Refer to the exhibit:

A customer has just configured a Posture Policy and the T2-Healthcheck Service. Next they installed the OnGuard Agent on Secure_Employee SSID. When they check Access Tracker they see many WEBAUTH requests are being triggered.
What could be the reason?

• A.TCP port 6658 is not allowed between the client and the ClearPass server
• B.The OnGuard Agent is connecting to the Data Port interface on ClearPass
• C.OnGuard Web-Based Health Check interval has been wrongly configured to three minutes.
• D.The OnGuard Agent trigger the events based on changing the Health Status

Comment: *

Name: *

Email: *

Verification: *

You are deploying ClearPass Policy Manager with Guest functionality for a customer withmultiple Aruba Networks Mobility Controllers The customer wants to avoid SSL errors during guest access but due to company security policy cannot use a wildcard certificate on ClearPass or the Controllers.
What is the most efficient way to configure the customers guest solution? (Select two.)

• A.Install the same public certificate on all Controllers with the common name "controller {company domain}"
• B.Build one Web Login page with vendor settings for controller {company domain)
• C.Build multiple Web Login pages with vendor settings configured for each controller
• D.Install multiple public certificates with a different Common Name on each controller

Comment: *

Name: *

Email: *

Verification: *

Refer to the Exhibit:


A customer wants to integrate posture validationinto an Aruba Wireless 802.1X authentication service During testing, the client connects to the Aruba Employee Secure SSID and is redirected to the Captive Portal page where the user can download the OnGuard Agent After the Agent is installed, the client receives the Healthy token the client remains connected to the Captive Portal page ClearPass is assigning the endpoint the following roles: T2-Staff-User. (Machine Authenticated! and T2-SOL-Device.
What could cause this behavior?

• A.Used Cached Results: has not been enabled In the Aruba 802.1X Wireless Service
• B.The Enforcement Policy conditions for rule 1 are not configured correctly.
• C.RFC-3576 Is not configured correctly on the Aruba Controller and does not update the role.
• D.The Enforcement Profile should bounce the connection instead of a Terminate session

Comment: *

Name: *

Email: *

Verification: *

Refer to the exhibit:


You configuring an 802 1x service endpoint profiling. When the client connects to the network, ClearPass successfully profiles the client and sends Radius Change of Authorization (RCoA) but Radius Change of Authorization {RCoA) fails for the client You manually clicked on the Change Status button in the access tracker to force an RCoA but that failed too.
What must you check to ensure that the RCoA will work? (Select two.)

• A.The RFC 3576 shared secret on ClearPass should match the Authentication Server shared secret
• B.RFC 3576 server IPs and the Authentication server IPs should be same in the AAA profile
• C.RFC 3576 option is enabled for Aruba Controller under Network devicein ClearPass.
• D.RFC 3576 server should be mapped in the server group on the Aruba Controller

Comment: *

Name: *

Email: *

Verification: *

A customer has a ClearPass cluster deployment with four servers, two servers at the data center and two servers at a large remote site connected over an SD-WAN solution The customer would like to implement OnGuard, Guest Self-Registration, and 802.1x authentication across their entire environment. During testing the customer is complaining that users connecting to an Instant Cluster Employee SSID at the remote site, with the OnGuard Persistent Agent installed are randomly getting their health check missed.
What could be a possible cause of this behavior?

• A.The ClearPass Policy Manager zones have been defined but the local IP sub-nets have not been property mapped to the zones and the OnGuard Agent might connect to any of the servers in the cluster.
• B.The traffic on the TCP port 6658 is congested due to the fact that this port is also used by the IPsec keep-alive packets of the SD-WAN solution.
• C.The OnGuard Clients are automatically mapped to the Policy Manager Zone based on their IP range but an ACL on the switch could be blocking access.
• D.The Aruba-user-role received by the IAP is filtering the TCP port 6658 to the ClearPass servers and after 10 seconds the SSL fallback gets activated and randomly generates the issue.

Comment: *

Name: *

Email: *

Verification: *