An administrator is implementing a downloadable user role solution involving AOS-CX switches. The AAA solution and the AOS-CX switches can successfully authenticate users; however, the role information fails to download to the switches. What policy should be added to an intermediate firewall to allow the downloadable role function to succeed?
For a downloadable user role solution involving AOS-CX switches, roles that are configured on a ClearPass server are transferred to the switch using HTTPS. HTTPS operates over TCP port 443, which needs to be allowed through the firewall for the role information to download successfully to the switches.
Answer A is correct. Student Guide Vol2, page 115: "Roles can be configured locally on the switch using a Local User Role (LUR) or on a ClearPass server, using a downloadable user role (DUR). Roles that are configured locally can be assigned via any RADIUS server, using the Aruba-User-Role VSA. When using DUR, the ClearPass HPE-CPPM-Role VSA is used in combination with HTTPS to transfer the role to the switch."
I think the answer Should be A because something wrong with HTTPS maybe the switch failed to download the certificate or there is firewall block TCP443. If UDP 8211 (PAPI) is related for dynamic segmentation instead of DUR
REST API is used for this, so A HTTPS
HTTPS uses TCP 443, so it is A and not C
Page 775 Study Guide: This means that a HTTPS certificate has to be installed on the edge switch. [Aruba Networks]
Correct it is A
pg 681 from the Aruba guide - "When using DUR, the ClearPass HPE-CPPM-Role VSA is used in combination with HTTPS to transfer the role to the switch." UDP 8211 (PAPI) is related to dynamic segmentation and the communication to the MC not DUR.
DUR is a CPPM feature, so assumption is that the AAA is CPPM. AOS switches download their roles from CPPM using HTTPS, you just have to put a CA cert on the switch for the CPPM and reference the FQDN. Definitely A.
The correct Answer is A
C is correct (HTTPS is used between switch and CPPM)
And HTTPS uses TCP 443, so it is A and not C
C only this port mentioned in study book. v2-169
Answer is A
A is correct
HTTPS uses TCP 443, so it is A and not C
If any firewall or network infrastructure device with ACLs are in the path, they must allow GRE and PAPI traffic. Enable GRE on IP protocol 47 and PAPI on UDP 8211