Hewlett Packard Enterprise Aruba IAP-303H User manual

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Aruba IAP-303H, IAP-304, IAP-305,
IAP-314, IAP-315, IAP-324, AP-325,
IAP-334, and IAP-335 Wireless
Access Points
with Aruba Instant Firmware
Non-Proprietary Security Policy
FIPS 140-2 Level 2
Version 4.9
February 2021

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Copyright
© 2020 Hewlett Packard Enterprise Company. Hewlett Packard Enterprise Company trademarks include ,
Aruba Networks®, Aruba Wireless Networks®, the registered Aruba the Mobile Edge Company logo, Aruba Mobility Management
System®, Mobile Edge Architecture®, People Move. Networks Must Follow®, RFProtect®, Green Island®. All rights reserved. All
other trademarks are the property of their respective owners.
Open Source Code
Certain Hewlett Packard Enterprise Company products include Open Source software code developed by third parties, including
software code subject to the GNU General Public License (GPL), GNU Lesser General Public License (LGPL), or other Open
Source Licenses. The Open Source code used can be found at this site:
http://www.arubanetworks.com/open_source
Legal Notice
The use of Aruba switching platforms and software, by all individuals or corporations, to terminate other vendors’ VPN client
devices constitutes complete acceptance of liability by that individual or corporation for this action and indemnifies, in full, Aruba.
from any and all legal actions that might be taken against it with respect to infringement of copyright on behalf of those vendors.
Warranty
This hardware product is protected by the standard Aruba warranty of one year parts/labor. For more information, refer to the
ARUBACARE SERVICE AND SUPPORT TERMS AND CONDITIONS.
Altering this device (such as painting it) voids the warranty.
www.arubanetworks.com
3333 Scott Blvd
Santa Clara, CA, USA 95054
Phone: [phone]
Fax [phone]

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |3
Contents
1. Purpose of this Document..................................................................................................................................................... 6
1.1. Related Documents ...................................................................................................................................................... 6
1.2. Additional Product Information.................................................................................................................................... 6
1.3. Acronyms and Abbreviations........................................................................................................................................ 7
2. Product Overview .................................................................................................................................................................. 8
2.1 IAP-303H ....................................................................................................................................................................... 8
2.1.1 Physical Description ............................................................................................................................................. 9
2.1.2 Dimensions/Weight ............................................................................................................................................. 9
2.1.3 Environmental...................................................................................................................................................... 9
2.1.4 Interfaces ............................................................................................................................................................. 9
2.2 IAP-300 Series ............................................................................................................................................................. 12
2.2.1 Physical Description ........................................................................................................................................... 13
2.2.2 Dimensions/Weight ........................................................................................................................................... 13
2.2.3 Environmental.................................................................................................................................................... 13
2.2.4 Interfaces ........................................................................................................................................................... 13
2.3 IAP-310 Series ............................................................................................................................................................. 15
2.3.1 Physical Description ........................................................................................................................................... 16
2.3.2 Dimensions/Weight ........................................................................................................................................... 16
2.3.3 Environmental.................................................................................................................................................... 16
2.3.4 Interfaces ........................................................................................................................................................... 16
2.4 IAP-320 Series ............................................................................................................................................................. 18
2.4.1 Physical Description ........................................................................................................................................... 19
2.4.2 Dimensions/Weight ........................................................................................................................................... 19
2.4.3 Environmental.................................................................................................................................................... 19
2.4.4 Interfaces ........................................................................................................................................................... 19
2.5 IAP-330 Series ............................................................................................................................................................. 21
2.5.1 Physical Description ........................................................................................................................................... 22
2.5.2 Dimensions/Weight ........................................................................................................................................... 22
2.5.3 Environmental.................................................................................................................................................... 22
2.5.4 Interfaces ........................................................................................................................................................... 22
3. Module Objectives .............................................................................................................................................................. 24
3.1. Security Levels ............................................................................................................................................................ 24
4. Physical Security .................................................................................................................................................................. 25
5. Operational Environment.................................................................................................................................................... 25
6. Logical Interfaces................................................................................................................................................................. 25
7. Roles, Authentication and Services ..................................................................................................................................... 26
7.1 Roles ........................................................................................................................................................................... 26
7.1.1 Crypto Officer Role ................................................................................................................................................. 26
7.1.2 User Role ................................................................................................................................................................ 26
7.1.3 Authentication Mechanisms .................................................................................................................................. 27
7.2 Services ....................................................................................................................................................................... 28
7.2.1 Crypto Officer Services ........................................................................................................................................... 28
7.2.2 User Services .......................................................................................................................................................... 30
7.2.3 Non-Approved Services .......................................................................................................................................... 31
7.2.4 Unauthenticated Services ...................................................................................................................................... 31
7.2.5 Services Available in Non-FIPS Mode ..................................................................................................................... 31
8. Cryptographic Algorithms.................................................................................................................................................... 32
8.1. FIPS Approved Algorithms .......................................................................................................................................... 32
8.2. Non-FIPS Approved Algorithms Allowed in FIPS Approved Mode.............................................................................. 35

4| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
8.3. Non-FIPS Approved Algorithms .................................................................................................................................. 35
9. Critical Security Parameters ................................................................................................................................................ 36
10. Self-Tests ......................................................................................................................................................................... 40
11. Installing the Wireless Access Point ................................................................................................................................ 42
11.1. Pre-Installation Checklist........................................................................................................................................ 42
11.2. Identifying Specific Installation Locations .............................................................................................................. 42
11.3. Precautions............................................................................................................................................................. 43
11.4. Product Examination .............................................................................................................................................. 43
11.5. Package Contents ................................................................................................................................................... 43
12. Tamper-Evident Labels.................................................................................................................................................... 44
12.1. Reading TELs........................................................................................................................................................... 44
12.2. Required TEL Locations .......................................................................................................................................... 45
12.2.1 TELs Placement on the IAP-303H ....................................................................................................................... 45
12.2.2 TELs Placement on the IAP-304 ......................................................................................................................... 46
12.2.3 TELs Placement on the IAP-305 ......................................................................................................................... 47
12.2.4 TELs Placement on the IAP-314 ......................................................................................................................... 48
12.2.5 TELs Placement on the IAP-315 ......................................................................................................................... 49
12.2.6 TELs Placement on the IAP-324 ......................................................................................................................... 50
12.2.7 TELs Placement on the IAP-325 ......................................................................................................................... 51
12.2.8 TELs Placement on the IAP-334 ......................................................................................................................... 52
12.2.9 TELs Placement on the IAP-335 ......................................................................................................................... 53
12.3. Applying TELs.......................................................................................................................................................... 54
12.4. Inspection/Testing of Physical Security Mechanisms............................................................................................. 54
13. User Guidance................................................................................................................................................................. 55
13.1. Crypto Officer Management .................................................................................................................................. 55
13.2. Configuring FIPS Approved Mode .......................................................................................................................... 55
13.3. Full Documentation ................................................................................................................................................ 56
14. Mitigation of Other Attacks ............................................................................................................................................ 57
Figures
Figure 1 - Aruba IAP-303H (with stand).......................................................................................................................................... 8
Figure 2 - Aruba IAP-303H Wireless Access Point – Interfaces (Front View) ............................................................................... 10
Figure 3 - Aruba IAP-303H Wireless Access Point – Interfaces (Rear View)................................................................................. 10
Figure 4 - Aruba IAP-303H Wireless Access Point – Interfaces (Bottom View) ............................................................................ 11
Figure 5 - Aruba IAP-303H Wireless Access Point – Interfaces (Side View) ................................................................................. 11
Figure 6 - Aruba IAP-304 .............................................................................................................................................................. 12
Figure 7 - Aruba IAP-305 .............................................................................................................................................................. 12
Figure 8 - Aruba IAP-300 Series Access Point – Interfaces ........................................................................................................... 13
Figure 9 - Aruba IAP-314 .............................................................................................................................................................. 15
Figure 10 - Aruba IAP-315 ............................................................................................................................................................ 15
Figure 11 - Aruba IAP-310 Series Access Point – Interfaces ......................................................................................................... 17
Figure 12 - Aruba IAP-324 ............................................................................................................................................................ 18
Figure 13 - Aruba IAP-325 ............................................................................................................................................................ 18
Figure 14 - Aruba IAP-320 Series Access Point – Interfaces ......................................................................................................... 20
Figure 15 - Aruba IAP-334 ............................................................................................................................................................ 21
Figure 16 - Aruba IAP-335 ............................................................................................................................................................ 21
Figure 17 - Aruba IAP-330 Series Access Point – Interfaces ......................................................................................................... 23
Figure 18 - Tamper-Evident Labels............................................................................................................................................... 44

