These symptoms are likely covered under issues filed against S3500 and ArubaOS Mobility controller products.
There are built-in limits to the total of derivation rules, so the number of rules that will work is dependent on the complete
controller configuration.
The issue was introduced in 6.1.3.0 software.
Currently, engineering are working on long term fixes for the issue.
In the meantime, there are a number of possible "workarounds" which may in fact, be advantageous in larger networks.
1) MAC based authentication using full, or OUI prefix, which can be used to derive.
- scripts are available to assist transition from the UDR configuration to the internal authentication database authentication
2) Use MAC OUI prefix UDR, thereby reducing the number of UDR rules required.
3) External authentication, using server derivation rules
Aruba Networks Technical Support can provide further details regarding the issue, assisting in positively identifying if this is indeed the cause of symptoms observed, or potential workarounds.