A company is deploying ArubaOS-CX switches to support 135 employees, which will tunnel client traffic to an Aruba Mobility Controller (MC) for the MC to apply firewall policies and deep packet inspection (DPI). This MC will be dedicated to receiving traffic from the ArubaOS-CX switches. What are the licensing requirements for the MC?

When ArubaOS-CX switches tunnel client traffic to an Aruba Mobility Controller (MC) using User-Based Tunneling (UBT), the MC applies advanced services. The Policy Enforcement Firewall (PEF) license is required on the MC to enable these services, which include the stateful firewall, deep packet inspection (DPI), and role-based policy application for the tunneled traffic. The license is consumed per device (in this case, per switch) that tunnels traffic to the controller.

A. AP licenses are for terminating wireless Access Points on the Mobility Controller, not for processing tunneled traffic from wired switches.
C. The Web Content Classification (WCC) license is an optional add-on to PEF for URL filtering and is not a base requirement for UBT.
D. This option is incorrect because AP licenses are not required for User-Based Tunneling from switches.

1. Aruba Mobility Controller Licensing Guide (for ArubaOS 8.7.0.0), Page 8, "PEF License": "The PEF license is required for... the enforcement of firewall policies for tunneled wired users."

2. ArubaOS-CX 10.07 User-Based Tunneling Guide, Page 7, "Mobility Controller Licenses": "The Mobility Controller requires one PEF license per switch that tunnels client traffic to the Mobility Controller."