You are helping another engineer troubleshoot a new downloadable user role configuration between your CX...

Downloadable User Roles (DUR) are a key component of Aruba ' s Dynamic Segmentation. Instead of manually defining roles on every switch, the switch downloads the role definition (VLAN, ACLs, QoS) dynamically from Aruba ClearPass via HTTPS .

The HTTPS Connection: When a user authenticates, ClearPass sends a RADIUS attribute containing the role name. The switch then initiates an HTTPS connection to the ClearPass server to fetch the full details of that role.

Certificate Trust: Because this download happens over HTTPS, the AOS-CX switch acts as an HTTPS Client . For the connection to be established, the switch must trust the SSL/TLS certificate presented by ClearPass.

Validation Requirement: If the switch does not have the correct CA Certificate installed, or if the HTTPS client certificate configuration is missing or incorrect, the TLS handshake will fail. The switch will be unable to download the role, and the user will typically be placed in a " denyall " or " initial " role. Therefore, verifying the HTTPS/TLS certificate configuration on the switch is a primary troubleshooting step for DUR.

Why other options are incorrect:

Option B: DUR does not use the REST API of the switch; it uses a standard HTTPS GET request to ClearPass.

Option C: SNMP is for monitoring and is not involved in the real-time delivery of user roles.

Option D: While the user-role name must match, the reason a DUR fails to load is almost always the transport mechanism (RADIUS or HTTPS), not the role name configuration itself.