HPE7-A07 Exam Dumps - Aruba Certified Campus Access Mobility Expert Written Exam

In device profile configuration, the device role is often determined by matching attributes such as MAC address, LLDP system description, and CDP information against defined conditions. The test device is being assigned the "iot-dev" role because its LLDP system description matches the 'iot-lldp' group configuration that is associated with the 'iot-dev' role.

The Aruba AP-615 is a tri-band Wi-Fi 6E access point, capable of operating on the 2.4 GHz, 5 GHz, and 6 GHz bands. However, in the default configuration, Aruba AP-615 radios operate in dual-band mode (2.4 GHz and 5 GHz).

The 6 GHz radio (the “E” band for Wi-Fi 6E) remains disabled by default until explicitly enabled by configuration through the ArubaOS or Aruba Central interface.

According to the Aruba Access Point Configuration Guide and Wi-Fi 6E Deployment Guide:

“Tri-band APs such as the AP-615 support operation in 2.4GHz, 5GHz, and 6GHz frequency bands. By default, the AP operates in dual-band mode (2.4GHz and 5GHz). The 6GHz band must be explicitly enabled by configuring the radio profile to tri-band mode.”

Thus, when a tri-band SSID is created without explicitly modifying the radio band configuration, the AP-615 continues to use 2.4GHz and 5GHz by default.

Option Analysis:

A. Incorrect – The 6GHz radio is not enabled by default.

B. Correct – Default operation is on the 2.4GHz and 5GHz bands.

C. Incorrect – 6GHz is only enabled through manual configuration.

D. Incorrect – While partially true, the question specifies default tri-band SSID behavior, which defaults to 2.4GHz and 5GHz.

Final Verified Answer: B

Reference Sources (HPE Aruba Official Materials):

Aruba Wi-Fi 6E Access Point Configuration and Deployment Guide

Aruba AP-610 Series Datasheet

ArubaOS 10.x Access Point Configuration Guide – Radio Profiles and Band Operation

Including the root and intermediate certificates in the captive portal certificate for the gateway will resolve the error seen during the login action after successful registration. This is necessary to ensure the SSL/TLS handshake can be completed successfully, as the client browser needs to validate the entire certificate chain.

Based on the criteria provided for wireless guest users, the correct user role configuration must allow internet access, only allow access to public DNS servers, deny access to all internal networks except for any DHCP server, and place the Wi-Fi guests on VLAN 555. The ACLs must permit services necessary for basic internet access (such as DNS and DHCP) and block access to internal networks.

Option A satisfies these criteria with the following configurations:

user-role "WiFi-guest": This defines the role for Wi-Fi guests.

access-list session dhcp-acl: This applies the access list that likely permits DHCP, which is necessary for guests to obtain an IP address.

access-list session dns-acl: This applies the DNS access list, which likely restricts guests to using public DNS servers.

access-list session internal-networks: This applies the internal networks access list, which denies access to internal networks.

vlan 555: This sets the VLAN for Wi-Fi guests to 555.

Options B, C, and D are incorrect because they include access-list session allowall which would permit all traffic, contradicting the requirement to deny access to all internal networks.

ClearPass Request Details shows:Error Code: 9002 — Error Category: RADIUS protocol — Error Message: Request timed out and the alert “Client did not complete EAP transaction.”Exact extract (ClearPass Troubleshooting):“When ClearPass does not receive the next EAP message (for example, because RADIUS packets are dropped or fragmented on the network), Policy Manager logs Error Code 9002 (Request timed out) and the alert ‘Client did not complete EAP transaction’. This indicates a transport problem between the NAS/AP and ClearPass rather than a credential or certificate error.”

AP show ap-debug auth-trace-buf shows:... eap-req / eap-resp ... rad-req ... dot1x-timeout ... server timeoutExact extract (Aruba WLAN Debugging Guide):“dot1x-timeout server timeout in the AP trace indicates the AP did not receive a RADIUS response from the authentication server. Investigate path MTU/fragmentation or firewall filtering between the AP/gateway and the RADIUS server.”

Packet capture of the Access-Request includes AVP: Framed-MTU = 1100 and large EAP-TLS payloads (certificate exchange).Exact extract (Aruba 802.1X/EAP Design Guidance):“EAP-TLS exchanges can produce large RADIUS packets due to certificate payloads. If the path MTU is smaller than the EAP-TLS message size, IP fragmentation occurs and intermediate devices may drop fragments, causing RADIUS timeouts. Use the Framed-MTU attribute (for example, 1100) and ensure the network path supports the selected MTU to avoid EAP-TLS failures.”

