Reference Guide

14
4 Roles, Authentication and Services
4.1 Roles
The module supports the roles of Crypto Officer, User, and Wireless Client; no additional roles (e.g.,
Maintenance) are supported. Administrative operations carried out by the Aruba Mobility Controller map
to the Crypto Officer role. The Crypto Officer has the ability to configure, manage, and monitor the
module, including the configuration, loading, and zeroization of CSPs.
Defining characteristics of the roles depend on whether the module is configured as a Remote AP mode or
as a Remote Mesh Portal mode.
 Remote AP FIPS mode:
o Crypto Officer role: the Crypto Officer is the Aruba Mobility Controller that has the
ability to configure, manage, and monitor the module, including the configuration,
loading, and zeroization of CSPs.
o User role: in the configuration, the User operator shares the same services and
authentication techniques as the Mobility Controller in the Crypto Officer role.
o Wireless Client role: in Remote AP configuration, a wireless client can create a
connection to the module using WPA2 and access wireless network access/bridging
services. In advanced Remote AP configuration, when Remote AP cannot communicate
with the controller, the wireless client role authenticates to the module via WPA2-PSK
only.
 CPSec AP FIPS mode:
o Crypto Officer role: the Crypto Officer is the Aruba Mobility Controller that has the
ability to configure, manage, and monitor the module, including the configuration,
loading, and zeroization of CSPs.
o User role: in the configuration, the User operator shares the same services and
authentication techniques as the Mobility Controller in the Crypto Officer
o Wireless Client role: in CPSec AP configuration, a wireless client can create a connection
to the module using WPA2 and access wireless network access services.
4.1.1 Crypto Officer Authentication
In each of FIPS approved modes, the Aruba Mobility Controller implements the Crypto Officer role.
Connections between the module and the mobility controller are protected using IPSec. Crypto Officer
authentication is accomplished via either proof of possession of the IKEv1/IKEv2 pre-shared key or
RSA/ECDSA certificate, which occurs during the IKEv1/IKEv2 key exchange.
4.1.2 User Authentication
When the module is configured as a Remote AP FIPS mode and CPSec protected AP FIPS mode, the User
role is authenticated via the same IKEv1/IKEv2 pre-shared key/certificate that is used by the Crypto
Officer.