ClearPass Policy Manager (CPPM) can receive detailed information about client device type, OS, and status from ClearPass OnGuard. ClearPass OnGuard is part of the ClearPass suite and provides posture assessment and endpoint health checks. It gathers detailed information on the status and security posture of devices trying to connect to the network, such as whether antivirus software is up to date, which operating system is running, and other details that characterize the device's compliance with the network's security policies.

:

Aruba ClearPass product documentation that details the capabilities of ClearPass OnGuard.

Network security resources that describe endpoint health checks and the importance of device posture assessment for access control.

The scenario involves AOS-CX switches in a two-tier topology (access and core layers) using OSPF routing at the core. The goal is to prevent ARP poisoning attacks on user VLANs at the access layer switches, where end-user devices connect. ARP poisoning (also known as ARP spoofing) is an attack where a malicious device sends fake ARP messages to associate its MAC address with the IP address of another device (e.g., the default gateway), allowing the attacker to intercept traffic.

ARP Inspection (Dynamic ARP Inspection, DAI): This feature prevents ARP poisoning by validating ARP packets against a trusted database of IP-to-MAC bindings. On AOS-CX switches, ARP inspection uses the DHCP snooping binding table to verify that ARP messages come from legitimate devices. If an ARP packet does not match the binding table, it is dropped.

DHCPv4 Snooping: This feature protects against rogue DHCP servers and builds a binding table of legitimate IP-to-MAC mappings by snooping DHCP traffic. The binding table is used by ARP inspection to validate ARP packets. DHCP snooping must be enabled before ARP inspection can function effectively, as it provides the trusted data for validation.

Option A, 'ARP inspection,' is correct. ARP inspection (DAI) directly prevents ARP poisoning by ensuring that ARP packets are legitimate, making it a key technology for this purpose.

Option B, 'OSPF passive interface,' is incorrect. OSPF passive interface is used to prevent OSPF from sending routing updates on specific interfaces, typically to reduce routing protocol traffic on user-facing interfaces. It does not prevent ARP poisoning, which is a Layer 2 attack.

Option C, 'BPDU guard (protection),' is incorrect. BPDU guard protects against spanning tree protocol (STP) attacks by disabling a port if it receives BPDUs (e.g., from an unauthorized switch). It does not address ARP poisoning, which is unrelated to STP.

Option D, 'DHCPv4 snooping,' is correct. DHCP snooping is a prerequisite for ARP inspection, as it builds the binding table used to validate ARP packets. It also protects against rogue DHCP servers, which can indirectly contribute to ARP poisoning by assigning incorrect IP addresses.

Option E, 'BPDU filtering,' is incorrect. BPDU filtering prevents a port from sending or receiving BPDUs, which can be used to protect against STP attacks, but it does not prevent ARP poisoning.

The HPE Aruba Networking AOS-CX 10.12 Security Guide states:

'To prevent ARP poisoning attacks on user VLANs, enable Dynamic ARP Inspection (DAI) on access layer switches. DAI validates ARP packets against the DHCP snooping binding table to ensure they come from legitimate devices. Use the command ip arp inspection vlan <vlan-list> to enable DAI on the specified VLANs. DHCP snooping must be enabled first with dhcp-snooping and dhcp-snooping vlan <vlan-list> to build the binding table used by DAI.' (Page 145, ARP Inspection and DHCP Snooping Section)

Additionally, the guide notes:

'DHCP snooping and ARP inspection work together to protect against Layer 2 attacks like ARP poisoning. DHCP snooping builds a trusted database of IP-to-MAC bindings, which ARP inspection uses to filter out malicious ARP packets.' (Page 146, Best Practices Section)

:

HPE Aruba Networking AOS-CX 10.12 Security Guide, ARP Inspection and DHCP Snooping Section, Page 145.

HPE Aruba Networking AOS-CX 10.12 Security Guide, Best Practices Section, Page 146.

===========

To meet the requirements for configuring an ArubaOS-CX switch for integration with ClearPass Policy Manager (CPPM), it is necessary to set the AAA authentication login method for SSH to use the ''radius'' server-group, with ''local'' as a backup. This ensures that when an admin attempts to SSH into the switch, the authentication request is first sent to CPPM via RADIUS. If CPPM is unavailable, the switch will fall back to using local authentication12.

Here's why the other options are not correct:

Option B is incorrect because configuring a CPPM username and password on the switch that matches a CPPM admin account is not required for SSH login; rather, the switch needs to be configured to communicate with CPPM for authentication.

Option C is incorrect because while CPPM will send Aruba-Admin-Role Vendor-Specific Attributes (VSAs), the switch does not need to have port-access roles created with the same names; it needs to interpret the VSA to assign the correct role.

Option D is incorrect because disabling SSH on the default VRF and enabling it on the mgmt VRF is not related to the authentication process with CPPM.

Therefore, the correct answer is A, as setting the AAA authentication login method for SSH to the ''radius'' server-group with ''local'' as backup is a key step in ensuring that the switch can authenticate admins through CPPM while providing a fallback method12.

In WPA3-Enterprise, the Pairwise Master Key (PMK) is indeed unique for each session and is derived using a process called Simultaneous Authentication of Equals (SAE). SAE is a new handshake protocol available in WPA3 that provides better security than the Pre-Shared Key (PSK) used in WPA2. This handshake process strengthens user privacy in open networks and provides forward secrecy. The information on SAE and its use in generating a unique PMK can be found in the Wi-Fi Alliance's WPA3 specifications and related technical documentation.

Based on the exhibits which seem to show RADIUS authentication and CoA logs, one can determine that CPPM (ClearPass Policy Manager) initially assigned the client to a role meant for non-profiled devices and then sent a CoA to the network access device (authenticator) once the device was categorized. This is a common workflow in network access control, where a device is first given limited access until it can be properly identified, after which appropriate access policies are applied.