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |5
Figure 19 – Right View of IAP-303H with TELs ............................................................................................................................. 45
Figure 20 – Left View of IAP-303H with TELs................................................................................................................................ 45
Figure 21 – Bottom View of IAP-303H with TELs.......................................................................................................................... 45
Figure 22 – Top View of IAP-304 with TELs .................................................................................................................................. 46
Figure 23 – Bottom View of IAP-304 with TELs ............................................................................................................................ 46
Figure 24 – Top View of IAP-305 with TELs .................................................................................................................................. 47
Figure 25 – Bottom View of IAP-305 with TELs ............................................................................................................................ 47
Figure 26 – Top View of IAP-314 with TELs .................................................................................................................................. 48
Figure 27 – Bottom View of IAP-314 with TELs ............................................................................................................................ 48
Figure 28 – Top View of IAP-315 with TELs .................................................................................................................................. 49
Figure 29 – Bottom View of IAP-315 with TELs ............................................................................................................................ 49
Figure 30 – Top View of IAP-324 with TELs .................................................................................................................................. 50
Figure 31 – Bottom View of IAP-324 with TELs ............................................................................................................................ 50
Figure 32 – Top View of IAP-325 with TELs .................................................................................................................................. 51
Figure 33 – Bottom View of IAP-325 with TELs ............................................................................................................................ 51
Figure 34 – Top View of IAP-334 with TELs .................................................................................................................................. 52
Figure 35 – Bottom View of IAP-334 with TELs ............................................................................................................................ 52
Figure 36 – Top View of IAP-335 with TELs .................................................................................................................................. 53
Figure 37 – Bottom View of IAP-335 with TELs ............................................................................................................................ 53
Tables
Table 1 - IAP-303H Status Indicator LEDs (Front) ......................................................................................................................... 11
Table 2 - IAP-303H Status Indicator LEDs (Bottom) ..................................................................................................................... 11
Table 3 - IAP-300 Series Status Indicator LEDs............................................................................................................................. 14
Table 4 - IAP-310 Series Status Indicator LEDs............................................................................................................................. 17
Table 5 - IAP-320 Series Status Indicator LEDs............................................................................................................................. 20
Table 6 - IAP-330 Series Status Indicator LEDs............................................................................................................................. 23
Table 7 - Intended Level of Security............................................................................................................................................. 24
Table 8 - FIPS 140-2 Logical Interfaces ......................................................................................................................................... 25
Table 9 – Estimated Strength of Authentication Mechanisms..................................................................................................... 27
Table 10 – Crypto Officer Services ............................................................................................................................................... 28
Table 11 - User Services ............................................................................................................................................................... 30
Table 12 – Aruba Instant VPN Module CAVP Certificates ............................................................................................................ 32
Table 13 – Aruba Instant Crypto Module CAVP Certificates ........................................................................................................ 33
Table 14 – ArubaInstant UBOOT Bootloader CAVP Certificates................................................................................................... 34
Table 15 – Aruba IAP Hardware CAVP Certificates ...................................................................................................................... 34
Table 16 – Critical Security Parameters ....................................................................................................................................... 36
Table 17 - Inspection/Testing of Physical Security Mechanisms.................................................................................................. 54

6| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Preface
This document may be freely reproduced and distributed whole and intact including the copyright notice.
Products identified herein contain confidential commercial firmware. Valid license required.
1. Purpose of this Document
This release supplement provides information regarding the Aruba IAP-303H, IAP-304, IAP-305, IAP-314, IAP-315, IAP-
324, IAP-325, IAP-334, and IAP-335 Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 validation
from Aruba Networks. The material in this supplement modifies the general Aruba hardware and firmware
documentation included with this product and should be kept with your Aruba product documentation.
This supplement primarily covers the non-proprietary Cryptographic Module Security Policy for the Aruba IAP-303H,
IAP-304, IAP-305, IAP-314, IAP-315, IAP-324, IAP-325, IAP-334, and IAP-335 Wireless Access Points with Aruba
Instant Firmware. This security policy describes how the Instant Access Point (IAP) meets the security requirements of
FIPS 140-2 Level 2 and how to place and maintain the IAP in the secure FIPS 140-2 mode. This policy was prepared as
part of the FIPS 140-2 Level 2 validation of the product.
FIPS 140-2 (Federal Information Processing Standards Publication 140-2, Security Requirements for Cryptographic
Modules) details the U.S. Government requirements for cryptographic modules. More information about the FIPS 140-2
standard and validation program is available on the National Institute of Standards and Technology (NIST) website at:
https://csrc.nist.gov/projects/cryptographic-module-validation-program
In addition, in this document, the Aruba IAP-303H, IAP-304, IAP-305, IAP-314, IAP-315, IAP-324, IAP-325, IAP-334,
and IAP-335 Wireless Access Points with Aruba Instant Firmware are referred to as the Wireless Access Point, the AP,
the IAP, the module, the cryptographic module, Aruba Wireless Access Points, Aruba Wireless APs, Aruba Access
Points, and IAP-3XX Wireless APs.
1.1. Related Documents
The following items are part of the complete installation and operations documentation included with this product:
• Aruba AP-300 Series Access Points Installation Guide
• Aruba AP-310 Series Access Points Installation Guide
• Aruba AP-320 Series Access Points Installation Guide
• Aruba AP-330 Series Access Points Installation Guide
• Aruba Instant 8.5.0.x User Guide
• Aruba Instant 8.5.0.x CLI Reference Guide
• Aruba Instant 8.5.0.x REST API Guide
• Aruba Instant 8.5.0.x Syslog Messages Reference Guide
• Aruba AP Software Quick Start Guide
1.2. Additional Product Information
More information is available from the following sources:
The Aruba Networks Web-site contains information on the full line of products from Aruba Networks:
http://www.arubanetworks.com
The NIST Validated Modules Web-site contains contact information for answers to technical or sales-
related questions for the product:
https://csrc.nist.gov/Projects/cryptographic-module-validation-program/Validated-Modules/Search
Enter Aruba in the Vendor field then select Search to see a list of FIPS certified Aruba products.
Select the Certificate Number for the Module Name ‘Aruba IAP-303H, IAP-304, IAP-305, IAP-314, IAP-
315, IAP-324, IAP-325, IAP-334, and IAP-335 Wireless Access Points with Aruba Instant Firmware’.

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |7
1.3. Acronyms and Abbreviations
AES Advanced Encryption Standard
AP Access Point
CBC Cipher Block Chaining
CLI Command Line Interface
CO Crypto Officer
CPSec Control Plane Security protected
CSEC Communications Security Establishment Canada
CSP Critical Security Parameter
ECO External Crypto Officer
EMC Electromagnetic Compatibility
EMI Electromagnetic Interference
FE Fast Ethernet
GE Gigabit Ethernet
GHz Gigahertz
HMAC Hashed Message Authentication Code
Hz Hertz
IKE Internet Key Exchange
IPsec Internet Protocol security
KAT Known Answer Test
KEK Key Encryption Key
L2TP Layer-2 Tunneling Protocol
LAN Local Area Network
LED Light Emitting Diode
SHA Secure Hash Algorithm
SNMP Simple Network Management Protocol
SPOE Serial & Power Over Ethernet
TEL Tamper-Evident Label
TFTP Trivial File Transfer Protocol
WLAN Wireless Local Area Network

8| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
2. Product Overview
This section introduces the Aruba IAP-303H, IAP-304, IAP-305, IAP-314, IAP-315, IAP-324, IAP-325, IAP-334, and IAP-
335 Wireless Access Points, providing a brief overview and summary of the physical features of each model covered by
this FIPS 140-2 security policy. The Aruba Instant Access Points are validated as hardware modules.
The tested versions of the firmware are: ArubaInstant 8.5.0.12.
Aruba's development processes are such that future releases under ArubaInstant 8.5 and 8.4 should be FIPS validate-able
and meet the claims made in this document. Only the versions that explicitly appear on the certificate, however, are
formally validated. The CMVP makes no claim as to the correct operation of the module or the security strengths of the
generated keys when operating under a version that is not listed on the validation certificate.
Note: For radio regulatory reasons, part numbers ending with –US TAA are to be sold in the US only. Part numbers
ending with –RW TAA are considered ‘rest of the world’ and must not be used for deployment in the United
States. From a FIPS perspective, both –US TAA and –RW TAA models are identical and fully FIPS compliant.
2.1 IAP-303H
This section introduces the Aruba IAP-303H Wireless Access Point (AP) with FIPS 140-2 Level 2 validation. It describes
the purpose of the AP-303H IAP, its physical attributes, and its interfaces.
Figure 1 - Aruba IAP-303H (with stand)

