Switch Security Features Flashcards

Which ArubaOS-CX feature limits the number of MAC addresses learned on a port to prevent MAC flooding attacks?

Answer: Port security

Port security restricts the number of MAC addresses allowed on a switch port, mitigating MAC flooding attacks that overflow the CAM table.

On an ArubaOS-CX switch, what action does port security take by default when a violation is detected?

Answer: Shutdown the port

The default port security violation action is to shut down the port (err-disable state), requiring manual intervention to restore connectivity.

What is the primary purpose of 802.1X port-based authentication on ArubaOS-CX switches?

Answer: Authenticate devices before granting network access

802.1X enforces authentication via EAP between a supplicant, authenticator (switch), and authentication server before allowing network access.

In an ArubaOS-CX 802.1X deployment, which role does the switch play?

Answer: Authenticator

The switch acts as the authenticator, relaying EAP messages between the supplicant (client device) and the RADIUS authentication server.

Which ArubaOS-CX feature assigns a VLAN dynamically based on RADIUS-returned attributes after 802.1X authentication?

Answer: Dynamic VLAN assignment

Dynamic VLAN assignment uses RADIUS attributes (Tunnel-Type, Tunnel-Medium-Type, Tunnel-Private-Group-ID) to place authenticated clients into the correct VLAN.

What does the 'auth-mode' setting 'multi-auth' allow in ArubaOS-CX 802.1X configurations?

Answer: Multiple devices to authenticate independently on the same port

Multi-auth mode allows each device connected through a hub or unmanaged switch to authenticate independently, each receiving its own VLAN assignment.

Which command enables 802.1X globally on an ArubaOS-CX switch?

Answer: aaa authentication port-access dot1x authenticator

The 'aaa authentication port-access dot1x authenticator' command enables 802.1X authentication globally in ArubaOS-CX.