In Aruba Central, setting the AP forwarding mode to ‘bridge’ allows client traffic to be switched locally at the AP. If connectivity to Central is lost, APs in this mode can continue to forward traffic for already connected clients based on their last known configuration, providing basic service continuity. Tunnel mode requires a continuous connection to Central for traffic forwarding.

Non-Wi-Fi interference (e.g., from Bluetooth, microwaves, cordless phones) renders specific 2.4 GHz channels unusable. The most effective mitigation is to move clients to the cleaner 5 GHz band. Using DFS (Dynamic Frequency Selection) channels in the 5 GHz band provides more non-overlapping channels that are free from this common interference, offering a more reliable connection.

A captive portal provides the required individual user authentication without a PSK. Setting the forwarding mode to ‘bridge’ allows for local traffic handling, and applying a restrictive firewall role (often called ‘guest’ or similar) is the standard method to enforce isolation, preventing guest users from accessing internal corporate resources.

In high-density areas, the key challenges are managing interference and providing sufficient capacity. A tight, non-overlapping channel plan (1, 6, 11 in 2.4GHz; careful planning in 5GHz) is essential to reduce co-channel interference. Reducing cell size (via lower power) and adding more APs increases overall network capacity by serving fewer clients per AP and allowing for more efficient reuse of channels.

In an 802.1X/EAP framework, the Network Access Device (authenticator, here the Aruba controller) communicates with the authentication server (RADIUS) using a shared secret. If this secret does not match on both devices, the RADIUS server will reject all access requests from the controller, causing authentication to fail even with correct user credentials.

ClientMatch is Aruba’s proprietary technology for intelligent band steering and load balancing. It actively monitors client performance, SNR, and AP load, and can steer clients to the best available AP (5 GHz preferred over 2.4 GHz) or away from congested APs. This happens dynamically to optimize overall network performance and user experience.

For simple, legacy IoT devices, segmentation is the primary security tool. A dedicated SSID with its own VLAN logically separates the IoT traffic. Applying a restrictive user role (via firewall policies) on that VLAN or SSID limits communication to only the specific servers (e.g., medical data gateways) the devices need, effectively containing lateral movement in case of compromise.

In the SD-Branch architecture, the Gateway (which can be a physical or virtual device) is the critical node. It enforces unified security and routing policies defined in Aruba Central, provides secure direct internet access (breakout) at the branch, and can establish IPsec tunnels back to the data center or hub for required traffic, simplifying branch network design and management.

While the controller uses an external RADIUS server for the actual credential validation, it must itself be configured as the ‘Authentication Server’ in the AAA profile. This is the local entity that processes the authentication transaction. The controller acts as the authenticator (network access device) and uses its ‘Authentication Server’ configuration to communicate with the external RADIUS server (the authentication server).

In Aruba Central, setting the AP forwarding mode to ‘bridge’ allows client traffic to be switched locally at the AP. If connectivity to Central is lost, APs in this mode can continue to forward traffic for already connected clients based on their last known configuration, providing basic service continuity. Tunnel mode requires a continuous connection to Central for traffic forwarding.0