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |9
With a maximum concurrent data rate of 867Mbps in the 5GHz band (with 2SS/VHT80 clients) and 300Mbps in the
2.4GHz band (with 2SS/HT40 clients), the 303H IAP delivers high-performance Gigabit Wi-Fi for hospitality and
branch environments at an attractive price point. It supports multi-user MIMO (MU-MIMO) and 2 spatial streams
(2SS) to provide simultaneous data transmission for up to 2 devices, maximizing data throughput and improving
network efficiency. The 802.11ac Wave 2 303H IAP combines wireless and wired access in a single compact device.
Three local Gigabit Ethernet ports are available to securely attach wired devices to your network. One of these ports
is also capable of supplying PoE power to the attached device.
2.1.1 Physical Description
The Aruba IAP-303H Access Point is a multi-chip standalone cryptographic modules consisting of hardware and
software, all contained in a hard, opaque plastic case. The module contains 802.11 a/b/g/n/ac transceivers and
support two internal dual-band antennas.
The case physically encloses the complete set of hardware and software components and represents the cryptographic
boundary of the module.
The IAP-303H Access Point configuration validated during the cryptographic modules testing included:
IAP-303H HW: IAP-303H-US TAA (HPE SKU JY681A)
2.1.2 Dimensions/Weight
The IAP-303H has the following physical dimensions (unit, including single-gang wall box mount plate):
Dimensions: 86 mm (W) x 40 mm (D) x 150 mm (H)
Weight: 310 g
2.1.3 Environmental
Operating:
oTemperature: 0° C to +40° C (+32° F to +104° F)
oHumidity: 5% to 93% non-condensing
Storage and transportation:
oTemperature: -40° C to +70° C (-40° F to +158° F)
oHumidity: 5% to 93% non-condensing
2.1.4 Interfaces
Each module provides the following network interfaces:
E0/PT:One Uplink Ethernet network interface (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
o802.3az Energy Efficient Ethernet (EEE)
oPoE-PD: 48 VDC (nominal) 802.3af/at POE
E1/E2:Two Local Ethernet network interfaces (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
o802.3az Energy Efficient Ethernet (EEE)
E3:One Local Ethernet network interface (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
o802.3az Energy Efficient Ethernet (EEE)
oPoE-PSE: 48 VDC (nominal) 802.3af POE
DC power interface:
12V DC (nominal, +/- 5%)
1.35mm/3.5-mm center-positive circular plug with 9.5-mm length

10| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Antenna interfaces:
802.11a/b/g/n/ac two internal antenna
USB 2.0 host interface (Type A connector)
Bluetooth Low Energy (BLE) radio:
Bluetooth: up to 4 dBm transmit power (class 2) and -93 dBm receive sensitivity
Figure 2 - Aruba IAP-303H Wireless Access Point – Interfaces (Front View)
Figure 3 - Aruba IAP-303H Wireless Access Point – Interfaces (Rear View)

