HPE7-A07 practice question 8 of 15

A customer has deployed an AOS 10 mobility gateway cluster consisting of three controllers at a single site The WLAN is configured to tunnel wireless…

A customer has deployed an AOS 10 mobility gateway cluster consisting of three controllers at a single site The WLAN is configured to tunnel wireless device traffic to the AOS 10 mobility cluster The clients are authenticated by ClearPass using WPA3-Enterprise (opmode wpa3-aes-ccm-128). The security team has requested the ability to force a wireless device to reauthenticate using ClearPass. Which steps are required to ensure ClearPass can consistently initiate a change of authorization against an AOS 10 mobility cluster, including during gateway failover scenarios? (Select two)

Answer options

A: set cluster mode to Auto Site under High Availability - Cluster configuration

B: modify WLAN - SSID - VLAN - Mode Configuration

C: enable manual cluster configuration under High Availability - Cluster Configuration

D: enable Dynamic Authorization CoA under High Availability - Cluster Configuration Correct answer

E: modify NAS IPv4 address under Security - Advanced - RADIUS Client Correct answer

Correct Answer:

D. enable Dynamic Authorization CoA under High Availability - Cluster Configuration; E. modify NAS IPv4 address under Security - Advanced - RADIUS Client

Explanation

For ClearPass to reliably initiate a Change of Authorization (CoA) against an AOS 10 mobility gateway cluster, especially during failover, the cluster must present a single, stable IP address to the RADIUS server. This ensures CoA requests are always sent to a reachable address that represents the cluster, which then forwards the request to the specific gateway managing the client session. This is achieved by:
1. Enabling "Dynamic Authorization (CoA)" within the cluster's high availability settings. This activates the feature and allows for the configuration of a shared IP address for the cluster.
2. Configuring the RADIUS client profile to use this shared IP address as the "NAS IPv4 address". This ensures all outgoing RADIUS authentication requests from the cluster use the shared IP as the source, so ClearPass correctly identifies the cluster's address for subsequent CoA messages.

Why Incorrect

A. Auto Site cluster mode is designed for geographically distributed L3 clusters, not for a single-site deployment as described in the scenario.
B. Modifying the WLAN VLAN configuration affects client network segmentation and IP addressing but does not enable or configure the RADIUS CoA mechanism.
C. Enabling manual cluster configuration is a method to form the cluster itself, not the specific setting required to ensure reliable CoA functionality.

References

1. ArubaOS 10.5.0.0 User Guide, Chapter: "Configuring Gateway Clusters", Section: "Dynamic Authorization", Page 388.

This section states: "To enable dynamic authorization for a Gateway cluster, you must configure a shared IP address for the Gateway cluster. The shared IP address is used as the NAS-IP address for all RADIUS communication from the Gateway cluster." It details the configuration path under High Availability > Cluster, which corresponds to option D.

2. ArubaOS 10.5.0.0 User Guide, Chapter: "Configuring RADIUS Servers", Section: "Configuring a RADIUS Client", Page 739.

This section describes the NAS IPv4 address parameter: "Enter the NAS IP address of the RADIUS client. If configured, this IP address is used as the source IP address for all RADIUS packets." This confirms that setting this value (option E) ensures the cluster uses the shared IP for RADIUS communication.

Keep practicing

Take the free HPE7-A07 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test