HP HPE6-A90 HPE Networking Central Exam Exam Practice Test

Technical explanation

A guest role must implement explicit deny rules against internal RFC1918 ranges and sensitive management subnets, followed by permitted DNS, DHCP, captive portal and internet services as appropriate. Confirm the enforcement point: it may be an AP, a gateway, or a switch depending on the forwarding model. Segmentation by VLAN or VRF adds isolation, but a separate VRF is not universally mandatory when a correctly ordered stateful policy blocks east-west access. Test both DNS resolution and attempts to reach internal hosts. For validation, associate a guest device, obtain its assigned role and subnet, then test access to the internet and to an internal host on each protected network. A successful web redirect alone does not demonstrate isolation.

A mixed forwarding SSID is a traffic-location choice, not an authorization policy; bridging employees or tunneling guests does not itself deny private destinations. A distinct VRF can strengthen segmentation but is not inherently required for internet-only guest access.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Check RADIUS server reachability and latency from the actual authenticator, which could be an AP or gateway depending on SSID forwarding and AAA design. Confirm server address, shared-secret or certificate relationship, firewall path, configured authentication ports and load. A timeout means a response did not arrive in the allotted window; an invalid credential should usually produce a recorded reject instead. Client VLAN and DNS may affect later stages of access, but they are not the first hypotheses for a backend EAP response timeout.

DNS misconfiguration causes resolution failures but is not the usual first explanation of RADIUS/EAP timeout. VLAN assignment normally happens at or after authorization; it cannot explain why the authentication backend never answers. Confirm latency, UDP reachability and server health.

Official HPE references | Troubleshooting Tools • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

BPDU Guard is appropriate on edge interfaces that should never receive spanning-tree bridge protocol data units. If somebody connects a downstream switch or another bridge that sends a BPDU, the guard transitions the port to a protected state, limiting a potential topology disturbance. It does not detect every possible loop between ordinary ports when no BPDU is emitted; loop protection or storm control may also be required. Do not enable edge BPDU Guard on legitimate switch-to-switch uplinks.

BPDU Filter suppresses information STP needs, potentially hiding a loop. Root Guard protects bridge-root selection on specified ports, not arbitrary edge patching. BPDU Guard disables an unexpected bridge-facing edge port when a BPDU appears.

Official HPE references | Creating a Port Profile for Switches • Step 3—Configuring VLANs and Port Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

During a live upgrade, devices download the firmware before carefully sequenced reboot groups reduce the simultaneous coverage loss. Conduct a compatibility and dependency assessment, including whether a BIOS upgrade forces a standard interruption-based procedure. Business-hours execution can be suitable only when coverage, client mobility and supported software conditions are verified; 'live' does not guarantee zero interruption for every station or application. Track roaming, VoIP performance and reconnect attempts during the rollout, not just firmware compliance at completion.

Manual serial work is unrealistic for hundreds of APs. Scheduling an ordinary concurrent upgrade during business hours does not make the upgrade low-impact. Live Upgrade is the relevant mechanism; even then, an engineer should verify density and roaming behavior.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

AirWave was a traditional network management and monitoring product, whereas Central consolidates broader cloud-native configuration, lifecycle management, AI insight and cross-domain operations. A migration requires checking device support, licensing, configuration equivalence and historical monitoring requirements rather than assuming a simple database replacement. ClearPass continues to provide policy and AAA services where deployed, and Mobility Controllers or gateways participate in wireless traffic forwarding; these products are not the legacy management software intended by the question. ClearPass remains an access-policy/AAA product; a Mobility Controller or VPN concentrator forwards or terminates traffic. AirWave is the legacy network-management platform whose visibility and operations Central supersedes for supported deployments.

Official HPE references | Planets in Global Monitoring Page • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Site scope is appropriate because the desired values are identical for switches physically assigned to that location, even when they belong to different configuration groups. Create or assign the NTP Server Profile and Syslog Server Profile, and configure a Source Interface Profile only where source-IP selection is required. Confirm the device function and effective scope assignment, as an unassigned Library profile has no deployment effect. Avoid placing genuinely site-specific addresses at Global scope, where the settings would be inherited by unrelated branches.

A device group is useful when the same settings should span several sites; the requirement instead defines one physical location. Site collection would broaden the configuration beyond the requested site. Note that syslog uses its own server profile, alongside NTP and optional source-interface settings.

