1

Aruba Clearpass -Brett Koelling 2024

Aruba Clearpass Implementation

Introduction..................................................................................................................................3
Network Access Control (NAC) Overview................................................................................. 3
Wired Access...........................................................................................................................3
802.1x...................................................................................................................................... 4
MAC Authentication Bypass (MAB)......................................................................................... 9
Wireless................................................................................................................................. 10
Initial Lab Topology................................................................................................................... 11
ClearPass................................................................................................................................... 12
Install..................................................................................................................................... 12
AD Join.................................................................................................................................. 15
Certificate Install.................................................................................................................... 16
Add Devices...........................................................................................................................21
Policy - Wired............................................................................................................................. 23
802.1x Wired..........................................................................................................................23
Create Authentication Source.......................................................................................... 23
Service Construction (802.1x Wired PEAP/MSCHAPv2)................................................ 26
802.1x Wired Device Configs................................................................................................ 28
Cisco IOS-XE...................................................................................................................28
Aruba OS-CX................................................................................................................... 30
Supplicant Configuration..................................................................................................31
ClearPass Verification......................................................................................................34
 2
Aruba Clearpass -Brett Koelling 2024

802.1x Wired EAP-TLS (Certificate Authentication).............................................................. 36

Windows Settings............................................................................................................ 36
ClearPass Policy..............................................................................................................39
802.1x Wired EAP-TLS CN/DN Comparison.........................................................................41
MAC Authentication Bypass.................................................................................................. 43
Profiling Configuration......................................................................................................43
MAB Policy Construction................................................................................................. 44
Roles and Enforcement................................................................................................... 46
Policy - Wireless........................................................................................................................ 54
802.1x Wireless..................................................................................................................... 54
Basic Service Construction.............................................................................................. 54
EAP-TLS Service Construction..................................................................................56
EAP-TLS Wireless Supplicant Configuration............................................................. 57
Wireless Device Config..........................................................................................................62
Aruba Instant AP..............................................................................................................62
Cisco WLC AireOS.......................................................................................................... 64
Cisco WLC IOS-XE..........................................................................................................66
Meraki AP........................................................................................................................ 69
Policy WebAuth (Wireless)....................................................................................................... 70
ClearPass Guest Flow Theory...............................................................................................70
ClearPass Policy Construction.............................................................................................. 72
Wizard Flow..................................................................................................................... 72
MAC Authentication Service............................................................................................ 74
Web Page Config.............................................................................................................77
Login Verification..............................................................................................................80
Adding additional options to Web Authentication Login...................................................82
WebAuth Device Configurations............................................................................................ 85
Cisco IOS-XE Controller.................................................................................................. 85
Aire-OS............................................................................................................................ 85
Meraki.............................................................................................................................. 87
Aruba IAP.........................................................................................................................89
Summary.................................................................................................................................... 95
 3
Aruba Clearpass -Brett Koelling 2024

Introduction
The following document explores a Clearpass policy manager deployment. The demonstration
environment utilizes Aruba and Cisco networking equipment. Primary employee and guest role
authentication will be demonstrated across various access mediums. The document will contain
both implementation and basic theory surrounding essential concepts.

Network Access Control (NAC) Overview

Network access control has become necessary in virtually every environment. While there are
many layers within the security “stack,” the focus of this deployment will be network-level
access. NAC is a blanket term that will encompass multiple components. The specific focus of
this article, Aruba Clearpass is an application that will ultimately control access by investigating
configured rules and taking the appropriate action. To understand the complete NAC
ecosystem, one must understand the authentication flow. In the upcoming sections, basic theory
will be examined.

Wired Access
In an unrestricted environment, as long as the supporting infrastructure is in place the device
has no issue gaining access to the network and its associated resources.

Through various iterations, network administrators may have made life more complicated for the
end user to roam the network freely. This would be implemented through access control lists,
virtual routing and forwarding (VRF), or topological decisions such as forcing all inter-vlan flows
through a firewall. While all of the abovementioned options successfully provide security and
isolation, they do not scale well without pre-planning. A void was present from a solution and
operation standpoint that would allow rapid change in policy while adapting to network expanse/
user demand. A network access server (Clearpass, NPS, Cisco ISE) provides a centralized
point where access is granted or denied.
 4
Aruba Clearpass -Brett Koelling 2024

802.1x
The IEEE 802.1x standard enables port-based authentication. Within this protocol flow, there
are two distinct domains. The first is the communication between the end-user device and the
switch. A specific protocol known as Extensible Authentication Protocol Over LAN (EAPOL) is
used within this network segment. This protocol is used to share login information and enables a
challenge method. Devices receive specific labels when speaking in terms of 802.1x. The end
device in this example will be the supplicant, while the switch will be called the authenticator.

