Aruba Wireless

---
name: aruba-wireless
description: "Expert coverage of HPE Aruba Networking wireless across all AOS versions: AOS 10 cloud-managed architecture, Aruba Central, AirMatch RF optimization, ClearPass NAC, dynamic segmentation, AP families, and gateway deployment. Use for \"Aruba wireless\", \"AOS 10\", \"Aruba Central\", \"ClearPass\", \"AirMatch\", \"dynamic segmentation\", \"Aruba AP\", \"AP 730\", \"tunneled node\", \"Aruba gateway\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `wireless` skill."
license: MIT
---

# Aruba Wireless

This skill covers HPE Aruba Networking wireless platforms across all AOS versions, with primary focus on AOS 10 (cloud-managed via Aruba Central). Areas of expertise include:

- AOS 10 cloud-first architecture and Aruba Central management
- AOS 8 on-premises Mobility Controller architecture (legacy/migration context)
- AP families: AP 3xx (Wi-Fi 6), AP 5xx (Wi-Fi 6/6E), AP 730 (Wi-Fi 7)
- AirMatch AI-driven RF optimization
- ClearPass integration (authentication, profiling, posture, guest, BYOD)
- Dynamic segmentation and role-based policy enforcement
- Gateway deployment (SD-WAN, ZTNA, stateful firewall)
- Tunneled node for wired edge security
- Aruba Central APIs and pycentral SDK

When a question is version-specific, consult the matching `references/versions/` file. When the version is unknown, provide general guidance and note where AOS 10 vs AOS 8 behavior differs.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Identify whether the issue is AP-level, Central-level, ClearPass, or gateway. Use Aruba Central monitoring and AP CLI.
   - **Design / Deployment** -- Load `references/best-practices.md` for SSID design, segmentation, Central management, ClearPass integration
   - **Architecture** -- Load `references/architecture.md` for AOS 10 components, AP families, AirMatch, ClearPass, dynamic segmentation
   - **Migration** -- Identify source (AOS 8, Cisco, Mist) and map feature gaps to AOS 10

2. **Identify AOS version** -- AOS 10 (cloud-managed) vs AOS 8 (on-prem controller). The architecture is fundamentally different. If unclear, ask.

3. **Load context** -- Read the relevant reference file for deep knowledge.

4. **Analyze** -- Apply Aruba-specific reasoning. Consider Central cloud requirements, ClearPass dependencies, and gateway vs AP-only trade-offs.

5. **Recommend** -- Provide actionable guidance with Central UI paths, AP CLI, or API examples.

6. **Verify** -- Suggest validation steps (Central dashboard monitoring, AP CLI diagnostics, ClearPass authentication logs).

## AOS 10 Architecture

### Cloud-First Design
AOS 10 shifts the control plane to Aruba Central (HPE GreenLake):
- **No on-premises controller required** for basic wireless operation
- APs run AOS 10 firmware and manage client data forwarding locally
- Central provides: provisioning, monitoring, firmware management, RF optimization (AirMatch), alerting
- APs maintain local client state; continue forwarding during cloud connectivity loss

### Key Components

| Component | Role |
|---|---|
| Aruba Central | Cloud management plane; provisions APs, gateways, switches |
| AOS 10 AP | Access point running AOS 10; local data forwarding; cloud-managed |
| Aruba Gateway | On-premises gateway for SD-WAN, ZTNA, stateful firewall, DPI |
| ClearPass | NAC server for authentication, authorization, profiling, posture |
| AirMatch | Cloud-based AI RF optimization engine |

### AOS 10 Deployment Options

**AP Only (no gateway):**
- Simple deployments; APs bridge traffic directly to local VLANs
- Limited security features (no stateful firewall, no DPI)
- Guest isolation via AP-level VLAN segmentation
- Suitable for: small offices, retail locations with basic security needs

**AP + Gateway:**
- Full enterprise deployment; gateway provides SD-WAN, ZTNA, stateful firewall, DPI
- Gateway terminates AP tunnels for policy enforcement
- ClearPass integration for role-based access
- Suitable for: enterprise campus, branch offices needing security enforcement

**Micro-Branch (AP with embedded gateway):**
- Single AP serves as both AP and gateway for small sites
- Performs gateway functions (firewall, SD-WAN) locally on the AP
- Suitable for: remote offices, kiosks, small retail with 1-3 APs

### AOS 10 vs AOS 8

| Feature | AOS 10 | AOS 8 |
|---|---|---|
| Management | Aruba Central (cloud) | On-prem Mobility Controller |
| Control plane | Cloud-based | MC-based (on-premises) |
| Data plane | Local at AP or Gateway | Tunnel to MC (centralized default) |
| SD-WAN | Integrated into Gateway | Separate SD-WAN license |
| Licensing | Subscription via Central | Per-feature perpetual licenses |
| RF management | AirMatch (cloud) | ARM (on-prem) |
| Scale | Central manages thousands | Per-MC limits (depends on model) |

## AP Families

| Series | Wi-Fi Standard | Bands | Notes |
|---|---|---|---|
| AP 3xx (305, 315, 345) | Wi-Fi 6 | 2.4/5 GHz | Value tier; small-medium office |
| AP 5xx (515, 535, 555, 575) | Wi-Fi 6 / 6E | 2.4/5/6 GHz (6E models) | Enterprise indoor; 802.11ax |
| AP 6xx (635, 655) | Wi-Fi 6E outdoor | 2.4/5/6 GHz | Outdoor/ruggedized |
| AP 730 | Wi-Fi 7 (802.11be) | 2.4/5/6 GHz | Flagship; MLO support |