Official HPE references | Multi-Level Hierarchy • System Profiles | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Split-detection mechanisms determine which VSF fragment may continue forwarding after stacking-link partition, preventing two active control domains from advertising identical management identities or gateway addresses. On supported 6200/6300 families, management ports participate in detection; certain 4100i/6100 platforms instead use a dedicated MAD VLAN with front-plane ports. The standby fragment can disable non-VSF ports when the conductor fragment remains active. MC-LAG design does not solve a split-brain event inside a VSF stack, and daisy-chain topology offers less fault tolerance than a ring where supported.

MC-LAG applies to multichassis link aggregation, not detecting a partitioned VSF stack. A daisy chain may create a single break point rather than preventing split brain. VSF split detection is built for isolating dangerous dual-active fragments.

Official HPE references | VSF Profile • VSF Split Detection | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Treat member ID 1 as the intended initial conductor in the documented Central VSF configuration workflow, with a second member explicitly assigned for standby resilience. Verify the topology from the VSF Profile view after onboarding rather than relying solely on a label. On failover, another member may temporarily conduct the stack; member number does not dynamically change with that role transition. Ensure both adequate stack-bandwidth design and platform-specific split detection, which prevents duplicate active management planes if the stack fragments.

A conductor is not simultaneously elected on every member, and the highest ID does not automatically own control. “Standby always ID 1” reverses the initial layout. Member ID remains fixed while roles can change after failover.

Official HPE references | VSF Profile • VSF Split Detection | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A cloud-native management plane integrates deployment, monitoring, troubleshooting, security posture and software maintenance across geographically separated sites. AI-based correlations help focus investigations, while APIs allow authorized external workflows to inventory devices, retrieve statistics or make controlled configuration updates. Unified operation does not depend on SNMPv3 alone; SNMP is one management protocol and cannot supply all policy, firmware and client-experience functions. Workspaces govern administrative organization and delegation, but they do not themselves replace the multi-site management architecture.

A workspace defines organizational separation, not by itself an operating model for coordinated multi-site management. SNMPv3 secures one management protocol but does not produce Central’s configuration inheritance, AI analysis, and cross-domain workflows.

Official HPE references | Application Programming Interface (API) FAQ • Multi-Level Hierarchy | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

A GreenLake workspace defines the organizational boundary containing services, users, resource associations and access controls. Establish the workspace, grant appropriate administrator rights and then onboard or assign devices and subscriptions to the Central application. Subscription tier selection remains an important later step but is not the organizational prerequisite asked here. Ensure that invited users and devices are associated with the correct workspace to avoid accidental cross-tenant visibility or assigning entitlements to an unintended environment.

Assigning subscriptions and enabling auto-assignment follow the existence of an organizational workspace. Compliance data upload is not the prerequisite to creating a Central service. Workspace and roles establish the management boundary first.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

RBAC separates identity, the abstract permission set and the resources to which those rights apply. Create roles with explicit privileges, assign those roles to users or groups and restrict scope to authorized sites or device functions. Users inherit privileges from their role membership; network devices do not inherit user access permissions from a 'role assignment' in the same sense. Validate least privilege using a test operator account rather than giving broad administrator rights simply to resolve visibility issues. In option A, devices incorrectly inherit the operator permissions. Option B attaches permissions to individual users rather than roles. Option C conflates equipment ownership with authorization. Mapping privileges to roles and roles to users is the RBAC principle.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The Connections card provides connection and session context for the selected clients, including whether attempts progressed through authentication and association. Group the failures by WLAN, radio, endpoint operating system and identity backend; a common failure stage often identifies the shared dependency. When an error appears as an authentication timeout, validate AAA transport and RADIUS responsiveness rather than assuming the passwords are incorrect. The RF Health and connectivity path cards answer different questions: spectrum condition and traffic path, respectively.

RF Health may explain weak links, while Connectivity Path is primarily a network-path view. Neither is as direct as the Connections card for linking unsuccessful authentication and connection status to actual client sessions.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

The licensing distinction must be read against the actual entitlement matrix, not assumed from feature names. HPE lists base AI Insights under Foundation, while its official Classic Central AP license table lists Unified Communications and Collaboration (UCC) and Live Upgrades under Advanced. UCC visibility concerns voice/video collaboration experience; Live Upgrade is a firmware-maintenance orchestration capability. The test’s answer key singles out UCC, but the wording admits another Advanced-only selection in that documented matrix.

The Foundation license includes AI Insights, making C ineligible as an Advanced-only distinction. However, HPE’s official Classic Central license table places both UCC and Live Upgrades in the Advanced column. Accordingly, A is the supplied key but B also satisfies the literal wording; the question is not unambiguous as a single-choice item.

Source-specific qualification: HPE’s AP Foundation and Advanced License table places both UCC and Live Upgrades under Advanced. A single-answer interpretation of this question therefore requires the intended curriculum/release context.