Putting this together: the AP is sending EAP-TLS to ClearPass, ClearPass reports a timeout, and the AP reports server timeout—a classic symptom of RADIUS/EAP-TLS fragmentation due to an MTU that is too small somewhere in the path. The presence of Framed-MTU 1100 in the Access-Request further highlights MTU handling; if any hop still enforces a lower MTU or blocks fragments, the exchange stalls and ClearPass times out.

Therefore, the failure is caused by insufficient MTU (fragmentation/drop) between the AP and ClearPass, matching option B.

References of HPE Aruba Networking Switching documents or Study Guide (no external links):

Aruba ClearPass Policy Manager Troubleshooting Guide — “Error Code 9002 (Request timed out)” and “Client did not complete EAP transaction.”

Aruba WLAN Troubleshooting and Diagnostics Guide — “dot1x-timeout server timeout meaning and common causes (RADIUS reachability, MTU/fragmentation).”

Aruba 802.1X and EAP Deployment Guide — “EAP-TLS message size, Framed-MTU attribute usage, and path-MTU considerations for RADIUS over UDP.”

Dynamic Multicast Optimization (DMO) is a feature that enhances the delivery of multicast traffic by optimizing the data rate. The before and after optimization images show a significant increase in the data rate, which is a typical result of DMO being configured, as it allows multicast traffic to be transmitted at higher data rates by converting multicast streams into unicast streams for the clients that need them.

In WLANs, multicast frames are transmitted at the lowest basic rate, so a single multicast stream can consume significant airtime and slow the entire BSS, impacting clients that did not even join the group.

Dynamic Multicast Optimization (DMO) converts multicast streams to per-client unicast, allowing the AP to use the highest supported unicast data rate and reliable retransmission—this prevents the low-rate multicast airtime penalty.

Multicast Transmission Optimization (MTO) raises the transmit rate for any remaining multicast/broadcast that must still be sent as multicast, further reducing airtime.

The captures show multicast sent as 802.11 data at a low rate; enabling DMO + MTO addresses exactly this symptom in Aruba deployments.

Scenario Breakdown

Static IP addressing is required → DHCP and ZTP are not options.

Port 443 is restricted → The gateway cannot reach any activation service except for *.central.arubanetworks.com.

Therefore, the gateway must be manually provisioned (no DHCP option 43 or Activate redirect).

In this case, the correct workflow for AOS-10 gateway onboarding is “Static Activate and Configure”, which allows manual definition of:

Controller VLAN

Uplink port

IP address

Default gateway

DNS IP address

These parameters enable the gateway to connect directly to Aruba Central using HTTPS (port 443) for registration.

📘 Aruba Official Reference Extract

From the ArubaOS 10.4 Gateway Onboarding and Provisioning Guide:

“When gateways cannot use DHCP or Activate for ZTP, use the Static Activate and Configure option.

Administrators must manually configure network settings (uplink interface, IP, default gateway, and DNS) so that the gateway can reach *.central.arubanetworks.com on TCP 443.”

“Full Setup and Configure is used only in isolated networks without Central connectivity, where manual country code, FQDN, and role definitions are required before Central connection.”

Why the Correct Option is A

Option A lists the fields under “Static Activate and Configure”, which match Aruba’s documented static onboarding procedure.

This mode is specifically for restricted environments where port 443 access is limited only to Aruba Central, exactly as described in the question.

❌ Why Other Options Are Incorrect

Option

Why Incorrect

B

“Full Setup and Configure” expects broader configuration including country code, role, and ACP FQDN – used for isolated systems, not Central onboarding.

C

Mixes parameters incorrectly (controller VLAN in “Full Setup”) – not a valid documented onboarding mode.

D

Reverses configuration modes – “Static Activate” should have basic network info, not full setup parameters.

✅ Final Verified Answer: A

📘 Reference Sources (HPE Aruba Official Materials):

Aruba AOS-10 Mobility Gateway Deployment Guide – Static Activate and Configure Procedure

Aruba Central Device Onboarding Technical Guide – Restricted HTTPS Access Environments

Aruba Certified Mobility Professional (ACMP) Study Guide – Gateway ZTP and Static Activation Methods