Aruba Central provides several security mechanisms to protect the management platform and the devices it controls from unauthorized administrative access. Multi-Factor Authentication (MFA) adds a second layer of security to the login process, requiring users to provide more than just a password. This significantly reduces the risk of compromised credentials. IP Whitelisting restricts access to the Aruba Central portal to a predefined list of trusted IP addresses or subnets, preventing login attempts from any unauthorized location. Both features are fundamental to securing administrative access to the platform.

B. Dynamic VLAN Assignment: This is a network access control feature that assigns authenticated clients to specific VLANs; it does not secure administrative access to the Aruba Central platform itself.

D. Smart Rate Ports: This is a hardware port technology that supports multi-gigabit speeds (e.g., 2.5GbE, 5GbE) on switches. It is a performance feature, not a security mechanism for management access.

1. Aruba Central Help Portal

"Configuring Two-Factor Authentication": This document details the MFA feature

stating

"Aruba Central supports the two-factor authentication feature to provide an additional layer of security to the users of the Aruba Central account. When two-factor authentication is enabled

users are required to enter the username

password

and the verification code to log in to their Aruba Central account."

2. Aruba Central Help Portal

"Managing Security": This section describes the IP Whitelisting feature under "Allowed IP Addresses." It states

"You can configure a list of allowed IP addresses or subnets from which users can log in to the Aruba Central portal. If the allowed IP list is configured

Aruba Central allows access to users logging in from the trusted IP addresses and subnets only."

3. ArubaOS-CX 10.11 Security Guide

"Dynamic VLAN Assignment": This guide explains that dynamic VLAN assignment is used for network clients

stating

"The RADIUS server assigns a VLAN to the client after the client is authenticated." (Page 235). This confirms it is a client access feature

not a platform management security feature.