A company assigns a different block of VLAN IDs to each of its access layer AOS-CX switches. The switches run version 10.07. The IDs are used for…

The most scalable and simple method is to use consistent VLAN names across all switches for the same purpose (e.g., "VLAN-Employee," "VLAN-VoIP"). On each AOS-CX switch, a local user role is configured to map this VLAN name to the switch's specific, local VLAN ID. ClearPass can then be configured with a single, simple policy that returns the generic Aruba-User-Role attribute (e.g., "Employee-Role") for all employee authentications, regardless of which switch they connect to. This decouples the central authentication policy from the switch-specific VLAN numbering scheme, greatly simplifying management.

B. Use the trunk allowed VLAN setting to assign multiple VLAN IDs to the same role. This is incorrect. Trunk settings define which VLANs can traverse a link, typically between switches or to an AP, not for assigning a specific access VLAN to an end-user.
C. Change the VLAN IDs across the AOS-CX switches so that they are consistent. While this would work, it involves a significant network re-architecture. The question asks for a way to simplify setting up the solution with the existing infrastructure, not redesign it.
D. Avoid configuring the VLAN in the role; use trunk VLANs to assign multiple VLANs to the port instead. This negates the primary goal of dynamic VLAN assignment via 802.1X. The role's function is precisely to assign the correct VLAN based on the user's identity.

1. ArubaOS-CX 10.07 Security Guide

Page 183

"User Roles" section. The guide details the configuration of user roles

which are containers for policy settings applied to authenticated clients. It shows that a VLAN can be assigned within a role using either its ID (vlan-id) or its name (vlan-name). Using vlan-name allows for abstraction from the specific numeric ID.

Quote/Concept: The command aaa authorization user-role vlan-name allows a role to be associated with a VLAN by its name

enabling consistent role definition across switches even if VLAN IDs differ.

2. Aruba ClearPass Policy Manager 6.9 User Guide

Page 534

"RADIUS Enforcement Profile" section. This section describes how to configure enforcement profiles to send RADIUS attributes back to a Network Access Device (NAD).

Quote/Concept: For Aruba devices

the Aruba-User-Role VSA (Vendor-Specific Attribute) is used to send the name of the role to be applied to the authenticated user. This allows ClearPass to assign a role name

which the switch then maps to a local policy

including the correct VLAN.

3. Aruba Campus Access for Small and Midsize Businesses Validated Solution Guide (April 2022)

Page 38

"User Roles" section. This design guide illustrates best practices for deploying role-based access.

Quote/Concept: "User roles are configured on the switch and define a set of policies... A key benefit of user roles is that they can be referenced by name

which simplifies ClearPass policy configuration when VLAN IDs are not standardized across the access layer." This directly supports using VLAN names for simplification.