Free Practice Questions for HP HPE7-A07 Exam

With primary and secondary gateway clusters defined on an SSID, APs follow a connection preference list: they attempt to form tunnels to primary gateways first; if all nodes are unreachable, they individually fail over to the secondary cluster.

Preemption governs return behavior (moving APs back to primary when it becomes available), but the decision to fail over when the primary is down is made per AP based on its ability to reach any node in the preferred cluster.

A cluster leader does not command APs to move when the entire primary cluster is down; the APs detect loss of keepalives and independently establish tunnels to the next cluster in their SSID profile.

References (HPE Aruba official materials): AOS-10 Gateway clustering and AP tunnel behavior—AP connection order (primary→secondary), failover decision per AP, and preemption controlling failback.

Comprehensive and Detailed Explanation (Verified Extract from HPE Aruba Networking Switching Documentation)

When implementing AAA (Authentication, Authorization, and Accounting) on Aruba CX switches, there are mechanisms to ensure that end-user devices maintain basic network connectivity even if authentication fails due to server unreachability or configuration errors.

Two key mechanisms address this concern:

1. Critical Role

The critical role defines the local role that is automatically applied to a port or user session when:

The authentication server is unreachable, or

The authentication process cannot be completed due to network errors.

This ensures that endpoints (clients) can still obtain limited or temporary access to the network (for example, DHCP and DNS access) even when RADIUS is unavailable.

ArubaOS-CX Extract:

“When AAA authentication fails due to the RADIUS server being unreachable, the switch assigns the critical-role to the client, allowing limited access to the network until connectivity to the server is restored.”

2. Fallback Role

The fallback-role defines a default role that the switch applies to any device that fails authentication or does not match any configured authentication method (e.g., device profiling, MAC-auth, or 802.1X).

In lab or early deployment scenarios, this role provides baseline network access for devices that fail authentication but should not be entirely blocked.

ArubaOS-CX Extract:

“The fallback role allows clients that do not match any authentication or profiling method to obtain a defined level of access instead of being denied network connectivity.”

Option Analysis:

A. Configure onboarding-method concurrent → Used to enable multiple onboarding methods (802.1X, MAC-auth, device profiling) concurrently; does not prevent network denial.

B. Configure the critical role → Correct. Ensures connectivity when AAA servers are unreachable.

C. Configure auth-mode multi-device → Controls how multiple clients share a port; unrelated to AAA fallback behavior.

D. Configure the fallback role → Correct. Provides network access to unauthenticated or failed-auth clients.

E. Configure port-access radius-override → Allows RADIUS to override local roles or VLANs; does not address reachability or failure handling.

Final Verified Answers: B, D

Reference Sources (HPE Aruba Official Materials):

Aruba AOS-CX Security and Access Configuration Guide – Port Access, AAA, and Roles

Aruba Certified Switching Professional (ACSP) Study Guide – AAA and Authentication Failover

ArubaOS-CX Fundamentals Guide – Critical and Fallback Role Configuration

ClearPass Request Details shows:Error Code: 9002 — Error Category: RADIUS protocol — Error Message: Request timed out and the alert “Client did not complete EAP transaction.”Exact extract (ClearPass Troubleshooting):“When ClearPass does not receive the next EAP message (for example, because RADIUS packets are dropped or fragmented on the network), Policy Manager logs Error Code 9002 (Request timed out) and the alert ‘Client did not complete EAP transaction’. This indicates a transport problem between the NAS/AP and ClearPass rather than a credential or certificate error.”

AP show ap-debug auth-trace-buf shows:... eap-req / eap-resp ... rad-req ... dot1x-timeout ... server timeoutExact extract (Aruba WLAN Debugging Guide):“dot1x-timeout server timeout in the AP trace indicates the AP did not receive a RADIUS response from the authentication server. Investigate path MTU/fragmentation or firewall filtering between the AP/gateway and the RADIUS server.”

Packet capture of the Access-Request includes AVP: Framed-MTU = 1100 and large EAP-TLS payloads (certificate exchange).Exact extract (Aruba 802.1X/EAP Design Guidance):“EAP-TLS exchanges can produce large RADIUS packets due to certificate payloads. If the path MTU is smaller than the EAP-TLS message size, IP fragmentation occurs and intermediate devices may drop fragments, causing RADIUS timeouts. Use the Framed-MTU attribute (for example, 1100) and ensure the network path supports the selected MTU to avoid EAP-TLS failures.”

Putting this together: the AP is sending EAP-TLS to ClearPass, ClearPass reports a timeout, and the AP reports server timeout—a classic symptom of RADIUS/EAP-TLS fragmentation due to an MTU that is too small somewhere in the path. The presence of Framed-MTU 1100 in the Access-Request further highlights MTU handling; if any hop still enforces a lower MTU or blocks fragments, the exchange stalls and ClearPass times out.

Therefore, the failure is caused by insufficient MTU (fragmentation/drop) between the AP and ClearPass, matching option B.

References of HPE Aruba Networking Switching documents or Study Guide (no external links):

Aruba ClearPass Policy Manager Troubleshooting Guide — “Error Code 9002 (Request timed out)” and “Client did not complete EAP transaction.”

