A customer has an AOS 10-based solution, including Aruba APs. The customer wants to use Cloud Auth to authenticate non-802.1X capable IoT devices. What is a prerequisite for setting up the device role mappings?

Cloud Authentication in Aruba Central assigns roles to clients based on a set of rules. For non-802.1X IoT devices that authenticate using their MAC address, the primary method for dynamic role assignment is device profiling. Aruba Device Insight automatically classifies clients on the network (e.g., as IP cameras, printers, etc.). Administrators can then create "Client Profile Tags" based on these classifications. These tags are used as attributes within the Cloud Authentication policy rules to map a specific type of device to a predefined user role. Therefore, configuring these tags is a necessary prerequisite for creating the role mapping rules.

A. Configuring a NetConductor-based fabric: NetConductor is an architecture for policy automation. Cloud Auth can function independently in non-fabric deployments, making this not a strict prerequisite for role mapping.
C. Integrating Aruba ClearPass Policy Manager (CPPM) and Device Insight: Cloud Auth is a native Aruba Central feature. Integrating an external NAC like ClearPass represents an alternative solution, not a prerequisite for using Central's built-in functionality.
D. Creating global role-to-role firewall policies in Central: Firewall policies define the network access permissions after a role has been assigned. They are configured as part of the role's definition, not as a prerequisite for the mapping process itself.

1. Aruba Central User Guide: In the section on "Cloud Authentication and Policy," the workflow for creating role assignment rules is detailed. The guide explicitly shows that "Client Profile Tags" are a selectable condition for these rules. It states, "The Cloud Authentication and Policy feature uses the device profiles from the Client Profile page and allows you to create user access policies." This confirms that profiles from Device Insight are used for role mapping. (Reference: Aruba Central Documentation > Security > Cloud Authentication and Policy > Configuring Cloud Authentication and Policy).

2. Aruba Central User Guide: The section on "Device Insight" explains how it classifies clients and how administrators can create tags. It notes that these tags can be leveraged by other services within Central, such as Cloud Authentication, for policy enforcement. (Reference: Aruba Central Documentation > Analyze > Device Insight > Managing Client Profile Tags).