CloudLabBox
Try the free demo

Aruba CX lab 16 of 16

Troubleshooting access security with six planted faults

A rushed rollout left Northwind's 802.1X, MAC authentication and DHCP snooping broken in six places, on the switch and on the RADIUS server. Follow the chain from the client through RADIUS to the role and the policy, and fix each fault as the last one uncovers the next.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 7,168 MB in total. That fits the free demo too.

In your workspace: Shared, then HPE Aruba Networking CX switching guided labs, then 16 - Troubleshooting access security with six planted faults

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
6 vCPU, 7,168 MB
Smallest plan
Lite

The scenario

A contractor finished Northwind's access-security rollout on Friday and left. On Monday the help desk has two tickets:

  1. Alice can't get on the network from PC1. Her password is right: she reset it this morning.
  2. The reception kiosk has no network. It used to show the visitor portal at http://10.30.30.10:8080/.

The design is below, and it's correct. The build isn't. Find every difference and fix it, on the switch or on the server, wherever the fault really is. Several faults hide behind others, so each fix may uncover the next one.

DeviceInterfaceDesign
acc1vlan 10 STAFF · 30 SERVERS · 50 KIOSKS · 99 QUARANTINE10.10.10.1 · 10.30.30.1 · 10.50.50.1 · 10.99.99.1 (all /24)
rad1eth0 (acc1 1/1/3, VLAN 30)10.30.30.10/24. RADIUS, and the portal on TCP 8080
dhcp1eth0 (acc1 1/1/4, VLAN 50)10.50.50.5/24. DHCP server for kiosks
PC1eth0 (acc1 1/1/1)802.1X, user alice, password Alice-Pass1. Role STAFF, VLAN 10, DHCP from acc1
KIOSKeth0 (acc1 1/1/2)MAC authentication. MAC 02:cb:00:00:16:12. Role KIOSK, VLAN 50, DHCP from dhcp1

Design rules:

  • The RADIUS shared key is Rad-Key-2026.
  • Role STAFF sets VLAN 10. Role KIOSK sets VLAN 50, and its policy PA-KIOSK allows the portal on TCP 8080 and a ping to the gateway, and nothing else.
  • DHCP snooping protects VLAN 50, and dhcp1 is the only server on it.

rad1 is this course's small teaching server: the account list is /opt/lab/radius-users.txt, and it's read again for every request, so an edit works at once. Its log is /var/log/lab/radius.log.

What you’ll practise

  • Follow an access-security failure from client to switch to RADIUS and back
  • Tell a wrong shared key from a dead server
  • Recognise role, VLAN and policy failures in the client table and the status views
  • Find a DHCP snooping fault from its counters
  • Decide whether a fault belongs to the switch or the server

The tasks

  1. Work the chain, one link at a time
  2. Fix ticket 1: Alice
  3. Fix ticket 2: the kiosk
  4. Prove the design

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Troubleshooting access security with six planted faults5 nodes, 4 links. Every link is listed as text below the diagram.acc1rad1dhcp1PC1KIOSK1/1/1eth01/1/2eth01/1/3eth01/1/4eth0
5 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • acc1 1/1/1 to PC1 eth0
  • acc1 1/1/2 to KIOSK eth0
  • acc1 1/1/3 to rad1 eth0
  • acc1 1/1/4 to dhcp1 eth0
Nodes in Troubleshooting access security with six planted faults, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
acc1Aruba AOS-CX virtual switcharubacx-10.142 vCPU, 3,072 MB
rad1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
dhcp1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
KIOSKEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HPE Aruba Networking CX switching guided labs.

  3. Open 16 - Troubleshooting access security with six planted faults and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Aruba CX labs

All Aruba CX labs

Related labs in other courses

CloudLabBox is independent of Hewlett Packard Enterprise. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.