This communication will enable the initiation of an authentication flow to be sent toward the
server. Once the authentication flow reaches an accept or deny decision, the switch can take
action at the port level to provide the appropriate access the server determines. The next
segment of communication happens between the switch and the server. This communication
will utilize the Remote Authentication Dial-In User Service (RADIUS) protocol. Remembering the
distinction between the two is essential, as the EAPOL protocol will not traverse beyond the
single segment leading toward the end host. The EAP information is simply placed within a
RADIUS packet, which is the communication the server can decipher and act upon.
 5
Aruba Clearpass -Brett Koelling 2024

Wireshark captures add further examples to the segmentation of protocol use. From the client
side, EAP can be observed initiating the flow and receiving the particular identity from the end
device.

EAP Transaction

Meanwhile, communication between the switch and Clearpass server strictly utilizes the
RADIUS protocol.

RADIUS Transaction

The RADIUS protocol shares many details that will be utilized during the authentication process.
A wealth of information can be observed by delving further into the Access-Request packet.
 6
Aruba Clearpass -Brett Koelling 2024

These values are known as Attribute Value Pairs (AVP). They can be leveraged for
authentication needs, grouping requests, or calling specific details and forcing requests to
authenticate against particular rulesets. Skipping ahead and for the sake of understanding the
entire picture, the request can be seen on the Clearpass server with these same values present.

Clearpass view of AVPs

 7
Aruba Clearpass -Brett Koelling 2024

Jumping back to the switch and end client communication, the switch port must remain
restricted until the client correctly authenticates. This is a benefit of EAPOL, as the switch can
deny all protocols except EAP until a decision is returned. The end client does not need an IP
address to perform authentication, which alleviates the need for some artisanal access lists.
Upon completion of authentication, the switch can deploy a specific policy, and the end device
can begin communicating with necessary services (DNS, DHCP). This simple protocol pairing
eliminates the unprotected access environment and restricts all ports until the client is granted
to the network. While this section focuses on the wired component, the wireless medium
operates similarly.

EAP/RADIUS Flow Diagram

The diagram above displays a rudimentary flow. Clearpass configuration sections will discuss
the many layers of details found within the flow decision depicted above. 802.1x relies on client
understanding of the 802.1x behavior. This service must be activated in Windows and will be
used for the demonstrations in this document.

Windows Service Configuration

 8
Aruba Clearpass -Brett Koelling 2024

The Wired AutoConfig service allows the use of 802.1x. The client must specify which
credentials to send and the method of how to send them. After activating the service, the
specific authentication details can be found in the particular interface settings.

Interface specific settings

The options are overwhelming, but only two main options are commonly deployed. One is
MSCHAPv2, a simple password-based protocol that utilizes specific hashes to verify a user. The
other is certificates, which allow for mutual client and server authentication. Some challenges
arise with this deployment option revolving around certificate dispersal, but thankfully, both
Windows and ClearPass have options to alleviate this hurdle.
 9
Aruba Clearpass -Brett Koelling 2024

MAC Authentication Bypass (MAB)

With the discussion of clients and services out of the way, some readers might notice a gap in
security coverage. The simple question is, what should we do with devices that do not support
802.1x? Thankfully, there is a simple answer in Mac Authentication Bypass. MAB allows the
device's MAC address to be used in the “request identity” action. This simple change enables
ClearPass to assess all non-802.1x clients' access.

The end devices are unaware of authentication; they simply communicate as programmed.
Upon receiving traffic, the MAB-enabled port inspects the MAC and uses it as the username in
the RADIUS packet sent to ClearPass.

MAB RADIUS packet

ClearPass will receive this access request and make an informed decision based on the
configured policy.
 10
Aruba Clearpass -Brett Koelling 2024

ClearPass MAB entry

MAB allows organizations to secure any device that communicates via MAC. This provides a
solution for securing more challenging domains such as IoT and large manufacturing
environments. MAB also offers a simple solution for office printers, scanners, and whatever else
802.1x can not operate on.

Wireless
The process within the wireless medium is similar. The difference usually becomes apparent
depending on the specific deployment and wireless vendor. Also, controller-based and
controlerless deployments each enable their unique requirements. The refreshing news is that
the wireless medium does not warrant a separate discussion regarding the authentication
theory. The topics previously discussed will be applicable.
 11
Aruba Clearpass -Brett Koelling 2024

Initial Lab Topology

Moving forward with the lab details, the initial lab will encompass a multi-vendor environment
with Wireless and Wired solutions from Aruba and Cisco. This will demonstrate the use of
varying products and simulate a realistic transition phase that may be found in the real world.

Device Model Software

Cisco Switch C3650-24 16.12.09

Meraki AP MR-57 30.6

Cisco AP AP3802I Varying

Aruba Instant AP 325 8.10.0.9_88493

Cisco WLC vWLC 8.10.190.0

Cisco WLC-XE 9800v 17.14.1

Aruba Switch AOS-CX 10.13.1000

ClearPass LabEval 6.12.0.300732

Each device will be examined as it is configured within Clearpass. This should allow an easier
workflow instead of scrolling up and down the document. Basic IP addressing will be mentioned,
but it will be a minor focus of the lab.
 12
Aruba Clearpass -Brett Koelling 2024

ClearPass
ClearPass is Aruba’s offering to fill the void of network access security. Clearpass and Cisco’s
ISE are usually the first to be mentioned in most discussions revolving around NAC. Clearpass
can be deployed via hardware appliance or OVA. This lab will utilize the virtual deployment.
**Access to the HPE Networking Support Portal will be necessary to replicate the scenarios in
this lab.