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |11
Figure 4 - Aruba IAP-303H Wireless Access Point – Interfaces (Bottom View)
Figure 5 - Aruba IAP-303H Wireless Access Point – Interfaces (Side View)
Other Interfaces:
Visual indicators (multi-color LEDs): for System, Radio (5 and 2.4 GHz) and Ethernet status
Reset button: factory reset (during device power up) or LED Toggle On/Off (during normal operation)
Serial console interface (proprietary micro-USB; optional adapter cable available; disabled in FIPS mode by TEL)
Table 1 - IAP-303H Status Indicator LEDs (Front)
LED Color/State Meaning
System Status
(Bottom)
Off AP powered off
Green/Amber - Alternating Device booting; not ready
Green - Solid Device ready
Amber - Solid Device ready; power-save mode (802.3af PoE): * Single radio
* USB disabled
Green or Amber - Flashing Device ready, restricted mode: * Uplink negotiated in sub optimal speed; or
* Radio in non-high throughput (HT) mode
Red System error condition
Radio Status
(Middle)
Off AP powered off, or both radios disabled
Green - Solid Both radios enabled in access mode
Amber - Solid Both radios enabled in monitor mode
Green/Amber - Alternating Green: one radio enabled in access mode,
Amber: one radio enabled in monitor mode
PoE-PSE Status
(Top)
Off AP powered off or PoE capability disabled
Green - Solid PoE power enabled (E3)
Red PoE power sourcing error or overload condition
Table 2 - IAP-303H Status Indicator LEDs (Bottom)
LED Color/State Meaning
E1/E2/E3
(Local Network Link
Status/Activity)
Off Ethernet link unavailable
Green - Solid 1000Mbs Ethernet link negotiated
Amber - Solid 10/100Mbs Ethernet link negotiated
Green or Amber - Flashing Ethernet link activity

12| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
2.2 IAP-300 Series
This section introduces the Aruba IAP-300 Series Wireless Access Points (APs) with FIPS 140-2 Level 2 validation. It
describes the purpose of the IAP-304 and IAP-305 APs, their physical attributes, and their interfaces.
Figure 6 - Aruba IAP-304
Figure 7 - Aruba IAP-305
These compact and cost-effective dual-radio IAPs implement a dual radio 802.11ac Access Point with Multi-User
MIMO - Supports up to 1,300 Mbps in the 5GHz band (with 3SS/VHT80 clients) and up to 300 Mbps in the 2.4GHz
band (with 2SS/VHT40 clients).

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |13
2.2.1 Physical Description
The Aruba IAP-304 and IAP-305 Access Points are multi-chip standalone cryptographic modules consisting of
hardware and software, all contained in a hard, opaque plastic case. Each module contains 802.11 a/b/g/n/ac
transceivers and support three external antennas through three N-type female connectors for external antennas
for the IAP-304, or three internal antennas for the IAP-305.
The case physically encloses the complete set of hardware and software components and represents the
cryptographic boundary of the module.
The IAP-300 Series Access Points configuration validated during the cryptographic modules testing included:
IAP-304 HW: IAP-304-US TAA (HPE SKU JX944A)
IAP-305 HW: IAP-305-US TAA (HPE SKU JX950A)
2.2.2 Dimensions/Weight
The IAP-300 Series have the following physical dimensions (unit, excluding mount accessories):
Dimensions: 165 mm (W) x 165 mm (D) x 38 mm (H)
Weight: 460 g
2.2.3 Environmental
Operating:
oTemperature: 0° C to +50° C (+32° F to +122° F)
oHumidity: 5% to 93% non-condensing
Storage and transportation:
oTemperature: -40° C to +70° C (-40° F to +158° F)
oHumidity: 5% to 93% non-condensing
2.2.4 Interfaces
The module provides the following network interface:
ENET: One Ethernet network interface (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
o802.3az Energy Efficient Ethernet (EEE)
oPoE-PD: 48 VDC (nominal) 802.3af/at POE
USB 2.0 host interface (Type A connector)
Figure 8 - Aruba IAP-300 Series Access Point – Interfaces

14| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Bluetooth Low Energy (BLE) radio:
Bluetooth: up to 3dBm transmit power (class 2) and -92dBm receive sensitivity
DC power interface:
12V DC (nominal, +/- 5%)
2.1mm/5.5-mm center-positive circular plug with 9.5-mm length
Antenna interfaces:
802.11a/b/g/n/ac three external antenna (IAP-304) or three internal antenna (IAP-305)
Other Interfaces:
Visual indicators (two multi-color LEDs): for System and Radio status
Reset button: factory reset (during device power up)
Serial console interface (proprietary; optional adapter cable available; disabled in FIPS mode by TEL)
Table 3 - IAP-300 Series Status Indicator LEDs
LED Type Color/State Meaning
System Status (Left)
Off AP powered off
Green/Amber
Alternating Device booting; not ready
Green - Solid Device ready
Amber - Solid Device ready; power-save mode (802.3af PoE):
* Single radio
* USB disabled
Green or Amber
Flashing
Device ready, restricted mode:
* Uplink negotiated in sub optimal speed; or
* Radio in non-high throughput (HT) mode
Red System error condition
Radio Status (Right)
Off AP powered off, or both radios disabled
Green - Solid Both radios enabled in access mode
Amber - Solid Both radios enabled in monitor mode
Green/Amber Alternating One radio enabled in access mode, other in monitor mode

