During the testing of RadSec authentication over VXLAN, if the RadSec connection fails during the

digital certificate exchange, it typically indicates an issue with the establishment of the TLS tunnel,

which is required for RadSec's secure communication. The failure of TLS tunnel establishment can

occur due to RADIUS TCP packets being dropped, preventing the secure exchange of digital

certificates necessary for RadSec authentication. The other options, such as IPv6 address reachability,

tracking mode settings, and proxy server misconfiguration, are not directly related to the failure of

the TLS tunnel establishment during the certificate exchange process

The event log showing PMK (Pairwise Master Key) and OKC (Opportunistic Key Caching) key

add/update and delete operations is indicative of normal client behavior in a WLAN environment.

These events are part of the standard process for maintaining client session security and do not

necessarily indicate any issue.

Multi-Pre-Shared Key (MPSK) with ClearPass is the recommended solution for a scenario where the

IT Helpdesk needs to configure IoT devices to connect to a single SSID using unique PSKs. MPSK

allows for the use of different PSKs on the same SSID, and ClearPass enables the management of

these unique keys efficiently.

In a high availability setup where both primary and secondary gateway clusters are present, APs are

typically designed to connect to the primary cluster. If the APs are equally split between the primary

and secondary, this may indicate that some APs cannot reach the primary cluster due to connectivity

issues or reachability constraints, thus falling back to the secondary cluster.

In Aruba's infrastructure, the Access Points (APs) are configured with primary and secondary gateway

clusters to ensure connectivity and resiliency. The APs will failover to the secondary gateway cluster

if they are unable to reach the primary gateway cluster, even if the primary cluster is operational.

This mechanism ensures that the APs maintain connectivity to the network infrastructure for

continuous service delivery.