How It Works - HP Aruba JL253A Management And Configuration Manual

Apply Intial Role

How it works

The functionality of User-Based Tunneling starts with the tunneled-node server information being discovered on
the Aruba switch. User-Based Tunneling module exchanges information with the tunneled-node server to
determine its reachability and discover the version details. Once the reachability is confirmed, the user-based
tunneling module in the Aruba switch sends a bootstrap message to the tunneled-node server, which replies with
an acknowledge message.
Creating a Tunnel
A GRE heartbeat is initiated between the Aruba switch and the managed device creating a tunnel. A GRE
heartbeat is exchanged with the managed device, which is the switch anchor controller (SAC). This is the
controller-IP in the tunneled-nodeserver command. A secondary heartbeat is also established with the
standby managed device and acts as a secondary switch anchor controller (s-SAC).
Authenticating the User
As a user connects to a secure port, the Aruba switch sends a request to the RADIUS server (in this case,
ClearPass), which authenticates the user and returns a user role attribute to the Aruba switch. Once the attribute
containing information on which user role the user will be placed in is received by the Aruba switch, the user role
that is configured locally on the Aruba switch or downloaded from the ClearPass.
Aruba User Role
A user role can contain policy, captive portal, and VLAN information. When the user role that is returned from the
RADIUS server is applied to the user, the tunneled-node-server-redirect command to redirect traffic to a
managed device can be included within the user role. When this command is executed and the user-based
tunneling feature status is up, the authentication sub system notifies the user-based tunnel node module,
providing a secondary role. The secondary role is the user role on the managed device where policy generally
exists for tunneled users. This is where the firewall and security will be applied. This secondary-role information is
Chapter 18 Dynamic Segmentation
User Connects
Authenticate User
User
No Yes
Authenticated?
Yes
Apply User Role
Apply Secondary
Role to Controller
Traffic
Switch Traffic
to Destination
Specify Secondary
Role
Redirect No
Traffic to
Controller
Switch
Traffic Locally
621