This article explains how to enable Access Policy, create Access Policy Security Profiles, and assign them to Policy Groups on Aruba AOS-CX and Aruba AOS-S switches. Onboarding and switch commands are covered in separate articles:
| Topic | Article |
|---|---|
| Onboarding the switches | Onboarding Aruba Switches as Virtual Edge Nodes |
| Switch commands for AOS-CX | Aruba AOS-CX Configuration Commands for Virtual Edge Node (VEN) Onboarding |
| Switch commands for AOS-S | Aruba AOS-S Configuration Commands for Virtual Edge Node (VEN) Onboarding |
Overview
Aruba switches use a source-oriented model: each source Policy Group receives one Access Policy, an ordered Access Policy Security Profile that defines the destinations, services, and actions allowed for devices in that group. Microsegmentation policies and Microsegmentation Security Profiles are not applied to Aruba Virtual Edge Nodes.
Enable Access Policy globally before onboarding an Aruba switch. A Virtual Edge Node onboarded while it is disabled reports a Degraded status, with a Policy Status message in its status details.
How Access Policy Works
A device on an Aruba switch receives its Access Policy through the following flow:
- The Virtual Edge collects device data and flow telemetry from the switch. When a device connects, the switch authenticates its media access control (MAC) address against the Virtual Edge, which acts as the switch's Remote Authentication Dial-In User Service (RADIUS) server. Until the device receives its Policy Group's role, the Virtual Edge answers with
elisity_default_role, which allows the device's traffic. - IdentityGraph enriches the device with the collected data.
- The Dynamic Policy Engine classifies the device into a Policy Group.
- Cloud Control Center sends the Policy Groups and Access Policy Security Profiles to the Virtual Edges, which apply those assigned in the switch's Policy Set.
- The Virtual Edge programs the Policy Group's Access Policy on the switch as a native Aruba user role and policy. After the switch confirms the role is in place, the Virtual Edge sends a Change of Authorization (CoA) that moves the device's session to that role.
- When a device moves to another Policy Group, the Virtual Edge sends a new CoA. When the device no longer belongs to a Policy Group with an Active Access Policy on the switch's Policy Set, the CoA returns it to
elisity_default_role. The Virtual Edge also periodically checks each session's role on the switch, re-sends the CoA when the role has drifted, and rebuilds its session list from the switch after the Virtual Edge restarts.
When Roles Appear on the Switch
A device already classified into a Policy Group that has an Active Access Policy on the switch's Policy Set receives that group's role as soon as it authenticates.
An Access Policy created as Active Policy appears in the switch configuration only after a device that matches the source Policy Group connects to that switch.
Evaluating Rules
Rules are evaluated in order, and traffic that no rule allows is dropped. Before you set an Access Policy to Active, add allow rules for every destination and service the source Policy Group needs.
Checking Roles on the Switch
Each Policy Group appears on the switch as a role named elisity_<number>, where <number> is the Policy Group's numeric ID. On Aruba AOS-S, the name ends with a -v<version> suffix that changes when the rules change.
To check the roles and policies on the switch, use the show commands in Aruba AOS-CX Configuration Commands for Virtual Edge Node (VEN) Onboarding or Aruba AOS-S Configuration Commands for Virtual Edge Node (VEN) Onboarding.
Enabling Access Policy
Access Policy is enabled once for the tenant and then on each Policy Set assigned to an Aruba deployment. Because the Policy Set setting is scoped, Access Policy Virtual Edge Nodes and Virtual Edge Nodes that enforce microsegmentation policies can coexist in the same tenant.
Enabling Access Policy Globally
Step 1. Navigate to Settings > System > Advanced.
Step 2. In the Access Policy Support card, enable Enable Access Policy.
Enabling Access Policy for a Policy Set
Step 1. Navigate to Policy > Policy Sets and edit the Policy Set assigned to the Aruba deployment.
Step 2. In Access Policy Configuration, enable Enable Access Policy Security Controls.
Step 3. Select Save Changes.
To enable Access Policy when you create a Policy Set, use Enable Access Policy in the Access Policy Configuration section of the Create Policy Set panel.
The Policy Set must contain every Policy Group the devices at the site need: a device that matches a global Policy Group missing from the Policy Set gets no Access Policy.
