HPE6-A78 practice question 22 of 25

You configure an ArubaOS-Switch to enforce 802.1X authentication with ClearPass Policy Manager (CPPM) denned as the RADIUS server Clients cannot authenticate You check Aruba ClearPass Access Tracker and cannot find a record of the authentication attempt. What are two possible problems that have this symptom? (Select two)

Full set: 168 questions
Answer options
A: users are logging in with the wrong usernames and passwords or invalid certificates.
B: Clients are configured to use a mismatched EAP method from the one In the CPPM service.
C: The RADIUS shared secret does not match between the switch and CPPM. Correct answer
D: CPPM does not have a network device defined for the switch's IP address. Correct answer
E: Clients are not configured to trust the root CA certificate for CPPM's RADIUS/EAP certificate.
Correct Answer:
C. The RADIUS shared secret does not match between the switch and CPPM.; D. CPPM does not have a network device defined for the switch's IP address.
Explanation

If authentication attempts do not appear in the ClearPass Access Tracker, it indicates a fundamental communication failure between the Network Access Device (the switch) and the ClearPass server. The RADIUS requests are not being received or are being dropped by ClearPass before being processed. Two common causes for this are a mismatched RADIUS shared secret between the switch and ClearPass, or the switch's IP address not being configured as a Network Device in ClearPass. In both cases, ClearPass will silently drop the incoming RADIUS packets, resulting in no log entry in the Access Tracker.

Why Incorrect

A. Incorrect user credentials would result in a RADIUS Reject message, and the failed authentication attempt would be logged in the Access Tracker.
B. A mismatched EAP method would cause the authentication to fail, but the RADIUS communication itself would be established and logged in the Access Tracker.
E. A client not trusting the RADIUS server's CA certificate would cause a client-side failure, but the initial RADIUS request from the switch would still be sent and logged.

References

- Aruba Networks, "ClearPass Policy Manager 6.9 User Guide," (2021). The troubleshooting section notes that if requests are not seen in Access Tracker, administrators should verify network connectivity, firewall rules, the RADIUS shared secret, and that the NAD is correctly defined in ClearPass. (See Chapter: Monitoring > Access Tracker > Troubleshooting).

- Aruba Networks, "Aruba ClearPass Workshop - Lab Guide," (various versions). These official training materials consistently instruct students to verify the NAD IP address and RADIUS shared secret in ClearPass as initial troubleshooting steps for connectivity issues where authentications are not logged. (See Module: "Adding Network Access Devices").

Scroll to Top