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |15
2.3 IAP-310 Series
This section introduces the Aruba IAP-310 Series Wireless Access Points (APs) with FIPS 140-2 Level 2 validation. It
describes the purpose of the IAP-314 and IAP-315 APs, their physical attributes, and their interfaces.
Figure 9 - Aruba IAP-314
Figure 10 - Aruba IAP-315
These compact and cost-effective dual-radio APs implement a dual radio 802.11ac access point with Multi-User
MIMO - Supports up to 1,733Mbps in the 5GHz band (with 4SS/VHT80 or 2SS/VHT160 clients) and up to 300 Mbps
in the 2.4 GHz band (with 2SS/VHT40 clients).

16| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
2.3.1 Physical Description
The Aruba IAP-314 and IAP-315 Access Points are multi-chip standalone cryptographic modules consisting of
hardware and software, all contained in hard, opaque plastic cases. Each module contains 802.11 a/b/g/n/ac
transceivers and support four external antennas through four N-type female connectors for external antennas for
the IAP-314, or four internal antennas for the IAP-315.
The case physically encloses the complete set of hardware and software components and represents the
cryptographic boundary of the module.
The IAP-310 Series Access Points configuration validated during the cryptographic modules testing included:
IAP-314 HW: IAP-314-US TAA (HPE SKU JW808A)
IAP-315 HW: IAP-315-US TAA (HPE SKU JW814A)
2.3.2 Dimensions/Weight
The IAP-310 Series have the following physical dimensions (unit, excluding mount accessories):
Dimensions: 182 mm (W) x 180 mm (D) x 48 mm (H)
Weight: 650 g (23 oz)
2.3.3 Environmental
Operating:
oTemperature: 0° C to +50° C (+32° F to +122° F)
oHumidity: 5% to 93% non-condensing
Storage and transportation:
oTemperature: -40° C to +70° C (-40° F to +158° F)
oHumidity: 5% to 93% non-condensing
2.3.4 Interfaces
Each module provides the following network interfaces:
ENET: One Ethernet network interface (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
o802.3az Energy Efficient Ethernet (EEE)
oPoE-PD: 48 VDC (nominal) 802.3af/at POE
DC power interface:
12V DC (nominal, +/- 5%)
2.1mm/5.5-mm center-positive circular plug with 9.5-mm length
Antenna interfaces:
802.11a/b/g/n/ac four external antenna (IAP-314) or four internal antenna (IAP-315)
USB 2.0 host interface (Type A connector)
Bluetooth Low Energy (BLE) radio:
Bluetooth: up to 4dBm transmit power (class 2) and -91dBm receive sensitivity

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |17
Figure 11 - Aruba IAP-310 Series Access Point – Interfaces
Other Interfaces:
Visual indicators (two multi-color LEDs): for System and Radio status
Reset button: factory reset (during device power up)
Serial console interface (proprietary; optional adapter cable available; disabled in FIPS mode by TEL)
Table 4 - IAP-310 Series Status Indicator LEDs
LED Type Color/State Meaning
System Status (Left)
Off AP powered off
Green/Amber
Alternating Device booting; not ready
Green - Solid Device ready
Amber - Solid Device ready; power-save mode (802.3af PoE): * Single radio
* USB disabled
Green or Amber
Flashing
Device ready, restricted mode:
* Uplink negotiated in sub optimal speed; or
* Radio in non-high throughput (HT) mode
Red System error condition
Radio Status (Right)
Off AP powered off, or both radios disabled
Green - Solid Both radios enabled in access mode
Amber - Solid Both radios enabled in monitor mode
Green/Amber
Alternating Green: one radio enabled in access mode,
Amber: one radio enabled in monitor mode

18| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
2.4 IAP-320 Series
This section introduces the Aruba IAP-320 Series Wireless Access Points (APs) with FIPS 140-2 Level 2 validation. It
describes the purpose of the IAP-324 and IAP-325 APs, their physical attributes, and their interfaces.
Figure 12 - Aruba IAP-324
Figure 13 - Aruba IAP-325
With a maximum concurrent data rate of 1,733 Mbps in the 5 GHz band and 600 Mbps in the 2.4 GHz band (for an
aggregate peak data rate of 2.3Gbps), the IAP-320 Series Access Points deliver a best-in-class, next-generation
802.11ac Wi-Fi infrastructure that is ideal for lecture halls, auditoriums, public venues, and high-density office
environments. The high performance and high density 802.11ac IAP-320 Series Access Points support dual radio 4x4
802.11AC multi-user MIMO with 4SS/VHT80 5GHz and 4SS/HT40 2.4GHz.

Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy |19
2.4.1 Physical Description
The Aruba IAP-324 and IAP-325 Access Points are multi-chip standalone cryptographic modules consisting of
hardware and software, all contained in hard, opaque plastic cases. Each module contains 802.11 a/b/g/n/ac
transceivers and support four external antennas through four N-type female connectors for external antennas for
the IAP-324, or eight integrated omni-directional downtilt internal antennas for the IAP-325.
The case physically encloses the complete set of hardware and software components and represents the
cryptographic boundary of the module.
The IAP-320 Series Access Points configuration validated during the cryptographic modules testing included:
IAP-324 HW: Aruba IAP-324-US TAA (HPE SKU JW322A)
IAP-325 HW: Aruba IAP-325-US TAA (HPE SKU JW328A)
2.4.2 Dimensions/Weight
The IAP-320 Series have the following physical dimensions (unit, excluding mount accessories):
Dimensions: 203mm (W) x 203mm (D) x 57mm (H) / 8.0” (W) x 8.0” (D) x 2.2” (H)
Weight: 950 g / 34 oz
2.4.3 Environmental
Operating:
oTemperature: 0° C to +50° C (+32° F to +122° F)
oHumidity: 5% to 93% non-condensing
Storage and transportation:
oTemperature: -40° C to +70° C (-40° F to +158° F)
oHumidity: 5% to 93% non-condensing
2.4.4 Interfaces
Each module provides the following network interfaces:
ENET0/POE: One Ethernet network interface (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
o802.3az Energy Efficient Ethernet (EEE)
oPoE-PD: 48V DC (nominal) 802.3at/af POE
ENET1: One Ethernet network interface (RJ-45, Auto-sensing link speed 10/100/1000BASE-T and MDI/MDX)
oLink Aggregation (LACP) support for redundancy and to achieve platform throughput up to 2 Gbps
o802.3az Energy Efficient Ethernet (EEE)
oPoE-PD: 48V DC (nominal) 802.3at/af POE
USB 2.0 host interface (Type A connector)
Bluetooth Low Energy (BLE) radio:
Bluetooth: up to 4 dBm transmit power (class 2) and -94 dBm receive sensitivity
DC power interface:
48V DC (nominal, +/- 5%)
2.1mm/5.5-mm center-positive circular plug with 9.5-mm length

20| Aruba IAP-3XX Wireless Access Points with Aruba Instant Firmware FIPS 140-2 Level 2 Security Policy
Figure 14 - Aruba IAP-320 Series Access Point – Interfaces
Antenna interfaces:
• 802.11a/b/g/n/ac four external antenna (IAP-324) or eight internal antenna (IAP-325)
Other Interfaces:
Visual indicators (two multi-color LEDs): for System and Radio status
Reset button: factory reset (during device power up)
Serial console interface (standard RJ-45 female connector;disabled in FIPS mode)
Table 5 - IAP-320 Series Status Indicator LEDs
LED Type Color/State Meaning
System Status (Left)
Off AP powered off
Green/Amber
Alternating Device booting; not ready
Green - Solid Device ready
Amber - Solid Device ready; power-save mode (802.3af PoE):
* Single radio
* USB disabled
Green or Amber
Flashing
Device ready, restricted mode:
* Uplink negotiated in sub optimal speed; or
* Radio in non-high throughput (HT) mode
Red System error condition
Radio Status (Right)
Off AP powered off, or both radios disabled
Green - Solid Both radios enabled in access mode
Amber - Solid Both radios enabled in monitor mode
Green/Amber
Alternating Green: one radio enabled in access mode,
Amber: one radio enabled in monitor mode