32
4 Roles, Authentication and Services
4.1 Roles
The module supports the roles of Crypto Officer, User, and Wireless Client; no additional roles (e.g.,
Maintenance) are supported. Administrative operations carried out by the Aruba Mobility Controller map
to the Crypto Officer role. The Crypto Officer has the ability to configure, manage, and monitor the
module, including the configuration, loading, and zeroization of CSPs.
Defining characteristics of the roles depend on whether the module is configured as a Remote AP mode or
as a Remote Mesh Portal mode.
Remote AP:
o
Crypto Officer Role: the Crypto Officer is the Aruba Mobility Controller that has the
ability to configure, manage, and monitor the module, including the configuration,
loading, and zeroization of CSPs.
o
User role: in the standard configuration, the User operator shares the same services and
authentication techniques as the Mobility Controller in the Crypto Officer role.
o
Wireless Client role: in Remote AP configuration, a wireless client can create a
connection to the module using WPA2 and access wireless network access/bridging
services. In advanced Remote AP configuration, when Remote AP cannot communicate
with the controller, the wireless client role authenticates to the module via WPA2-PSK
only.
CPSec AP:
o
Crypto Officer Role: the Crypto Officer is the Aruba Mobility Controller that has the
ability to configure, manage, and monitor the module, including the configuration,
loading, and zeroization of CSPs.
o
User role: in the standard configuration, the User operator shares the same services and
authentication techniques as the Mobility Controller in the Crypto Officer
o
Wireless Client role: in CPSec AP configuration, a wireless client can create a connection
to the module using WPA2 and access wireless network access services.
Mesh AP (Mesh Point or Remote Mesh Portal configuration):
o
Crypto Officer role: the Crypto Officer role is the Aruba Mobility Controller that has the
ability to configure, manage, and monitor the module, including the configuration,
loading, and zeroization of CSPs.
o
User role: the second (or third, or nth) AP in a given mesh cluster
o
Wireless Client role: in Mesh AP configuration, a wireless client can create a connection
to the module using WPA2 and access wireless network access services.
4.1.1 Crypto Officer Authentication
In each of FIPS approved modes, the Aruba Mobility Controller implements the Crypto Officer role.
Connections between the module and the mobility controller are protected using IPSec. Crypto Officer
authentication is accomplished via either proof of possession of the IKEv1/IKEv2 pre-shared key or RSA
certificate, which occurs during the IKEv1/IKEv2 key exchange.