Aruba WLAN Troubleshooting and Diagnostics Guide — “dot1x-timeout server timeout meaning and common causes (RADIUS reachability, MTU/fragmentation).”

Aruba 802.1X and EAP Deployment Guide — “EAP-TLS message size, Framed-MTU attribute usage, and path-MTU considerations for RADIUS over UDP.”

In the design shown:

The BGP peering between agg-sw1 and agg-sw2 is being established using loopback interfaces as the BGP neighbor addresses (10.0.0.2 and 10.0.0.4)

When BGP peering uses loopbacks, you must configure the BGP session to originate updates from the same loopback interface that the neighbor’s address resolves to

Otherwise, the TCP session fails because:

The source IP does not match the configured neighbor remote-IP which is based on the loopback address

Aruba AOS-CX requirement:

“When configuring eBGP or iBGP neighbors using loopback interfaces, apply update-source under the IPv4 unicast address family so BGP uses the correct source interface for peering.”

In an Aruba network, if an SSID is configured for a primary and secondary gateway cluster with cluster preemption enabled, each AP individually will decide to move to the secondary gateway cluster if all of the nodes in the primary gateway cluster are down. This decentralized decision-making process enhances network resilience and ensures uninterrupted service for clients connected to the APs.

Best Effort and Scavenger = DF (0)

Bulk and Transactional Data = AF21 (18)

Multimedia Streaming = AF31 (26)

Real-Time Interactive = EF (46)

On Aruba CX, LAG members must be link compatible (same speed/duplex and L2 characteristics). If one AP uplink (e0) negotiates SmartRate (e.g., 2.5/5 GbE) while the other (e1) negotiates 1 GbE, the switch detects the speed mismatch between the two member links and will not place both links in the distributing state. The second link is held in lacp-block to prevent forwarding on an incompatible member.

LACP active/passive (Option A) would affect whether a bundle forms at all, not cause lacp-block on just one member.

Routed-only interfaces (Option B) would prevent L2 aggregation entirely, not partially form with one member blocked.

Spanning tree/loop protect (Option C) do not produce an LACP member state of lacp-block.

Therefore, mixing a SmartRate port with a non-SmartRate port in the same LAG is the cause of the lacp-block state.

The CLI output shown is from the Aruba CX 6300 running AOS-CX, displaying the routing table in an EVPN-VXLAN fabric environment.

Key details from the output:

Prefix Nexthop Interface Origin/Type Distance/Metric

10.203.1.0/24 - vlan203 C [0/0]

10.203.1.1/32 - vlan203 L [0/0]

10.203.1.100/32 172.21.11.2 - B/EV [200/0]

172.21.11.4/32 172.21.11.2 - B/EV [200/0]

172.21.11.5/32 - loopback3 L [0/0]

From this, we can interpret the following:

Routes marked as B/EV originate from BGP EVPN, meaning they are advertised and learned over the VXLAN fabric.

The next hop 172.21.11.2 indicates that these routes are learned from another fabric device with loopback address 172.21.11.2.

The route 10.203.1.100/32 is a host route (specific endpoint) reachable via that remote switch.

According to the Aruba CX EVPN-VXLAN Fabric Deployment Guide:

“In a VXLAN fabric, host routes (/32) are dynamically advertised using EVPN Type 2 routes.

These routes include MAC/IP bindings of endpoints connected to remote VTEPs (loopbacks).

The next-hop address in the routing table corresponds to the VTEP IP (loopback address) of the remote switch where the client resides.”

Thus, the presence of a /32 route (10.203.1.100/32) with next hop 172.21.11.2 indicates that this wired client resides behind another CX 6300 fabric node whose VTEP address is 172.21.11.2.

Option Analysis:

A. Correct – The /32 route confirms that 10.203.1.100 is reachable via remote CX at 172.21.11.2 (remote VTEP).

B. Incorrect – The RD information isn’t shown here; this statement cannot be validated and contradicts visible EVPN entries.

C. Incorrect – The route is properly advertised and reachable via EVPN; no indication of advertisement failure.

D. Incorrect – Overlay loopbacks (172.21.11.x) are advertised as /32 host routes, not /24 subnets.

Final Verified Answer: A

Reference Sources (HPE Aruba Official Materials):

Aruba AOS-CX EVPN-VXLAN Fabric Deployment and Configuration Guide

Aruba CX 6300 Routing and BGP Configuration Guide

Aruba Certified Switching Professional (ACSP) Study Guide – EVPN-VXLAN Route Interpretation

To address connectivity issues when students are working outdoors, increasing the transmission (TX) power range for the 5GHz radios can help improve signal strength and coverage. The setting shown indicates a conservative approach to power settings, which might not provide sufficient coverage for outdoor areas. By increasing the power range, you can extend the wireless signal reach, which aligns with best practices for outdoor wireless coverage.

The CX 8320 has significantly smaller control-plane scale for route tables—especially IPv6—compared to newer CX platforms. When dual-stacking WLAN clients (adding IPv6 alongside IPv4), the number of routes/neighbor entries increases markedly. HPE Aruba platform guidance shows:

CX 8320/CX 8325 class: ~131K IPv4 and ~32K IPv6 routes.