In a remote-office rollout with VLANs 100 (mgmt), 200 (clients), and 300 (guests), which port-access configuration correctly enables AP onboarding?

In a remote-office rollout with VLANs 100 (mgmt), 200 (clients), and 300 (guests), which port-access configuration correctly enables AP onboarding?

• A. port-access lldp-group IAP-Group seq 10 match sys-desc AP-515 seq 20 match sys-desc AP-575 port-access role IAP-Role description ARUBA AP poe-priority high trust-mode dscp vlan trunk native 100 vlan trunk allowed 100,200,300 enable port-access device-profile IAP-profile associate role IAP-Role associate lldp-group IAP-Group
• B. port-access ilap-group IAP-Group seq 10 match sys-desc 515 seq 20 match sys-desc 575 role IAP-Role description ARUBA AP poe-priority high trust-mode ascp vlan trunk native vlan trunk allowed 100,200,300 port-access device-profile IAP-Profile enable associate role IAP-Role associate lldp-group IAP-Group
• C. port-access Ilap-group IAP-Group seq 10 match sys-desc 515 seq 20 match sys-desc 575 port-access role IAP-role description ARUBA AP poe-priority high trust-mode dscp vlan trunk native 100 vlan trunk allowed 200,300 port-access device-profile IAP-Profile enable associate role IAP-Role associate Ildp-group IAP-Group
• D. port-access Ildp-group IAP-Group seq 10 match sys-desc 515 seq 20 match sys-desc 575 port-access role IAP-ROE description ARUBA AP poe-priority high trust-mode dscp vian trunk native 100 vlan trunk allowed 100,200,300 port-access device-profile IAP-Profile enable associate role IAP_Role associate Ildp-group IAP-Group

Answer: (C)

The essential idea is to use port-access to automatically onboard Aruba APs by recognizing their model (via LLDP/system description), assign them to an onboarding group and role, and place them on the correct VLANs for management and data traffic. For remote-office AP onboarding, the port must be a trunk carrying the management VLAN as native and allowing the client and guest VLANs to be tagged, so the AP can obtain its management IP on the native VLAN and carry user traffic on the other VLANs. In the correct configuration, AP models AP-515 and AP-575 are identified by their system descriptions, and the port is configured to trust DSCP marks for QoS, with the native VLAN set to 100 for management. Only the data VLANs are allowed on the trunk (200 and 300), so client and guest traffic can be tagged while management remains untagged on VLAN 100. The port-access policy ties the port to the IAP onboarding group and the IAP role, and the device-profile ensures the AP receives the proper onboarding behavior. The other options fail because they either misconfigure the native VLAN or the trunk’s allowed VLANs (for example, listing the native VLAN among the allowed VLANs, or leaving the native VLAN unspecified), use the wrong trust method, or contain typos and inconsistent names for groups, roles, or LLDP associations.

The essential idea is to use port-access to automatically onboard Aruba APs by recognizing their model (via LLDP/system description), assign them to an onboarding group and role, and place them on the correct VLANs for management and data traffic. For remote-office AP onboarding, the port must be a trunk carrying the management VLAN as native and allowing the client and guest VLANs to be tagged, so the AP can obtain its management IP on the native VLAN and carry user traffic on the other VLANs.

In the correct configuration, AP models AP-515 and AP-575 are identified by their system descriptions, and the port is configured to trust DSCP marks for QoS, with the native VLAN set to 100 for management. Only the data VLANs are allowed on the trunk (200 and 300), so client and guest traffic can be tagged while management remains untagged on VLAN 100. The port-access policy ties the port to the IAP onboarding group and the IAP role, and the device-profile ensures the AP receives the proper onboarding behavior.

The other options fail because they either misconfigure the native VLAN or the trunk’s allowed VLANs (for example, listing the native VLAN among the allowed VLANs, or leaving the native VLAN unspecified), use the wrong trust method, or contain typos and inconsistent names for groups, roles, or LLDP associations.