Which authentication does Aruba's Captive Portal use?

Aruba's Captive Portal is classified as a Layer 3 authentication method. In this process, a client first establishes a Layer 2 connection (associates with the AP) and obtains a Layer 3 address (IP address). When the user attempts to access a web resource, the Aruba controller or gateway intercepts the HTTP/HTTPS traffic based on the client's IP address and redirects them to a login portal. After successful authentication, the system applies a new user role with updated Layer 3 firewall policies to that specific IP address, granting broader network access. The enforcement and session management are fundamentally tied to the client's IP address.

B. MAC authentication: This is a Layer 2 authentication method that validates a device based on its unique hardware MAC address, not through a web-based user interaction.
C. 802.1x authentication: This is a port-based network access control (PNAC) standard that operates at Layer 2, using the Extensible Authentication Protocol (EAP) framework, which is distinct from web-based portal authentication.
D. Layer 2 authentication: This is a general category for methods like 802.1X and MAC authentication. Captive Portal operates after Layer 2 connectivity is already established and uses Layer 3 information for enforcement. ---

1. ArubaOS 8.10.0.x User Guide: In the "Captive Portal Authentication" section, the workflow describes the client obtaining an IP address before being redirected. The controller's firewall policy, which is a Layer 3/4 construct, manages this redirection and subsequent access. The user table maps the authenticated user to an IP address to enforce the post-authentication role. (See Chapter: "Configuring User Access", Section: "Captive Portal Authentication").

2. Aruba Validated Solution Guide: Campus WLAN for Higher Education (April 2018): Page 31 describes the guest access workflow using Captive Portal. It states, "The controller intercepts the web request from the unauthenticated user and redirects the user to its internal captive portal." This interception and redirection is an IP-based (Layer 3) function.

3. Aruba Certified Campus Access Associate (ACCA) Official Study Guide: In chapters covering network access and security, Captive Portal is consistently presented as a web-based authentication method that functions after Layer 2 and Layer 3 connectivity have been established, with enforcement occurring at the IP layer, distinguishing it from Layer 2 methods like 802.1X.