### AP Power Requirements
- Wi-Fi 6 APs: 802.3at (PoE+) sufficient
- Wi-Fi 6E APs: 802.3bt (PoE++) recommended for full tri-band operation
- Wi-Fi 7 AP 730: 802.3bt (PoE++) required for full Wi-Fi 7 features
- Without adequate PoE: AP may disable one radio (typically 6 GHz) to stay within power budget

## AirMatch

AirMatch is Aruba's cloud-based AI RF optimization engine:
- Runs in Aruba Central; analyzes RF environment across all sites globally
- Computes globally optimal channel and power assignments considering all APs in the network
- Pushes optimized plan to APs once per day during off-peak hours to minimize disruption
- Manages 5 GHz and 6 GHz independently (2.4 GHz uses simpler ARM algorithm)
- More holistic than traditional RRM: optimizes across entire network, not just local neighbors
- AirMatch improvements are continuous via cloud ML model updates

### AirMatch vs Cisco RRM
- RRM: Real-time, event-driven changes (reacts to interference immediately)
- AirMatch: Periodic global optimization (computes ideal state, applies during maintenance window)
- AirMatch avoids RF churn from constant adjustments; RRM can react faster to sudden interference
- Both approaches have trade-offs; AirMatch is considered more stable for large deployments

## ClearPass Integration

ClearPass is central to Aruba enterprise wireless security:

### Authentication Methods
- **802.1X**: EAP-TLS, PEAP, EAP-TTLS via ClearPass as RADIUS server
- **MAC Authentication Bypass (MAB)**: For IoT/headless devices
- **Guest portal**: Self-registration, sponsor approval, social login, usage policies
- **OnBoard**: Automated BYOD certificate provisioning and enrollment
- **Captive portal**: Browser-based authentication redirect

### Authorization
ClearPass returns RADIUS attributes to Aruba gateway/AP:
- **User role**: Maps to firewall policy on gateway
- **VLAN**: Dynamic VLAN assignment based on user/device identity
- **Bandwidth limit**: Per-user rate limiting
- **ACL**: Named ACL applied at gateway or AP

### Profiling
ClearPass identifies device types automatically:
- DHCP fingerprinting, MAC OUI, HTTP User-Agent, SNMP, Onboarding attributes
- Profiles feed into authorization policy (e.g., "if device is IP camera, assign IoT role")
- Profiling accuracy improves over time with more data sources

### Posture Assessment
- Checks endpoint health (antivirus status, OS patch level, disk encryption)
- Requires ClearPass OnGuard agent or FortiClient integration on endpoints
- Non-compliant devices can be quarantined to a remediation VLAN

## Dynamic Segmentation

Dynamic segmentation ensures consistent policy regardless of connection method:
- User connects (wired or wireless)
- ClearPass assigns a role based on identity, device type, and posture
- Role maps to a firewall policy on the Aruba Gateway
- Policy follows the user across wired/wireless, across APs, across sites
- No VLAN-based segmentation needed -- policy is identity-based

### Tunneled Node (Wired Extension)
Extends dynamic segmentation to wired switch ports:
- Wired switch ports configured as "tunneled nodes"
- Traffic from wired clients tunneled (GRE) to Aruba Gateway for policy enforcement
- Same ClearPass-driven role/policy as wireless clients
- Enables consistent ZTNA and firewall policies for wired devices

## Aruba Central APIs

Aruba Central provides REST APIs for automation:
```
GET  /monitoring/v2/aps              # AP inventory and status
GET  /monitoring/v2/clients          # Connected client details
POST /configuration/v1/devices       # Push configuration to devices
GET  /analytics/v2/rogue_aps         # Rogue AP detection data
GET  /monitoring/v2/networks         # Network health metrics
```

**pycentral**: Official Python SDK for Aruba Central API automation. Handles OAuth2 token management, pagination, and error handling.

## Common Pitfalls

1. **Deploying AP-only without understanding security limitations** -- AP-only mode (no gateway) lacks stateful firewall, DPI, and ZTNA. If security policies require traffic inspection, a gateway is essential.

2. **AOS 8 to AOS 10 migration assumptions** -- AOS 10 is not an upgrade from AOS 8; it is a different architecture. APs must be re-provisioned. Configuration does not migrate 1:1. Plan as a greenfield deployment.

3. **ClearPass version compatibility** -- Ensure ClearPass version supports AOS 10 features (dynamic segmentation roles, enhanced RADIUS attributes). Check compatibility matrix before upgrading either component.

4. **AirMatch overrides** -- Manually pinning channels/power on some APs while AirMatch manages others creates suboptimal RF. Either commit to AirMatch or manage RF manually across the site.

5. **Ignoring gateway capacity** -- Aruba Gateways have throughput limits for firewall/DPI. Size gateways for actual traffic volume, not just AP count. Undersized gateways create bottlenecks.

6. **6 GHz without WPA3** -- 6 GHz SSIDs require WPA3. ClearPass and RADIUS infrastructure must support WPA3 authentication methods (SAE, 802.1X with PMF).

7. **Cloud dependency planning** -- While APs continue forwarding during Central outage, new client authentication, configuration changes, and monitoring stop. Plan for graceful degradation.

8. **Tunneled node switch compatibility** -- Not all Aruba switch models support tunneled node configuration. Verify switch firmware and model support before designing wired segmentation.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 10.7 | `references/versions/10.7.md` | AOS 10.7 specific features, enhancements, migration guidance |

## Reference Files

Load these when you need deep knowledge:
- `references/architecture.md` -- AOS 10 architecture, Aruba Central, AP families, AirMatch, ClearPass, dynamic segmentation, gateway deployment. Read for "how does X work" architecture questions.
- `references/best-practices.md` -- SSID design, segmentation strategy, Central management, ClearPass integration patterns, RF tuning, upgrade procedures. Read for design and operations questions.