.x," Chapter: "QoS Overview," Section: "QoS Models." (Details Best Effort, IntServ, and DiffServ models).

Wi-Fi Alliance, "WMM (Wi-Fi Multimedia) Specification," Version 1.2.0. (Defines the implementation of IEEE 802.11e QoS and Access Categories).

Aruba (HPE), "ArubaOS 8.6.0.0 User Guide," Chapter: "Quality of Service," Section: "Wi-Fi Multimedia." (Explains WMM and its relation to 802.11e Access Categories).

Unicast is a one-to-one transmission between a specific source and a specific destination IP (e.g., 10.1.3.7 to 10.13.4.2). Multicast enables efficient one-to-many or many-to-many communication where traffic is sent to a specific group of interested receivers (class D addresses), allowing multiple senders and recipients. IP Directed Broadcast targets all hosts on a specific remote subnet; the packet is routed as unicast until it reaches the destination router, which then broadcasts it locally. Broadcast (specifically limited broadcast, 255.255.255.255) is sent to all network interface cards (NICs) on the same local Layer 2 segment as the sender and is not forwarded by routers.

RFC 919, "Broadcasting Internet Datagrams," Section 6 (Gateways and Broadcasts), defining the distinction between local and directed broadcasts.

RFC 1112, "Host Extensions for IP Multicasting," Section 1, defining multicast as the delivery of datagrams to a "host group" (zero or more hosts).

Cisco Systems, "IP Addressing: IPv4 Addressing Configuration Guide," Configuring IP Directed Broadcasts, which defines directed broadcasts as packets sent to the broadcast address of a subnet to which the sender is not directly attached.

RFC 1812, "Requirements for IP Version 4 Routers," Section 4.2.2.11, discussing the requirements for forwarding directed broadcasts versus limited broadcasts.

IEEE 802.3af (PoE), also known as Type 1, was the original standard defining power delivery over Ethernet. It supports a maximum power output of 15.4 W at the Power Sourcing Equipment (PSE), which encompasses Class 3.

IEEE 802.3at (PoE+), or Type 2, increased the available power to 30 W at the PSE. This standard introduced Class 4 to handle the higher power requirements beyond the original 802.3af limits.

IEEE 802.3bt (4-Pair PoE) introduced Type 3 and Type 4, utilizing all four pairs of the Ethernet cable. It supports Class 6 (providing up to 60 W at the PSE under Type 3) and Class 8 (providing up to 90 W at the PSE under Type 4).

IEEE Computer Society. (2018). IEEE Std 802.3bt-2018: Amendment 2: Physical Layer and Management Parameters for DTE Power via MDI over 4-Pair. IEEE. Section 145. (Defining Type 3 and Type 4 power levels/classes).

Cisco Systems. (2022). Cisco Catalyst 9000 Series Switches - PoE and UPOE+ White Paper. "Table 1: PoE Standards." (Confirms 802.3af maps to 15.4W/Class 3, 802.3at to 30W/Class 4, and 802.3bt to 60W/90W).

Ethernet Alliance. (2019). Overview of 802.3bt - Power over Ethernet. Page 4, "Power Classes." (Details the specific wattage for Class 6 and Class 8 under the 802.3bt standard).

User Based Tunneling (UBT), a component of Dynamic Segmentation, creates a Centralized Overlay by tunneling specific user traffic from the access switch to a central Gateway (Controller) for centralized policy enforcement and inspection. The transport protocol used for this data tunnel is Generic Routing Encapsulation (GRE).

In contrast, EVPN-VXLAN is designed to create a Distributed Overlay fabric. It decouples the virtual network from the physical underlay, distributing Layer 3 gateways across leaf switches (Distributed Anycast Gateway). The VXLAN data plane encapsulates Layer 2 Ethernet frames within Layer 3 packets using UDP (specifically destination port 4789) to traverse the underlay network.

HPE Aruba Networking. (2023). ArubaOS-CX 10.13 Virtualization Guide. Chapter: "EVPN-VXLAN Solution Overview." (Confirming VXLAN uses UDP encapsulation and creates a distributed network fabric).

HPE Aruba Networking. (2022). Aruba Dynamic Segmentation on ArubaOS-CX Switch Guide. Section: "User-Based Tunneling (UBT)." (Describes the tunneling of traffic to a controller via GRE).

Mahalingam, M., et al. (2014). Virtual eXtensible Local Area Network (VXLAN): A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks. RFC 7348. (Official IETF standard defining VXLAN as a UDP-based encapsulation).