Creating Access Policy Security Profiles
Step 1. Create any static Policy Groups that the rules use as destinations, then navigate to Policy > Security Profiles and select the Access Policy Security Profiles tab.
Step 2. Select Create Security Profile.
Step 3. Enter the Profile Name and Description.
On Aruba AOS-S, Access Policy rules share the switch's rule resources, and smaller models such as the 2530 hold fewer rules, so keep Access Policy Security Profiles compact.
Step 4. In Security Rules, select Add New Rule for each rule and set its fields.
| Field | Value |
|---|---|
| Protocol | ANY, Transmission Control Protocol (TCP), User Datagram Protocol (UDP), or Internet Control Message Protocol (ICMP). |
| Side A Ports | Source port or port range, or ANY. Separate multiple values with commas. |
| Side B Ports | Destination port or port range, or ANY. Separate multiple values with commas, for example 80,443. |
| Static Policy Group / Destination IP | A static Policy Group or an IP prefix. Dynamic Policy Groups are not available. |
| Action | Allow or deny. |
A new Access Policy Security Profile starts with two rules. The first allows Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP), UDP ports 53 and 67-68, to any destination, so devices can obtain a DHCP lease and resolve names; keep it unless devices do both another way. The second is an empty rule that allows all traffic: edit it or delete it, because rules after it never match. Add allow rules for any other infrastructure services the source Policy Group depends on.
Step 5. Drag the rules into evaluation order. The Order column shows the position of each rule.
The rules appear in evaluation order:
Step 6. Select Create.
The Access Policy Security Profile appears in the Access Policy Security Profiles list.
Assigning an Access Policy to a Policy Group
Step 1. Navigate to Policy > Matrix and select the Policy Set in the Policy Set menu.
Step 2. Confirm that All Filters > Layout > Access Policy is enabled (the default). The matrix displays an Access Policy column next to the source Policy Groups.
Step 3. Locate the source Policy Group on Side A and select its Access Policy cell. Cells for static Policy Groups are grayed out.
Step 4. Select Custom Policy.
Step 5. Review the prefilled Policy Name and enter a Description.
Step 6. In Security Profile, select the Access Policy Security Profile. To create one here instead, select Create Security Profile at the end of the list; the new profile is selected automatically.
Step 7. Select Create As, then select Simulated Policy or Active Policy. Simulated Policy evaluates the assignment without programming the Aruba role, so matching devices keep the default allow role. Active Policy programs and enforces the role. On a switch already in service, create the Access Policy as Simulated Policy first.
After creation, select or hover over the Access Policy cell to review the assigned Access Policy Security Profile.
The Assets tab of the source Policy Group, in Policy > Policy Groups, lists the devices classified into it:
To see which Access Policy applies to a device, open IdentityGraph > Devices, select the device, and check the Access Policy row in the Policy Details card; select the Access Policy to review its Access Policy Security Profile. The row appears only when an Access Policy is assigned to the device's Policy Group in the Policy Set for its Site Label.
Activating a Simulated Access Policy
Cloud Control Center does not show traffic results for a Simulated Access Policy. Before you activate it, review its Access Policy Security Profile rules against the traffic the source Policy Group needs.
Step 1. Navigate to Policy > Matrix, select the Policy Set in the Policy Set menu, and select the source Policy Group's Access Policy cell to open the Access Policy details page.
Step 2. Select Activate.
Step 3. In the Activate Policy? dialog, select Activate.
The Access Policy status changes to Active, and the Virtual Edge programs the role and moves matching devices to it.
Managing Access Policy Security Profiles
Editing an Access Policy Security Profile
Editing an Access Policy Security Profile, or changing which profile a Policy Group uses, does not interrupt endpoint traffic.
Disabling Access Policy
Step 1. Delete the Access Policies in the Policy Set.
Step 2. Navigate to Policy > Policy Sets and edit the Policy Set.
Step 3. In Access Policy Configuration, disable Enable Access Policy Security Controls.
Step 4. Select Save Changes.
Step 5. Navigate to Settings > System > Advanced and disable Enable Access Policy.
Enable Access Policy Security Controls cannot be disabled while the Policy Set contains Access Policies. Enable Access Policy cannot be disabled while any Access Policy is configured or any Access Policy Virtual Edge Node is connected.