Refer to the scenario. A customer has an AOS10 architecture that is managed by Aruba Central. Aruba infrastructure devices authenticate clients to an…

Aruba Central's "Alerts & Events" monitoring dashboard is the most direct and efficient tool for this task. It provides a comprehensive, filterable log of network activities captured by the infrastructure. An administrator can quickly apply filters for the "IoT" client category (or a specific profile like "Raspberry Pi") and the "SSH" application to generate a precise list of all clients that have initiated SSH traffic. This feature is designed for exactly this type of ad-hoc operational visibility and troubleshooting.

A. Create and apply a Central client profile tag that selects the SSH application and the clients' category.

Client tags are primarily for classifying clients to enforce policies (e.g., VLAN or firewall rule assignment), not for historical searching or ad-hoc reporting of traffic flows.

B. Run a search for SSH traffic and loT client IDs in Aruba ClearPass Policy Manager's (CPPM's) accounting information.

ClearPass accounting logs contain RADIUS session data (e.g., connection times, data transferred) but lack the application-level visibility from Deep Packet Inspection (DPI) needed to identify SSH traffic.

D. Use Central's Gateway IDS/IPS Security Dashboard to search for SSH events and sources.

The IDS/IPS dashboard is specifically for analyzing security threats. While it might log malicious SSH activity, it is not the appropriate tool for general visibility of all legitimate SSH traffic.

1. Aruba Central User Guide: In the "Monitoring Network Health and Activities" chapter

the "Alerts & Events" section describes the dashboard's function. It states

"The Alerts & Events dashboard provides a list of all alerts and events generated for devices

clients

and networks." The guide details the powerful filtering capabilities

which include filtering by Application

Client Category

and Client OS

directly supporting the action in option C. (Reference: Aruba Central User Guide

Monitoring > Alerts & Events section).

2. Aruba Central User Guide: The "Clients" chapter

under "Client Profiling

" explains that tags are used to "group clients that match the specified criteria" for the purpose of applying configuration profiles

such as user-based tunneling or session ACLs. This confirms tags are a policy tool

not a search tool. (Reference: Aruba Central User Guide

Clients > Client Profile section).

3. Aruba ClearPass Policy Manager User Guide: The "Live Monitoring > Accounting" section details the available RADIUS accounting data. The fields listed (e.g.

Acct-Status-Type

Framed-IP-Address

NAS-IP-Address) confirm that application-specific data like "SSH" is not part of standard accounting records. (Reference: ClearPass Policy Manager 6.x User Guide

Monitoring > Live Monitoring > Accounting).

4. Aruba Central User Guide: The "Security > IDS/IPS" chapter describes the dashboard as a tool to "monitor threats detected in the network" and view "events based on severity." This highlights its focus on security incidents rather than general traffic visibility. (Reference: Aruba Central User Guide

Security > IDS/IPS section).