Pass the HP Aruba Certified Design Professional (ACDP) V1 HPE6-A47 Questions and answers with CertsForce

The Aruba MC 7010 and 7024 are both designed for small to mid-sized campuses and branches, but they have some differences in their features and specifications. One of the main differences is the number and type of ports they offer. The MC 7010 has 16 10/100/1000BASE-T ports, while the MC 7024 has 8 10/100/1000BASE-T ports and 8 1000BASE-X SFP ports1. This means that the MC 7024 can support more APs that require fiber connections, such as the AP-387 or the AP-5352. The MC 7024 also supports 10G ports, which can provide higher bandwidth and performance for the network backbone3.

Therefore, if the customer needs to connect 20 APs directly to the MC, and some of them require fiber or 10G connections, the MC 7024 is a better choice than the MC 7010. The other options (A, B, and C) are not relevant for choosing between the MC 7010 and 7024, as both models can support up to 64 APs and 4096 users or devices, and both models can provide PoE+ on 12 ports1.

References:

Aruba 7000 Series Mobility Controllers Data Sheet

Aruba Access Points Data Sheet

Aruba 7000 Series Mobility Controllers and Gateways

A customer who has an Instant AP deployment and needs to provide client-to-site VPN access for remote users would benefit from adding a controller to the deployment. A controller can act as a VPN concentrator that terminates the VPN tunnels from the remote clients and provides secure access to the corporate network. The controller can also apply firewall policies and role-based access control to the VPN traffic. An Instant AP deployment alone cannot provide this functionality, as it only supports site-to-site VPN between Instant AP clusters12. The other options do not require a controller, as they can be achieved with an Instant AP deployment. An Instant AP deployment can apply role-based firewall policies using the built-in stateful firewall on each Instant AP3. An Instant AP deployment can also provide a captive portal for guests using the internal orexternal web server options4. An Instant AP deployment can be managed by a cloud-based solution such as Aruba Central, which does not require a controller5. References:

1: Understanding IAP-VPN Architecture - Aruba

2: Configuring IAP-VPN - Aruba

3: Firewall Roles and Policies - Aruba

4: Configuring Captive Portal - Aruba

5: Managing Instant AP from Aruba Central - Aruba

The architect should propose one LIC-MM-VA-500 license package for the customer. This license package allows the customer to deploy up to two VMMs and manage up to 500 MCs and 10,000 APs. The customer does not need any additional licenses for the MCs or the APs, as they are included in the LIC-MM-VA-500 package. The other options are either insufficient or excessive for the customer’s needs.

Option A is insufficient because six LIC-MM-VA-50 licenses only allow the customer to manage up to 300 MCs and 6,000 APs. The customer needs to manage 300 APs and six MCs, so this option does not meet the requirement.

Option B is excessive because one LIC-MC-VA-250 and one LIC-MC-VA-50 licenses allow the customer to deploy up to 300 MCs and 6,000 APs, which is more than what the customer needs. Moreover, one LIC-MM-VA-500 license allows the customer to deploy up to two VMMs and manage up to 500 MCs and 10,000 APs, which is also more than what the customer needs. Therefore, this option is wasteful and unnecessary.

Option D is also excessive because one LIC-MC-VA-250 and one LIC-MC-VA-50 licenses allow the customer to deploy up to 300 MCs and 6,000 APs, which is more than whatthe customer needs. Additionally, six LIC-MM-VA-500 licenses allow the customer to deploy up to 12 VMMs and manage up to 3,000 MCs and 60,000 APs, which is way more than what the customer needs. Therefore, this option is also wasteful and unnecessary.

References:

ArubaOS 8.5 Licensing Guide)

Aruba Mobility Master Data Sheet)

Aruba 7000 Series Mobility Controllers Data Sheet)

SmartLink is a technology that provides fast failover for access switches connected to the core VSF fabric. It detects link failures on the uplink ports and switches to the backup link within 50 ms. It also shuts down the primary link to prevent loops. SmartLink works with any routing protocol and does not require any additional configuration on the core switches. OSPF graceful restart is a feature that allows OSPF to continue forwarding traffic during a planned or unplanned restart of the routing process. However, it does not provide fast failover for link or device failures. BGP is a routing protocol that is mainly used for inter-domain routing and does not provide fast failover for link or device failures. VRRP is a protocol that provides redundancy for routers by creating a virtual router with a shared IP address. However, it does not provide fast failover for link or device failures. References: ArubaOS-Switch Management and Configuration Guide for WC.16.10), Aruba Validated Design: Campus Wired LAN)

The customer needs a solution that can terminate VPN tunnels for Aruba RAPs, which are remote access points that connect to the corporate network over the Internet. The customer has only one public IP address, which means that they need to use NAT to forward the IPsec traffic to the device that will terminate the VPN tunnel. The customer also wants N+1 redundancy, which means that they need at least two devices that can act as backup for each other in case of failure.

