The command shown in the exhibit is:
Access-1# show ubt state
This command displays the User-Based Tunneling (UBT) status on an Aruba CX switch. UBT allows wired access devices (like CX 6300/6400) to extend tunneled connectivity to Aruba gateways, using GRE tunnels for user traffic.
The output contains the following sections:
1. Local Conductor Server (LCS) State
Primary : 172.16.200.252 ready_for_bootstrap operational_primary
Secondary : 172.16.200.253 ready_for_bootstrap operational_secondary
This confirms that two gateways (IP 172.16.200.252 and 172.16.200.253) form an LCS pair in an Aruba gateway cluster.
Exact extract:
“The Local Conductor Servers (LCS) represent the pair of Aruba Gateways that control and terminate UBT tunnels. One operates as the primary (active) and the other as the secondary (standby). These gateways must be configured as a cluster pair.”
2. Switch Anchor Controller (SAC) State
Active : 172.16.200.252 20:4c:03:81:e7:ca registered
Standby : 172.16.200.253 20:4c:03:b2:12:0a registered
Both gateways are registered as active and standby switch anchor controllers. This is a clear indication that the switch (Access-1) has successfully established tunnels to both gateways within the cluster.
Exact extract:
“The Switch Anchor Controller (SAC) section lists both cluster members to which the switch forms GRE tunnels. The switch maintains active and standby tunnels for redundancy.”
3. User Anchor Controller (UAC) State
Each connected user is mapped to a User Anchor Controller (UAC) — one of the two gateways — depending on cluster load balancing:
User Anchor Controller (UAC): 172.16.200.252
User Anchor Controller (UAC): 172.16.200.253
Each user session is anchored on a specific gateway within the cluster. The presence of two different UAC IPs confirms that users are being distributed across both gateways — a behavior that occurs only in a clustered gateway configuration.
Exact extract:
“In a clustered gateway deployment, each user session is dynamically anchored to one of the gateways. The UAC field shows which gateway currently handles each user session.”
Conclusion:
From the output:
Both are registered as SACs (tunnel endpoints).
Users are distributed across both gateways as UACs.
This confirms that Access-1 (the CX switch) has established GRE tunnels to a pair of gateways within a cluster.
Hence, the correct answer is A. A pair of gateways within a cluster.
Why the Other Options Are Incorrect:
B. A pair of switches running VXLAN:UBT tunnels are GRE-based and terminate on Aruba Gateways, not VXLAN-enabled switches.
“User-Based Tunneling uses GRE tunnels to Aruba Gateways; VXLAN is not used for UBT.”
C. A single gateway within a cluster:The output explicitly shows two controllers (active and standby) registered — not a single one.
D. A pair of standalone gateways:The LCS state shows primary/secondary operational roles, which exist only in a cluster, not standalone gateways.
References of HPE Aruba Networking Switching Documents or Study Guide:
ArubaOS-CX Access Security and UBT Configuration Guide – “Understanding User-Based Tunneling (UBT), LCS, SAC, and UAC roles.”
Aruba Gateway Clustering and Redundancy Guide – “Cluster operation and role distribution for UBT.”
Aruba Campus Wired and Wireless Integration Guide – “How CX switches form UBT tunnels to clustered Aruba gateways.”
Aruba Zero Trust Access Design Guide – “High availability with UBT across gateway clusters.”
