What is another setting that you must configure on the switch to meet these requirements?

To meet the requirements for configuring an ArubaOS-CX switch for integration with ClearPass Policy Manager (CPPM), it is necessary to set the AAA authentication login method for SSH to use the “radius” server-group, with “local” as a backup. This ensures that when an admin attempts to SSH into the switch, the authentication request is first sent to CPPM via RADIUS. If CPPM is unavailable, the switch will fall back to using local authentication12.

Here’s why the other options are not correct:

Option B is incorrect because configuring a CPPM username and password on the switch that matches a CPPM admin account is not required for SSH login; rather, the switch needs to be configured to communicate with CPPM for authentication.

Option C is incorrect because while CPPM will send Aruba-Admin-Role Vendor-Specific Attributes (VSAs), the switch does not need to have port-access roles created with the same names; it needs to interpret the VSA to assign the correct role.

Option D is incorrect because disabling SSH on the default VRF and enabling it on the mgmt VRF is not related to the authentication process with CPPM.

Therefore, the correct answer is A, as setting the AAA authentication login method for SSH to the “radius” server-group with “local” as backup is a key step in ensuring that the switch can authenticate admins through CPPM while providing a fallback method12.