Official HPE references | AP Foundation and Advanced License – HPE Aruba Networking Central • Dynamic Application Prioritization Profile | Study-guide topic: Introduction to AOS-10

Technical explanation

Firmware policy allows administrators to select devices by deployment scope, desired image and an upgrade mechanism. A live upgrade organizes participating APs into reboot sets rather than restarting the entire RF neighborhood together. Prechecks include supported AP hardware, appropriate licensing, access to image distribution and sufficient overlapping coverage. Schedule sites in controlled waves, observe client experience between waves and retain a backout plan. BIOS-dependent transitions and unsupported combinations may require a standard maintenance-window upgrade. For forty sites, stagger upgrade waves by RF coverage and criticality; avoid putting neighboring radios into the same reboot wave. Check the actual release supports the desired live-upgrade procedure for the APs involved.

Manually touching every AP multiplies administrative effort and risk across forty sites. An unscheduled global push can take adjacent radios offline together. A planned live-upgrade sequence is designed to preserve coverage while individual APs change software.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

An SVI is a virtual Layer 3 interface associated with a VLAN. Give it an IP address and mask from that VLAN's subnet so clients can use it as a default gateway and the switch can route toward other connected networks. Ensure IP routing is enabled, VLAN membership is correct and any VRF association is intentional. A local profile or address alias may be necessary when individual switches need distinct IPs; the basic requirement is the assigned SVI address, not the site scope itself or a static aggregate link.

Site scoping governs distribution of configuration, not whether an SVI has an IP gateway. A static LAG aggregates physical links without creating a routed VLAN interface. The SVI needs its own suitable IP address on the associated subnet.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

A role refers to one or more policies composed of ordered match/action rules. Place an explicit deny for protected internal subnets before an otherwise permissive internet-access entry, while permitting infrastructure services needed for DHCP, DNS and captive portal as appropriate. A final default allow can be valid only when the earlier internal-deny rules reliably match the protected networks. Validate the applied role, destination address objects and rule counters; the rule set is ineffective if bound to the wrong SSID or enforcement point. For example, a policy can deny guest access to 10.0.0.0/8 and 172.16.0.0/12 before a general internet permit. It must still allow the required DNS and DHCP services for a usable guest session.

With first-match rules, adding a deny after an earlier broad permit can make it ineffective. Setting the entire default policy to allow-all without an early internal-networks deny violates the restriction. Match specific protected prefixes first, then permit the required public destinations.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

The series shorthand is a quick screening question rather than a migration compatibility matrix. Supported AOS-10 hardware spans selected 3xx, 5xx, and 7xx families. A serial-number inventory should be matched with HPE’s model-level support table and software release before scheduling AOS-10 adoption. Some older 3xx hardware has minimum or final supported releases; family membership does not override the exact SKU restrictions.

The options name broad hardware families rather than exact SKUs. The 2xx generation is outside the supported AOS-10 set, and “4xx series” is not included in the referenced supported-series choices. A 3xx selection still demands model-level and release-level validation.

Official HPE references | Supported Access Point Platforms for AOS-10 • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

AI-derived RF recommendations should be assessed against channel quality, neighboring AP assignments, regulatory limits and the operational change window. AirMatch computes channel, bandwidth and power plans from aggregated AP telemetry, rather than assuming every AP requires a manual static channel. Confirm the recommendation fits the affected site's survey and any reserved channels before permitting changes. Disabling AirMatch eliminates the automation that normally manages RF resource reuse and is not a logical response to detected overlap.

Manually rebuilding every AP channel plan discards the fleet-wide context of AirMatch. Disabling AirMatch removes the optimization mechanism that can correct overlap. Check the recommendation’s assumptions and scope before applying it.

Official HPE references | AirMatch • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

AOS-10 APs send operating state, radio channel and transmit-power parameters, RF noise/retry indicators, client counts and related performance telemetry to Central. Analytics services aggregate these measurements for RF optimization, health scoring, anomaly detection and troubleshooting. Authentication secrets are not normal monitoring telemetry, and AP reporting is not a replacement for extracting arbitrary upstream router tables. When connectivity to Central is disrupted, APs can continue their currently applied forwarding and RF plans, although cloud-dependent optimizations may be delayed. A useful operational validation is to compare AP-reported RF counters and connectivity status before and after a known interference or availability event. The resulting time-series permits trend diagnosis without copying authentication credentials into the management platform.

DHCP lease information and learned routes can exist elsewhere in the topology but are not the defining AOS-10 AP telemetry category. Secret authentication material is not a routine performance-telemetry feed. Radios report operational metrics used in health and RF decisions.

