An MC has a WLAN that enforces WPA3-Enterprise with authentication to HPE Aruba Networking ClearPass Policy Manager (CPPM). The WLAN's default role…

In an Aruba network using 802.1X authentication with a RADIUS server like ClearPass, the role assigned to a user is determined by a specific hierarchy. A role returned by the RADIUS server via a Vendor-Specific Attribute (VSA), such as Aruba-User-Role, takes precedence over any default role configured on the WLAN's AAA profile. Since ClearPass returned an Access-Accept with the Aruba-User-Role VSA set to generalaccess, and this role exists on the Mobility Controller, the client is assigned the general-access role, overriding the default guest role.

A. The guest role is the default but is overridden by the role specified in the RADIUS VSA.
B. The logon role is typically used during the initial captive portal or 802.1X process, not as the final role after successful authentication.
D. The authenticated role is a default system role, but the specific role from the RADIUS server (general-access) is used instead.

1. ArubaOS 8.6.0.0 User Guide, "Role Derivation" chapter, section "Deriving a User Role from a VSA". It states, "You can configure your RADIUS server to send the Aruba-User-Role VSA as part of the RADIUS accept message... This VSA takes precedence over all other methods of role derivation." (p. 598).

2. Aruba ClearPass Policy Manager 6.9 User Guide, "Enforcement Profiles" chapter. This guide details how to configure enforcement profiles to return VSAs, including Aruba-User-Role, to network devices upon successful authentication.