ClearPass OnConnect is a feature of the ClearPass Policy Manager that allows wired authentication on switches that do not support 802.1X or RADIUS protocols. ClearPass OnConnect uses SNMP to monitor and control the switch ports based on the device profiles and policies defined in ClearPass12. ClearPass OnConnect can provide the following benefits for the customer:

• It can enable wired authentication without requiring any changes to the existing switch infrastructure or the end-user devices. This can save the customer’s budget and time, as well as minimize the network disruption and user impact.
• It can provide visibility and control over the wired devices, such as printers, IoT devices, and laptops, that connect to the network. ClearPass OnConnect can identify the device type, user role, and location, and apply the appropriate access policies based on the customer’s security and compliance requirements. For example, ClearPass OnConnect can allow only authorized devices and users to access certain network resources, or quarantine or block any unknown or non-compliant devices.
• It can integrate with the other components of the Aruba solution, such as the MCs, MMs, APs, AirWave, and ClearPass Guest, to provide a consistent and unified network management and security solution across the wired and wireless networks. For example, ClearPass OnConnect can leverage the device profiles and policies from ClearPass Guest, or share the network health and performance data with AirWave.

Therefore, by explaining this feature, the architect can justify the proposed solution and show how it can meet the customer’s needs and expectations for wired authentication, as well as wireless authentication.

References:

• 1: https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/OnConnect.htm
• 2: https://www.arubanetworks.com/assets/tg/TB_ClearPass_OnConnect.pdf

The Aruba Mobility Master (MM) hardware appliances are designed to manage large-scale networks. The MM-HW-10K model is capable of managing up to 10,000 devices, which would be sufficient for the customer’s requirement of supporting about 1,500 client APs and a maximum of about 20,000 wireless clients1. Two MM-HW-10K appliances would allow for an active and standby deployment, providing redundancy and ensuring network reliability2.

References:

• System Requirements - Aruba
• Mobility Master Hardware Appliance - Aruba

The Aruba SDN Controller is a software component that runs on the Mobility Master (MM) and provides centralized control and management of the network devices and applications that support the SDN services. The SDN Controller communicates with the network devices through the southbound interface (SBI) and exposes the northbound API (NBAPI) for the SDN applications to access the network resources and services1.

One of the SDN applications that can integrate with the Aruba SDN Controller is the Aruba UC and Collaboration Solution, which optimizes the performance and quality of Skype for Business traffic over the wireless network. The Aruba UC and Collaboration Solution consists of three components: the Aruba UC and Collaboration SDN Application, the Aruba UC and Collaboration Dashboard, and the Aruba UC and Collaboration Agent2.

The Aruba UC and Collaboration SDN Application is a software module that runs on the Skype for Business Front End Server and communicates with the Aruba SDN Controller through the NBAPI. The Aruba UC and Collaboration SDN Application monitors the Skype for Business sessions and events, and sends the relevant information to the Aruba SDN Controller, such as the user identity, device type, session type, codec, bandwidth, and quality of service (QoS) requirements2.

The Aruba UC and Collaboration Dashboard is a web-based graphical user interface that provides visibility and analytics of the Skype for Business sessions and events over the wireless network. The Aruba UC and Collaboration Dashboard connects to the Aruba SDN Controller through the NBAPI and displays the information collected by the Aruba UC and Collaboration SDN Application, such as the number of active sessions, session types, session quality, bandwidth consumption, and device distribution2.

The Aruba UC and Collaboration Agent is a software module that runs on the Mobility Controller (MC) and communicates with the Aruba SDN Controller through the SBI. The Aruba UC and Collaboration Agent receives the information from the Aruba UC and Collaboration SDN Application through the Aruba SDN Controller, and applies the appropriate QoS policies and actions on the wireless network, such as prioritizing the Skype for Business traffic, marking the DSCP values, reserving the bandwidth, and adjusting the airtime2.

