Score Higher on Verified HPE7-A07 | Aruba Certified Campus Access Mobility Expert Written Exam Questions with Answers

The show ata endpoint output lists the AP’s AP Tunnel Agent (ATA) state transitions with a given gateway.

Key state/result fields:

CONNECTING ? PROBE_TIMEOUT ? INIT: the AP tries to bring up the IPSec tunnel, health probes to the gateway time out, then the state resets to INIT and retries.

TUN_RECV_TIMEOUT: the AP stops receiving tunnel keepalives/packets from the gateway within the expected interval.

SURVIVING indicates the AP is maintaining service with an already-up tunnel while control connectivity is impaired; it is not the state shown at the end here.

In the log, AP-01 repeatedly cycles through CONNECTING ? PROBE_TIMEOUT ? INIT, with intermittent TUN_RECV_TIMEOUT. This pattern is the documented symptom of the gateway being unreachable or down (no response to probes/keepalives), rather than a Central/orchestrator outage or PMTU problem.

Therefore, the correct conclusion is that the gateway at 192.168.1.92 is offline or not reachable.

A is incorrect: the final/recurring state is not SURVIVING.

C is incorrect: a Central/orchestrator issue would show SURVIVING (existing tunnel continues) rather than repeated probe timeouts to the gateway.

D is incorrect: PMTU issues do not generate recurring PROBE_TIMEOUT/TUN_RECV_TIMEOUT cycles; they appear as ESP/IKE negotiation problems, not persistent probe loss.

The correct Bandwidth Control settings for 1024 Kbps down and 2048 Kbps up for the SSID are shown in Option D. In Option D, the downstream is set at 1024 Kbps and the upstream at 2048 Kbps, both configured per user, which matches the requested configuration. This setup ensures that each user has a guaranteed bandwidth allocation of the specified rates when connected to the SSID, providing a controlled and predictable user experience.

In Aruba AOS-CX, OSPF neighbors that reach EXSTART/EXCHANGE but fail to advance typically indicate a database description (DD) negotiation issue, most commonly caused by an MTU mismatch on the link. The OSPF header carries the interface MTU; if the values do not match, the peer rejects DD packets and the adjacency remains stuck at EXSTART (often shown as EXSTART/DR or EXSTART/BDR).

Aruba’s OSPF guidance states:

“If neighbors remain in EXSTART/EXCHANGE, verify that the Layer-3 MTU matches on both ends of the adjacency. An MTU mismatch causes DD packets to be rejected and prevents the adjacency from reaching FULL.”

Recommended corrective action is to align or remove custom L3 MTU settings on the participating interfaces (or use the mtu-ignore feature where appropriate).

In this scenario, removing the custom Layer-3 MTU configuration so both sides use the same default MTU allows DD packet negotiation to succeed and the adjacency to progress to FULL.