HPE Aruba Networking Hardening Guide: Secure ArubaOS Controllers and ClearPass Policy Manager

HPE Aruba Networking controllers and ClearPass Policy Manager decide who gets onto the network, so a weak management plane on either one hands an attacker the keys to every wireless and wired segment they control. ArubaOS 8 Mobility Conductors and controllers, and AOS-10 gateways, manage access points over the PAPI protocol; ClearPass is the RADIUS and TACACS+ policy engine that authenticates users, devices and administrators, and it holds directory, device and integration credentials. In 2024 HPE published ten ArubaOS vulnerabilities in PAPI, four of them unauthenticated remote code execution rated CVSS 9.8, and in 2025 Aruba Instant On access points were found to ship with hard-coded administrator credentials. This guide covers management access, roles, service accounts and API clients, logging and a hardening baseline for ArubaOS 8 controllers and ClearPass, using HPE's own documentation and ClearPass hardening guide. It is for wireless, NAC and network security engineers. For NAC design itself, see the Network Access Control (NAC) Guide.

Key takeaways

• Block PAPI (UDP 8211) from untrusted networks. HPE's advisory ARUBA-PSA-2024-004 says there is no workaround for most of its ten CVEs other than blocking UDP/8211 from untrusted networks and patching.
• Separate ClearPass management from data. HPE's hardening guide puts the WebUI, CLI and cluster traffic on a dedicated management interface and leaves RADIUS, TACACS+ and web authentication on the data port, where SSH is denied by default.
• Change both ClearPass default credentials. The default Admin username and password, and the appadmin (cluster) password, must both be changed, and every administrator should have an individual account.
• Use centralised admin authentication with least privilege. ArubaOS aaa authentication mgmt and ClearPass admin privilege levels let you authenticate administrators against a directory and give each the narrowest role.
• ClearPass is a credential vault. Directory bind accounts, RADIUS shared secrets, TACACS+ secrets and API clients all live there; inventory and rotate them as non-human identities.

How identity and access work in ArubaOS and ClearPass

Three identity flows meet in an Aruba deployment, and each needs its own controls.

For the user and device flow, the strongest pattern is certificate-based 802.1X (EAP-TLS) with ClearPass as the policy engine; the 802.1X and EAP-TLS Enterprise Wi-Fi Guide covers that design. This page concentrates on protecting the systems that run it.

ArubaOS 8 management authentication

• Local management users: mgmt-user <username> <rolename> creates up to 10 local users. Passwords must be at least six characters; set a stronger management password policy than that minimum.
• Central authentication: aaa authentication mgmt with server-group <group> and enable sends administrator logins to a RADIUS or TACACS+ server group, typically ClearPass. It is disabled by default. default-role sets the role when the server does not return one: use read-only or no-access, never root.
• Local fallback: mgmt-user localauth controls authentication of management users based on the authentication server's results; decide deliberately whether local accounts remain usable when the server is reachable, and keep at least one break-glass local account in a vault.
• Certificates: WebUI administrators can be authenticated by client certificate (mgmt-user webui-cacert, with an optional revocation checkpoint), and SSH users by public key mapped from an X.509 certificate with ssh mgmt-auth public-key and mgmt-user ssh-pubkey client-cert.

Admin roles and privileged access

The aaa authentication mgmt syntax also lists ap-provisioning, nbapi-mgmt and no-access as default-role options. Use max-concurrent-session to cap sessions per user (up to 10) and mgmt-user console-block where physical console access is a risk (save the configuration first, as HPE warns the console is blocked once the serial session logs out).

ClearPass administrators

• Default accounts: change the default Admin username and password, using a username that is not descriptive or easily guessed, and change the appadmin cluster password with Change Cluster Password under Administration > Server Manager > Server Configuration.
• Individual accounts and least privilege: one account per administrator under Administration > Users and Privileges > Admin Users, assigned the matching level from the seven default Admin Privileges, or a custom privilege for Policy Manager and Insight.
• Centralised authentication: authenticate administrators against Active Directory or LDAP and return authorisation data such as group membership through an enforcement policy (HPE's example maps a CP Admin group to Super Admin). Keep the mapped groups small and reviewed.
• Password policy and lockout: set separate Admin and Local user rules under Admin Users > Password Policy (length, complexity, expiry, history) and disable accounts after failed logins.
• Sessions and certificates: set "Allow Concurrent Admin Logins" to FALSE, and consider smart card or certificate-based login, which ClearPass supports for Policy Manager, Guest, Onboard and Insight.

Manage both controller and ClearPass break-glass credentials through your Privileged Access Management Guide process; ClearPass often authenticates administrators for every other network device through TACACS+, which makes its own admin plane one of the most privileged in the estate.

Integrations, API tokens and service accounts

ClearPass and the controllers hold a large set of machine credentials. HPE's guide covers the API privilege; the rest of this list reflects common ClearPass deployments and should be checked against your configuration (own knowledge).

The Instant On case shows the limit of what operators can rotate: CVE-2025-37103 was a hard-coded administrator credential in Instant On access point firmware 3.2.0.1 and earlier, with no workaround other than upgrading to 3.2.1.0 or later. See the HPE Aruba Instant On Hard-Coded Credentials 2025 analysis. For credentials you do control, the Service Account Security Guide covers inventory and rotation.

Vulnerabilities and patching

No HPE Aruba Networking product appeared in the CISA Known Exploited Vulnerabilities catalogue cache checked for this guide on 27 October 2026, but the published advisories are serious enough to treat as emergency patches.