To support high availability for the SDN services, the Aruba SDN Controller must be deployed in a redundant configuration, with a primary MM and a backup MM. The primary MM runs the active instance of the Aruba SDN Controller, while the backup MM runs the standby instance of the Aruba SDN Controller. The backup MM synchronizes the configuration and state information from the primary MM, and takes over the SDN Controller role in case of a failure or switchover of the primary MM1.

The other options do not provide high availability specifically for the SDN services, although they may provide redundancy for other aspects of the wireless network. A redundant master MC does not run the Aruba SDN Controller, and only provides backup for the master MC role, which is responsible for managing the configuration and licensing of the MCs in the network3. Backup controllers defined on the APs do not run the Aruba SDN Controller, and only provide backup for the local MC role, which is responsible for terminating and managing the APs in the network4. A cluster deployment for MCs does not run the Aruba SDN Controller, and only provides load balancing and fast failover for the APs in the network5.

References: 1: ArubaOS 8.7 User Guide - Aruba, Chapter 42: SDN Controller, pages 1049-1050. 2: Aruba UC and Collaboration Solution Guide - Aruba, Chapter 2: Aruba UC and Collaboration Solution Overview, pages 11-15. 3: ArubaOS 8.7 User Guide - Aruba, Chapter 2: ArubaOS Architecture, pages 25-26. 4: ArubaOS 8.7 User Guide - Aruba, Chapter 3: Configuring Controller Redundancy, pages 39-40. 5: ArubaOS 8.7 User Guide - Aruba, Chapter 4: Configuring Controller Clustering, pages 51-52.

The maximum bandwidth possible between the aggregation and core layers using 8 strands of OM4 Multi-Mode fiber can be up to 200 Gbps1. This is because each strand of OM4 fiber can support up to 25 Gbps of bandwidth, and with 8 strands, the total bandwidth can reach up to 200 Gbps1. However, the actual bandwidth can be influenced by various factors such as the quality of the fiber, the type of transceivers used, and the distance between the aggregation and core layers1.

References:

• What is IP and Ethernet aggregation? - Ciena
• Aruba 5400R zl2 Switch Series Data Sheet
• Aruba 5400R zl2 Switch Series Installation and Getting Started Guide
• ArubaOS-Switch and ArubaOS-CX Transceiver Guide

The Aruba 7210 Mobility Controller is designed to support up to 512 APs and 16,384 simultaneous users. In contrast, the 7205 Mobility Controller supports up to 256 APs and 8,192 simultaneous users. Therefore, for a very high density (VHD) design with 128 APs supporting 12,800 devices, the 7210 controllers would be a better fit due to their higher capacity for APs and simultaneous users.

References:

• Designing Aruba Solutions, Rev. 20.11, Module 4: Aruba Mobility Controller Design, page 4-16
• 7200 Series Controller Data Sheet, page 1

In the event of an MM outage, MCs continue to use their existing licenses for 30 days, and the network remains up. However, you cannot change the configuration items in the controller network. In addition, the MM manages many of the higher level functions that can cause issues in the network if the MM fails. Aruba recommends a backup MM for these situations. From an economic point of view, a backup MM for a VMM is free. If a customer has a hardware MM, the customer must purchase a backup hardware MM.

https://www.arubanetworks.com/techdocs/ArubaOS_86_Web_Help/Content/arubaos-solutions/vrrp/conf-stby-mm-l3red.htm

References:

• 4: https://blog.router-switch.com/2020/11/data-center-design-basic-3-layers-core-aggregation-and-access/
• 1: https://community.cisco.com/t5/data-center-and-cloud-knowledge-base/datacenter-core-and-aggregation-design/ta-p/3135946
• 2: https://www.oreilly.com/library/view/ccna-data-center/9780133860429/ch01lev3sec2.html
• 3: https://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Content/ArubaFrameStyles/VLANs/Extending_VLANs.htm