Official HPE references | AOS-10 Cloud Services • Roaming and the Key Management Service | Study-guide topic: Introduction to AOS-10

Technical explanation

A mixed-mode SSID supports both bridged and tunneled forwarding, selected according to the client VLAN and deployment configuration. Put POS endpoints in the locally bridged role/VLAN where latency-sensitive branch processing must remain onsite; tunnel the guest VLAN toward a DMZ gateway cluster where centralized inspection is required. Ensure guest VLANs terminate on gateways and are not accidentally carried onto the AP's local switching trunk. Mixed mode is not arbitrary per-packet application steering; the forwarding selection must match the actual WLAN/VLAN policy. Under mixed forwarding, the relevant VLAN assignment decides the datapath. Ensure POS VLANs are permitted on the local AP uplink, while the guest VLAN is present on the gateway cluster for tunneling.

All-tunnel forwarding would backhaul the POS transactions unnecessarily; all-bridge forwarding would bypass the DMZ gateway for guests. Mixed forwarding is selected per VLAN/client role, so different VLANs require the intended bridge/tunnel mapping and uplink support. The AOS-10 WLAN wizard exposes Traffic Forwarding Mode = Mixed in its VLAN settings, with a primary gateway cluster for tunneled VLANs.

Official HPE references | AOS-10 Traffic Forwarding Modes • Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode | Study-guide topic: Introduction to AOS-10

Technical explanation

Build a reusable Port Profile containing interface administrative state, speed/duplex behavior, PoE settings, applicable spanning-tree options and associated VLAN/security parameters. Assign it through the appropriate Interface Profile or interface selection according to device family and UI workflow. Compare effective configuration on representative switches before deploying widely because uplinks, phones and ordinary edge hosts require different policy. A global alias without an applied profile carries no operational intent, while configuring every port independently raises drift and audit risk.

An alias does not automatically carry an entire port configuration, and editing every interface by hand invites drift. Profiles bind the required switchport intent to a reusable object; assignment to actual ports remains necessary. Open Configuration > Interfaces > Port Profile > Create profile, define the switch settings, then apply the profile from Switch Interface Configuration.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Creating an SVI directly for a particular switch requires a device-appropriate local profile so its unique routed address is not unintentionally imposed on every switch that shares the VLAN definition. Reusable VLAN identity and shared subnet policy can remain centrally defined while the interface IP is assigned locally or through a device-specific alias. Validate address uniqueness and routing adjacency after deployment. A Library object cannot independently carry a unique per-device address without appropriate scope or alias resolution, and disabling the VLAN defeats the logical SVI's Layer 2 association.

A Library profile is normally a reusable template, not the place for every switch’s unique SVI address. Disabling the VLAN destroys the L3 VLAN interface’s purpose. The Switch Interface Configuration profile is related to applying profiles to interfaces, but the per-switch IP is entered as local SVI configuration.

Official HPE references | Creating a Port Profile for Switches • Creating a VLAN Profile | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

Run tests and, where authorized, command sessions from Troubleshooting so their timestamps, device context and results appear in History. The session record allows comparison before and after an intervention and can be exported as operational evidence. For accountability, also consult Audit Trail, which records administrative actions rather than being a substitute for diagnostic output. Preserve results externally when a regulatory or investigation retention period exceeds Central's operational history retention window. Central records troubleshooting sessions under Troubleshoot > History; select a session ID to read its outputs and any associated notes.

A configuration-change event cannot replay the output of a cable test or ping. The site timeline helps correlate incidents but is not a test archive. History contains prior sessions and can be reviewed for repeated diagnostics or handover.

Official HPE references | Troubleshooting Tools • Troubleshooting History | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

WPA3-Enterprise enables 802.1X/EAP-based per-user authentication rather than a shared preshared key. Select EAP-TLS when the policy mandates client certificates; provision trusted PKI roots, server certificates, identity mappings and renewal procedures. EAP-TLS offers mutual certificate-based validation and avoids the password-only model, but WPA3-Enterprise is the WLAN security family and EAP-TLS is the specific authentication method. WPA3-Personal is password-oriented, and transition mode or RadSec transport alone does not impose employee certificate authentication.

WPA3-Personal relies on SAE with a shared passphrase, not enterprise EAP-TLS identity. WPA3 transition options address interoperability and RadSec secures RADIUS transport; neither alone establishes the requested client-certificate mode.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10

Technical explanation

Interpret the card as a triage tool: percentages place the sites with more severe health impact at the top, so an administrator can focus on locations needing action. The underlying site-health computation combines device health with client experience, rather than relying solely on offline device counts. A site without active clients may be evaluated using device health alone. When comparing apparently similar sites, open the underlying health bar and examine affected populations before prioritizing remediation exclusively from the ordering.

