HPE Aruba Gateways

The 9000 Series (9004 and 9012) are branch gateways designed for small and medium branch offices, combining SD-WAN, routing, and security in a compact form factor. The 9100 Series (9106) is a hybrid gateway for large branch and small campus environments, running AOS-10 for greater AP and client scale with 10GbE uplinks. The 9200 Series (9240) is a campus gateway for medium and large enterprises, scaling to 2,048 APs and 32,000 devices, and is purpose-built for high-density environments where continuous availability is critical.

Both run the same software and support the same SD-WAN, security, and WLAN gateway functions. The 9004 has four GbE ports and is sized for smaller branch sites. The 9012 has 12 GbE ports, six of which support PoE+ at up to 120W total, making it the right choice for branches where the gateway also needs to power a small number of devices — such as IP phones or lightweight access points — directly without a separate PoE switch. Both support up to 32 access points and 2,048 clients.

SD-Branch is an operating mode where the gateway manages WAN connectivity, routing, security, and wireless policy enforcement from a single platform rather than separate devices. In this mode, the gateway handles traffic steering across multiple WAN links — such as MPLS and broadband — alongside Dynamic Segmentation policy for connected users and IoT devices. It applies when a branch has multiple WAN connections to manage or when a unified policy across wired, wireless, and WAN is required without deploying separate appliances for each function.

The 9240 ships as a hardware-only unit that supports 512 APs and 16,000 devices at 20 Gbps throughput. Capacity can be increased by applying a Silver perpetual licence (1,024 APs, 24,000 devices, 30 Gbps) or a Gold perpetual licence (2,048 APs, 32,000 devices, 40 Gbps). The physical hardware does not change — the capacity increase takes effect through the licence. This allows organisations to start at a lower capacity and expand as the network grows without a hardware refresh.

All three series support clustering, where multiple gateway units are grouped together so that if one fails, others continue serving the network. The 9000 Series supports N+1 or NxN redundancy at the branch, allowing two gateways to share the load. The 9100 and 9200 Series both support live upgrades — software can be updated on a gateway without dropping connected users or APs during the process. This is a specific capability that standard gateway platforms do not offer and is particularly relevant in environments that cannot tolerate planned downtime.

All models include a built-in Layer 4–7 Policy Enforcement Firewall that applies access policy based on user identity, device type, application, and location — rather than just the port or VLAN a device is on. This means a contractor and an employee connecting to the same network segment receive different access levels automatically. When deployed in SD-WAN mode, the 9000 Series adds IDS/IPS, inspecting both east-west traffic between internal devices and north-south traffic to and from the WAN. Deep Packet Inspection provides visibility and control over more than 3,800 applications.