HPE7-A07 Exam Dumps : Aruba Certified Campus Access Mobility Expert Written Exam

In the design shown:

The BGP peering between agg-sw1 and agg-sw2 is being established using loopback interfaces as the BGP neighbor addresses (10.0.0.2 and 10.0.0.4)

When BGP peering uses loopbacks, you must configure the BGP session to originate updates from the same loopback interface that the neighbor’s address resolves to

Otherwise, the TCP session fails because:

The source IP does not match the configured neighbor remote-IP which is based on the loopback address

Aruba AOS-CX requirement:

“When configuring eBGP or iBGP neighbors using loopback interfaces, apply update-source under the IPv4 unicast address family so BGP uses the correct source interface for peering.”

In Aruba CX 6300 and other AOS-CX switches, device profiling enables automatic assignment of roles and policies to endpoints based on device attributes such as MAC OUI, LLDP, or DHCP fingerprint — without requiring an external authentication server such as ClearPass or RADIUS.

The configuration snippet shows:

mac-group iot

seq 10 match mac-oui 81:cd:93

port-access device-profile iot-prod

enable

associate role iot-prod

associate mac-group iot

This means that any device with a MAC address matching the OUI 81:cd:93 will automatically be assigned the iot-prod device profile and its associated role (iot-prod).

However, the requirement also specifies that any other device connected to the same interface (that does not match the OUI or device profile) should still be assigned a default role called iot-default.

To ensure that endpoints not matching any known device profile still receive limited network access, Aruba AOS-CX uses the fallback-role feature under port-access configuration.

The command:

port-access fallback-role iot-default

defines the role that will be automatically assigned to endpoints that fail to match any of the configured device-profile conditions.

This mechanism is crucial in lab or standalone environments where no external authentication (e.g., RADIUS, ClearPass) is configured. It ensures devices are still given a default policy, preventing them from being left in an unauthenticated or blocked state.

Official HPE Aruba Extract (ArubaOS-CX Security and Access Guide):

“The fallback-role command allows the switch to assign a predefined local role to a device when no authentication server is available, or when the device does not match any configured device profile.”

“This command is typically used in test or lab environments where profiling is local to the switch, and a baseline role must still be enforced for unknown devices.”

Therefore, in this case:

Devices matching the MAC OUI 81:cd:93 → assigned iot-prod role

All other devices → automatically assigned iot-default role via port-access fallback-role iot-default

Option Analysis:

A. Incorrect – The port-access onboarding-method precedence command changes the priority order between authentication methods (e.g., 802.1X, MAC-auth, device profile). It does not control fallback behavior.

B. Incorrect – The block-until-profile-applied option delays port activation until profiling completes, but it doesn’t provide a fallback role.

C. Correct – The port-access fallback-role iot-default command ensures that any device not matching the iot-prod profile receives the iot-default role.

D. Incorrect – Lowering precedence has no effect on assigning a default role.

Final Verified Answer: C

Reference Sources (HPE Aruba Official Materials):

Aruba AOS-CX Security and Access Configuration Guide – Device Profiling and Role Assignment

Aruba Certified Switching Professional (ACSP) Study Guide – Port Access and Device Profiling

ArubaOS-CX Fundamentals Guide – Port Access and Fallback Role Implementation

In a packet capture from an upstream switch port mirror, you would see the VLAN assignment. The port mirror captures the traffic as it is on the network, including any VLAN tags. GRE or IPsec tunnels encapsulate the original packet, including VLAN tags, but the VLAN information is not visible within the encapsulation headers.