In Aruba AOS 10 Tunnel Mode (specifically Decrypt-Tunnel), the Overlay Tunnel Orchestrator (OTO) facilitates the control plane by handling the Negotiate IPsec Phase 1 function (generating and distributing key material), effectively replacing the traditional IKE Phase 1 between peers. The Access Point and Gateway then utilize this key material to Negotiate IPsec Phase 2 (establishing the IPsec/GRE Data Tunnels). Regarding 802.1X, the Access Point acts as the Authenticator (handling encryption/decryption at the edge), while the Device Designated Gateway serves as the termination point for the tunnel and acts as the RADIUS proxy to the AAA server.

Aruba Campus Access Webinar Part 2 (Slide 21): Explicitly lists "Negotiate IPsec Phase 1" under OTO Service and "Negotiate IPsec Phase 2" under APs and Gateways.

Aruba AOS 10 Terminology Guide: Confirms that in AOS 10 Tunnel Mode, the "AP acts as an authenticator while the Gateway acts as authentication proxy" (RADIUS proxy).

HPE Aruba Networking TechDocs (Tunnel Orchestrator): Describes the OTO's role in automating tunnel establishment and distributing IPsec keys.

The Aruba controller assigns user roles based on a specific hierarchy of precedence. The process flows from the base configuration to specific overrides:

1. Initial role assigned: This is the starting point. When a user first associates with the SSID (before authentication completes), they are assigned the "Initial Role" configured in the AAA profile.
2. Authentication default role: Upon successful authentication, the system applies the default role specified in the authentication profile (e.g., 802.1X or MAC authentication profile). This overrides the initial role.
3. User derived role: The controller then checks for User Derivation Rules (UDRs) configured locally on the controller (based on attributes like SSID, VLAN, or MAC OUI). If a match is found, this role takes precedence over the authentication default role.
4. Server derived role: Finally, if the authentication server (RADIUS) returns a Vendor Specific Attribute (VSA) specifying a role, this Server Derived Role takes the highest precedence and overrides all previous roles.

Aruba Networks (HPE), ArubaOS 8.6.0.0 User Guide, "User Roles" section, subsection "Role Derivation." This section explicitly states: "The following is the order of precedence for role assignment (from highest to lowest): 1. Server-derived role 2. User-derived role 3. Default role 4. Initial role."

Aruba Networks (HPE), Aruba Certified Mobility Associate (ACMA) Study Guide, Chapter on "Firewall Roles and Policies," describing the hierarchy of role assignment where Server Derived roles override User Derived rules, which in turn override Default roles.

VSF (Virtual Switching Framework) is a front-plane stacking technology used primarily in the access and aggregation layers (e.g., Aruba CX 6300 series).

• Stack Size: It supports stacking up to 10 member switches (specifically on the CX 6300).
• Bandwidth: The CX 6300 allows the use of SFP56 ports for VSF links. These ports support speeds up to 50G individually. With up to 4 ports configured for stacking, the maximum aggregate stacking bandwidth is 200 Gbps (unidirectional) or quoted as 400 Gbps bidirectional in some marketing, but the "200G" and "50G" figures specifically define the VSF limits in this context.

VSX (Virtual Switching Extension) is a high-availability clustering technology used in the core and data center (e.g., Aruba CX 6400, 8325, 9300).

• Cluster Size: VSX always pairs exactly two devices (peers) to form a cluster with synchronized control planes.
• Bandwidth: VSX uses standard Ethernet links for the Inter-Switch Link (ISL). On high-end platforms like the Aruba CX 9300, which features native 400G ports, an individual ISL link can operate at 400G.

HPE Aruba Networking, "Aruba CX 6300 Switch Series Data Sheet," Performance and Power, (Confirming VSF stacking up to 10 members and 50G/200G bandwidth limits).

Quote: "VSF allows for stacking of up to 10 switches... Four built-in uplinks support speeds of up to 10, 25, 50, and 100 GbE for a total of 200 to 400 Gbps of stacking throughput."

HPE Aruba Networking, "AOS-CX 10.07 Virtual Switching Framework (VSF) Guide," Chapter 1, Introduction.

Quote: "6300: VSF allows stacks to be formed... Up to 10 member switches will be allowed. Connections between the switches must use 10G, 25G, or 50G links."

HPE Aruba Networking, "AOS-CX 10.10 Virtual Switching Extension (VSX) Guide," VSX Overview.

Quote: "VSX binds two AOS-CX switches of the same model type to operate as one device for layer 2."

HPE Aruba Networking, "Aruba CX 9300 Switch Series Data Sheet."

Context: Verifies support for 400G interfaces on VSX-capable Data Center switches, enabling 400G ISL links.

