HPE6-A78 practice question 16 of 25

You have a network with ArubaOS-Switches for which Aruba ClearPass Policy Manager (CPPM) is acting as a TACACS+ server to authenticate managers. CPPM…

You have a network with ArubaOS-Switches for which Aruba ClearPass Policy Manager (CPPM) is acting as a TACACS+ server to authenticate managers. CPPM assigns the admins a TACACS+ privilege level, either manager or operator. You are now adding ArubaOS-CX switches to the network. ClearPass admins want to use the same CPPM service and policies to authenticate managers on the new switches. What should you explain?

Answer options

A: This approach cannot work because the ArubaOS-CX switches do not accept standard TACACS+ privilege levels.

B: This approach cannot work because the ArubaOS-CX switches do not support TACACS+.

C: This approach will work, but will need to be adjusted later if you want to assign managers to the default auditors group.

D: This approach will work to assign admins to the default "administrators" group, but not to the default "operators" group. Correct answer

Correct Answer:

D. This approach will work to assign admins to the default "administrators" group, but not to the default "operators" group.

Explanation

This approach will work for assigning administrators but requires adjustment for operators. ArubaOS-CX maps the standard TACACS+ priv-lvl attribute to its local user groups. A priv-lvl of 15, typically used for a "manager" role on legacy systems, correctly maps to the ArubaOS-CX "administrators" group. However, the "operators" group on ArubaOS-CX requires a priv-lvl between 1 and 14. If the legacy configuration for the "operator" role sends a priv-lvl of 0 (a common value for lowest-privilege access), it will not map to the "operators" group on the ArubaOS-CX switch, and the user will be denied access. Therefore, the policy needs adjustment for operators.

Why Incorrect

A. ArubaOS-CX switches do accept standard TACACS+ priv-lvl attributes and map them to local roles, making this statement incorrect.
B. ArubaOS-CX switches fully support TACACS+ for management authentication and authorization, making this statement false.
C. While the auditors group exists, the immediate problem lies with the mapping of the existing operator privilege level, not a future assignment to a different group.

References

ArubaOS-CX 10.11 Security Guide (R0X46-63001, Edition 1, October 2022), Page 111, "TACACS+ user authorization": "The switch maps the TACACS+ priv-lvl attribute to the user groups. A priv-lvl of 15 maps to the administrators group. A priv-lvl of 1-14 maps to the operators group." This confirms the specific numerical mapping on CX switches.

Keep practicing

Take the free HPE6-A78 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test