1. Inventory: record every conductor, controller, gateway, ClearPass node and Instant On site with software train and maintenance status. HPE's 2024 advisory notes several branches had reached end of maintenance and remained unpatched.
2. Subscribe: follow HPE Aruba Networking security advisories (published in CSAF) and the KEV feed. See the CISA KEV Catalogue Guide.
3. Stage: upgrade a lab or a pilot controller and a test SSID first; for ClearPass, upgrade a subscriber before the publisher and take a configuration backup.
4. Roll out by cluster: controllers in a cluster can be upgraded in turn to keep APs served; ClearPass cluster upgrades follow HPE's documented order.
5. Roll back: keep the previous image in the alternate partition on controllers (own knowledge) and the ClearPass backup, and confirm 802.1X and guest flows after each step. The Emergency Out-of-Band Patching Playbook covers urgent cases.

Logging and detection

ArubaOS supports logging to external syslog servers and management user audits; ClearPass records administrative changes and authentication events and can export them to syslog targets (own knowledge for the ClearPass menu names: Audit Viewer, Event Viewer, syslog export). Send all of it to the SIEM.

Metrics:

• Percentage of controllers and gateways on a train that fixes ARUBA-PSA-2024-004.
• Number of places where UDP 8211 is reachable from untrusted networks (target: zero).
• Percentage of administrator logins through central authentication rather than local accounts.
• Number of root or Super Admin accounts, reviewed quarterly.
• Percentage of ClearPass integration credentials and RADIUS secrets with an owner and rotation date.

Hardening baseline

ArubaOS controllers and gateways

1. Patch to a maintained release that fixes ARUBA-PSA-2024-004 and every later advisory.
2. Firewall PAPI: block UDP 8211 from untrusted networks and enable CPSec.
3. Central admin authentication: aaa authentication mgmt with a ClearPass server group, a low default-role, and one vaulted local root account.
4. Roles: standard for engineers, network-operations or read-only for monitoring, root only where user management is needed.
5. SSH: public key or certificate authentication with ssh mgmt-auth public-key (omit the username/password option once keys work), and disable ciphers or MACs you do not need, for example ssh disable-mac hmac-sha1-96. Confirm with show ssh.
6. WebUI: HTTPS with a trusted certificate and client certificate authentication where possible; a notice and consent banner.
7. Sessions and audit: concurrent session limits and management user audits enabled.

ClearPass Policy Manager

1. Interfaces: management interface on a dedicated management network; data interface for RADIUS, TACACS+ and web authentication only.
2. Application access control: on each server, under Server Configuration > Network > Application access control, allow only admin networks to Policy Manager, Guest Operator, Insight and Graphite.
3. Accounts: change Admin and appadmin credentials, individual admin accounts, AD or LDAP authentication with group mapping, password policy and lockout.
4. Privileges: least-privilege admin levels, custom privileges where needed, API Administrator for automation.
5. SSH and web: restrict Allowed SSH Modes to a single strong cipher mode (AES-GCM or AES-CTR) under Cluster-Wide Parameters, set Allow Concurrent Admin Logins to FALSE, and test enabling the Content Security Policy parameter, since HPE warns it can break custom skins and captive portals.
6. Cluster traffic: consider IPsec tunnels for management and data interfaces between nodes, which HPE's guide describes under Create IPsec Tunnel.

Small vs large estates: a site with a single controller pair and one ClearPass appliance should prioritise patching, PAPI filtering, changed default credentials and central admin authentication. Large multi-site estates should add a separate management network for ClearPass clusters, custom privileges per team, certificate-based admin login, and automated configuration diffing. For edge devices generally, see the Edge Device Security Guide.

Common misconfigurations

• PAPI reachable beyond the AP network: controllers listening on UDP 8211 on interfaces reachable from user VLANs or the internet.
• ClearPass management on the data port: admin WebUI reachable from every network that sends RADIUS.
• appadmin left at its install value: the cluster password is forgotten because day to day administration uses the WebUI.
• default-role root: any user the RADIUS server accepts becomes a full administrator if the server returns no role.
• Shared RADIUS secrets: one secret across hundreds of switches and controllers, unchanged for years.
• End of maintenance trains: controllers left on branches that HPE no longer patches, as the 2024 advisory listed.

Framework mapping

Practitioner checklist

• Upgrade controllers and gateways past ARUBA-PSA-2024-004 and Instant On APs to 3.2.1.0 or later.
• Block UDP 8211 from untrusted networks and enable CPSec.
• Enable aaa authentication mgmt against ClearPass with a low default role; vault one local root account.
• Assign standard, network-operations and read-only roles instead of root wherever possible.
• Change ClearPass Admin and appadmin credentials; use individual, directory-backed admin accounts with lockout.
• Put ClearPass management on a dedicated network and restrict Application access control to admin hosts.
• Use API Administrator privilege for automation and inventory every API client and integration credential.
• Use unique RADIUS and TACACS+ secrets per device and rotate them on a schedule.
• Forward controller and ClearPass audit logs to the SIEM and alert on local account use and admin changes.

Standards and references

• HPE Aruba Networking: ClearPass Hardening Guide, Locking Down Administrative Access
• HPE Aruba Networking: ArubaOS 8 CLI Reference, mgmt-user
• HPE Aruba Networking: ArubaOS 8 CLI Reference, aaa authentication mgmt
• HPE Aruba Networking: ArubaOS 8 Secure Shell
• HPE Aruba Networking: ARUBA-PSA-2024-004 Controller and Gateway AOS Vulnerabilities
• CISA: Known Exploited Vulnerabilities Catalog
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Network Access Control (NAC) Guide · 802.1X and EAP-TLS Enterprise Wi-Fi Guide · HPE Aruba Instant On Hard-Coded Credentials 2025 · Edge Device Security Guide