Option A puts alphabetic order before health severity; C moves names ahead of fair-health severity; D ranks fair above poor. The specified sort is severity-first, fair-health second, then name to resolve the remaining tie.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Live upgrade orchestrates staged AP restarts so coverage from unaffected neighbors continues serving users. Verify AP clustering or other supported live-upgrade prerequisites, firmware path, image availability and Advanced licensing when required by the deployed platform. Schedule the execution with awareness of RF design: in a poorly overlapped area, even one AP reboot can disrupt clients. Maintain deployment monitoring and post-change authentication checks. Manually reimaging each AP or relocating devices into a test site is operationally unnecessary and introduces more risk.

Console-based reflashing does not scale to a campus fleet, and relocating APs to a test site creates monitoring and policy confusion. Live Upgrade sequences eligible APs while the remaining radios continue serving much of the coverage area.

Official HPE references | Creating a Firmware Policy • Live Upgrade | Study-guide topic: Introduction to AOS-10

Technical explanation

Accept Invite begins the account activation and identity verification process for an invited GreenLake user who has not yet completed registration. The invitation associates a person with the organization's workspace but does not automatically grant administrator privileges in every Central application. Role assignment and identity-provider configuration remain separate authorization concerns. If the recipient already has an HPE identity, the exact flow can involve signing in rather than creating a duplicate account; verify the destination workspace and permitted application scopes after acceptance.

Accepting the invite is not blanket access without identity creation or sign-in, and it does not confer administrator status by default. The invited person is guided into the GreenLake account/acceptance process with separately assigned permissions.

Official HPE references | Multi-Level Hierarchy • HPE Aruba Networking Unified Infrastructure - Solution Overview | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

In the global or site context, Device Health counts APs, switches, gateways and bridges by health classification. Expand the card to compare the same metrics by site and select the affected location for a closer device list. Health aggregation helps prioritize teams and incidents by location but should not be interpreted as identifying the underlying fault. Inventory primarily lists assets and assignment, while AI Insights investigates patterns and anomalies; the health card is the direct summary requested.

Inventory can count devices but is not organized around their assessed health; AI Insights explains anomalies rather than serving as the core device-count summary. The Device Health card answers the operational question directly.

Official HPE references | Planets in Global Monitoring Page • Device Health Card | Study-guide topic: Network Management with HPE Aruba Networking Central

Technical explanation

Create a VSX pair in the aggregation tier and a VSX LAG/MC-LAG extending to each aggregation member, while the access stack uses LACP toward the two peers. The access device sees a single logical bundle even though the links terminate on different chassis. Correct ISL, peer keepalive, VLAN membership and LACP settings are essential for deterministic failover. Separate unaffiliated access ports force spanning-tree or routed-design considerations and do not deliver the same active-active link aggregation behavior.

Two independent access ports are not an LACP bundle across two chassis. Making a separate VRF for each link only isolates routing state. VSX with a multi-chassis LAG supports forwarding on both uplinks while preserving peer independence. For acceptance, disconnect each upstream aggregation peer in turn and confirm the LACP bundle remains up on the other peer. An undersized VSX ISL or incorrectly routed keepalive can defeat the intended resilience.

Official HPE references | VSX and VSF Connectivity Design - Validated Solution Guide • Creating a VSX Pair | Study-guide topic: Managing Wired Networks with HPE Aruba Networking Central

Technical explanation

With tunneled client forwarding, gateway policy becomes a consistent enforcement point for branch WLAN clients. Authentication, role assignment, user VLAN anchoring and traffic inspection can be coordinated centrally, while individual branches retain relatively modest local VLAN requirements. Check WAN latency, gateway cluster capacity, tunnel redundancy and failure behavior before choosing this architecture. Bridging all traffic locally can be valid in smaller branches, but it decentralizes the datapath and reduces the central inspection consistency stipulated by the scenario. A branch design using tunneled traffic also requires sufficient WAN capacity and a survivability plan. Centralized inspection is beneficial only when the gateway and transport remain appropriately available.

Bridge mode breaks out traffic at the AP and may enforce policy locally, so adding gateways without tunnel forwarding does not centralize inspection. Standalone APs lack the requested shared gateway datapath. A tunneled design consolidates enforcement at the gateway cluster.

Official HPE references | Configuring VLAN Settings for WLAN SSID in Tunnel and Mixed Mode • AOS-10 Cloud Services | Study-guide topic: Introduction to AOS-10