The solution that meets the customer requirements is to use two Aruba MCs on the same subnet that use VRRP without clustering. VRRP stands for Virtual Router Redundancy Protocol, and it is a protocol that allows multiple devices to share a virtual IP address and act as a single gateway for the network. This way, the customer can use the virtual IP address as the public IP address for the NAT, and the IPsec traffic will be forwarded to the device that is the VRRP master. If the master device fails, the backup device will take over the role of the master and continue to terminate the VPN tunnels. This provides N+1 redundancy for the customer.

The other options are not suitable for the customer requirements:

Option B is not suitable because a Layer 3 cluster requires two public IP addresses, one for each MC. The customer only has one public IP address, so they cannot use this option.

Option C is not suitable because VRRP does not work across different subnets. The customer needs to have the MCs on the same subnet to use VRRP.

Option D is not suitable because a Layer 2 cluster does not support NAT. The customer needs to use NAT to forward the IPsec traffic to the MCs.

References:

Aruba Remote Access Point (RAP) Networks Validated Reference Design)

Aruba Mobility Controller Virtual IP Configuration Guide)

ArubaOS 8.5 User Guide)

 Aruba AirWare is a network management solution that provides real time statistics and assessment of call quality for Skype for Business UC solution. It integrates with Skype for Business SDN API to monitor and troubleshoot voice and video calls, and optimize network performance and user experience. It also provides visibility into network health, application performance, and user behavior across wired and wireless networks. Aruba Central is a cloud-based network management solution that does not support Skype for Business integration. Aruba Mobility Master (MM) is a network controller that manages Aruba access points and switches, but does not provide call quality statistics or assessment. Aruba ClearPass is a network access control solution that provides secure authentication and policy enforcement, but does not monitor or optimize Skype for Business calls. References: Aruba AirWave Network Management), Aruba AirWave and Microsoft Skype for Business Integration Guide)

The minimum acceptable signal for an active site survey depends on the type of applications and the data rates that the users require. For 802.11ac, which operates in the 5 GHz band, Aruba recommends a signal of -65 dBm or better for high-performance applications such as voice and video, and a signal of -72 dBm or better for basic applications such as Web and email1. These values are based on the receiver sensitivity of typical 802.11ac clients and the expected signal-to-noise ratio (SNR) for different modulation and coding schemes (MCS). A higher SNR means a higher data rate and a better user experience.

Therefore, the architect should look for a signal of -65 dBm in the 5 GHz band to determine the test AP range for 802.11ac, assuming that the users run high-performance applications. A signal of -75 dBm in the 5 GHz band might be too weak to support the desired data rates and quality of service. A signal of -65 dBm or -75 dBm in the 2.4 GHz band is irrelevant for 802.11ac, as it does not operate in that band.

References:

Aruba Validated Reference Design: 802.11ac Networks

Best Practices for Monitoring and Troubleshooting 802.11ac Networks

ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.

It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.

It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm

2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

One Aruba best practice for this design is to ensure that optimization and suppression of unnecessary multicast is enabled on the MCs. This is because multicast traffic can consume a lot of bandwidth and degrade the wireless performance, especially in a large building with many devices. By enabling optimization and suppression of unnecessary multicast, the MCs can reduce the amount of multicast traffic that is sent to the APs and the wireless clients, and improve the network efficiency and user experience.

Option A is incorrect because extending VLAN 10 to the edge and deploying Aruba APs on it is not a best practice for this design. This is because it creates a large broadcast domain that can increase the network congestion and complexity. It also exposes the VLAN 10 to potential security risks from the edge devices. Option B is incorrect because ensuring that each user role on the MCs is associated with a different VLAN ID is not a best practice for this design. This is because it creates a large number of VLANs that can increase the network overhead and management difficulty. It also limits the flexibility and scalability of the network design. Option C is incorrect because ensuring that the RADIUS server assigns users to different VLANs dynamically is not a best practice for this design. This is because it adds an extra layer of complexity and dependency to the network design. It also requires the RADIUS server to be configured and synchronized with the MCs and the VLANs, which can introduce potential errors and delays. References: Aruba Validated Design: Campus Wireless LAN), ArubaOS 8.7 User Guide)

This is a routed link, meaning you should only have one VLAN assigned to the link. Obvious since VLANs are terminated at a layer 3 boundary, but also right out of the curriculum.

References: The information can be referenced from the official HPE documents and learning materials available on HPE Press and Aruba Networks. Specifically, it aligns with the objectives outlined in Chapter 5: Wired Network Design, where the VSF and VLAN design considerations are discussed. Designing Aruba Solutions Official Certification Study Guide ArubaOS-Switch and ArubaOS-CX VSF Configuration Guide