Dynamic Multicast Optimization is enabled inside the WLAN/SSID (VAP) profile, so it is applied on a per-SSID basis rather than as a single global setting. When enabled, the Aruba mobility controller (or virtual controller in an Instant cluster) duplicates each incoming multicast frame and retransmits it as separate unicast frames to every associated client. This improves reliability and airtime efficiency for video or other multicast-based traffic over Wi-Fi. The feature does not rely on airtime fairness mechanisms in the AP and is not configured “globally for each SSID.”

1. HPE ArubaOS 8.10.0.0 User Guide

Chapter “Wireless Multicast”

section “Dynamic Multicast Optimization”

pp. 1159-1160 – “DMO is enabled in the WLAN SSID profile… the controller converts multicast packets to unicast packets for each client.”

2. ArubaOS 6.4 Mobility Controller Configuration Guide

Chapter 37 “Dynamic Multicast Optimization”

p. 1146 – “Configure dynamic-multicast-optimization under the SSID profile… the controller replicates multicast into unicast frames.”

In an Aruba User-Based Tunneling (UBT) environment, the switch relies on an authentication server (e.g., ClearPass) to provide the Aruba-User-Role attribute for an authenticated client. This attribute specifies the role to be applied by the gateway (Mobility Controller). If the authentication server successfully authenticates a client but fails to return this specific gateway role, the switch cannot establish the tunnel for that client. The switch's default fallback behavior in this scenario is to place the client on the port's configured access VLAN and forward its traffic locally, as if it were a standard, non-tunneled client.

B. The gateway will assign a default role to the client.

This is incorrect because the premise is that the gateway did not receive a role; therefore, it cannot take any action, including assigning a default one.

C. The switch will assign the default deny role to the client.

This is incorrect. The switch's default action is to revert to local forwarding on the access VLAN, not to apply a specific named "deny role".

D. The gateway will send back the deny role to the client.

This is incorrect as it contradicts the question's scenario where the gateway does not specify any role for the client.

1. ArubaOS-Switch Advanced Traffic Management Guide K.16.03

Chapter 7: "Per-User Tunneled Node"

Page 161

"Operation notes": "If the authentication server does not return a gateway role for an authenticated client

the switch places the client in the access VLAN and forwards its traffic locally."

2. ArubaOS-Switch Access Security Guide for 16.10

Chapter 11: "Tunneled Node"

Page 301

"RADIUS attributes for tunneled node": This section details the necessity of the Aruba-User-Role Vendor-Specific Attribute (VSA) for the gateway to assign a policy. Its absence leads to the failure condition described in the question.

Equivalent Isotropic Radiated Power (EIRP) is the total power radiated from a theoretical isotropic antenna. It is calculated by adding the transmitter power to the antenna gain and subtracting any signal loss that occurs in the transmission line (e.g., antenna cable).

The formula is:

EIRP = Transmitter Power (dBm) + Antenna Gain (dBi) – Cable Loss (dB)

For AP1, the values are:

Transmitter Power = 10 dBm

Antenna Gain = 9 dBi

Cable Loss = 2 dB

Calculation: EIRP = 10 dBm + 9 dBi - 2 dB = 17 dBm.

A. 26 dBm: This value is an incorrect calculation and does not correspond to the specifications provided for either AP1 or AP2.

B. 30 dBm: This is a common regulatory EIRP limit in some regions (e.g., for UNII-1 and UNII-3 bands in the US), not the calculated value for AP1's specific hardware.

D. -12 dBm: This result would be derived from an incorrect application of the EIRP formula, such as improperly subtracting gain or adding loss.

1. Aruba Networks

an HPE Company. ArubaOS 8.6.0.0 User Guide. (2019). In the section on RF Management (ARM)

the concept of EIRP is discussed as the basis for power level management. The guide implicitly uses the standard formula (Transmit Power + Antenna Gain - Cable Loss) to determine the final radiated power. See Chapter: "RF Management (ARM)"

Section: "Power Management".

2. HPE Press. Aruba Certified Mobility Associate (ACMA) Official Certification Study Guide. (2020). The guide covers fundamental RF concepts

including the calculation of EIRP. Chapter 2

"RF Fundamentals

" details the components of an RF system and explains how to calculate link budgets and radiated power using dBm

dBi

and dB loss values. The formula EIRP = Tx Power + Antenna Gain – Cable Loss is a core concept presented.

3. David D. Coleman

David A. Westcott. CWNA Certified Wireless Network Administrator Study Guide

5th Edition. (Sybex

2018). While a general industry certification guide

its principles are foundational to vendor-specific exams like HPE7-A01. Chapter 4

"Radio Frequency Fundamentals

" page 121

explicitly defines the EIRP calculation as: "Transmitter Power (in dBm) – Cable Loss (in dB) + Antenna Gain (in dBi) = EIRP (in dBm)".