Install
Upon deploying the OVA, an input must be selected to specify the deployment type.
The simple LAB variant is used in this demonstration, and the required specs are listed in the
below:

CPU = 4
Memory = 6GB
Disk = 400GB

CLABV deployment requirements

The installation will begin, and a login prompt will eventually appear on the console.

ClearPass login prompt

 13
Aruba Clearpass -Brett Koelling 2024

User: appadmin
Password: eTIPS123

Upon login, the user will be dropped off in the guided walkthrough for IP addressing and system
details. All of these settings are very straightforward. A single management interface can be
used for all ClearPass needs. If you must separate management and data, a second interface is
included.

Configuration summary

With the guided setup completed, the Web GUI should be active and ready for login.
 14
Aruba Clearpass -Brett Koelling 2024

A successful login will display ClearPass's main dashboard. The first item to examine from the
main page is the server settings under the administration tab. Changes can be made to that
initial server deployment from this configuration page.

Server configuration navigation

If the initial settings need no changes, the next step is to join the ClearPass server to a
Windows Active Directory Domain.
 15
Aruba Clearpass -Brett Koelling 2024

AD Join
In the lab, Windows Server 2022 is enabled with DNS, Active Directory, and Certificate Authority
features. Some basic Windows config will be examined, but it is recommended that you seek
purpose-written tutorials on how to get that infrastructure piece up and running.

The correct DNS server must be specified, as ClearPass must resolve the domain controller in
this step. The account used will need adequate permissions to allow the ClearPass server to
join the domain as a compute object. The ClearPass Policy Manager (CPPM) should appear in
the AD Computers folder after a successful join.
 16
Aruba Clearpass -Brett Koelling 2024

ClearPass joined to the AD Server

With the ClearPass server being domain joined, the next step involves adding the correct
certificates to the onboard trust list and generating certificate signing requests for the
appropriate services.

Certificate Install
ClearPass must either act as the cert authority or utilize an established certificate authority to
allow certificate-based authentication. In this example, the Windows certificate authority will be
used. The first order of operations is to add the Windows root certificate to the trust list within
ClearPass.
 17
Aruba Clearpass -Brett Koelling 2024

Certificate Trust Menu

The root certificate can be downloaded from the certsrv web page (http://X.X.X/certsrv/) using a
Windows certificate authority with web enrollment.
 18
Aruba Clearpass -Brett Koelling 2024

Windows CA web download

After retrieving the certificate, it can be uploaded to the ClearPass trust list.

The usage selection will specify what operations this cert can be utilized for. In this simple
deployment of one node, we will only concern ourselves with EAP, Aruba Services, and Others.
Once the root certificate is in place, a certificate signing request can be generated to create
specific certs for the ClearPass operation. These operations will be handled via the Certificate
store.
 19
Aruba Clearpass -Brett Koelling 2024

Certificate Store Config Location

Certificate signing requests can be generated from this configuration menu. I have added
easy-to-identify names to the certificate for demonstration purposes.

Submitting the CSR generates the appropriate request, which can be saved as a file or copied
to the clipboard.
 20
Aruba Clearpass -Brett Koelling 2024

CleaPass CSR output

Again, if you are using Windows as a Certificate Authority, you can paste this into the web enroll
menu to generate the proper certificate signed by the enterprise root.

Windows certificate request

 21
Aruba Clearpass -Brett Koelling 2024

With the CSR processed, the Server certificate can be uploaded to ClearPass with the proper
usage specified. For example, I created an RSA and ECC server CSR and generated the cert
through the Windows CA. After uploading the certificate to ClearPass, a logout is required to
see the change reflected.

The ClearPass WebPage now utilizes the enterprise root-signed certificate. This is a
rinse-and-repeat process for the Radius Service. The reason for separate certs comes down to
flexibility. When handing out user-specific certifications within the enterprise, you usually want to
avoid paying the premium to have those publicly signed. On your guest and onboard portal, you
will want a recognized certificate so you will not be inundated with “security warning” tickets.

Add Devices
The final step before actual policy construction is to add the network devices that will use
ClearPass to authenticate. The addition requires the correct IP, vendor, and shared secret
information. If a device is not specified and attempts to utilize ClearPass, the request will be
ignored, and an accompanying event log will be registered.
 22
Aruba Clearpass -Brett Koelling 2024

Device unknown event log

The network configuration menu will be utilized to add the appropriate device.

Network Device Config Location

Clearpass has various vendor profiles available. All of the devices under investigation in this lab
are already included.
 23
Aruba Clearpass -Brett Koelling 2024

Aruba Instant AP addition

Enabling Dynamic Auth on all the added devices did not cause any issues within the lab. This
feature is common with network devices and is integral to certain authentication steps. All
devices and controllers will need to be added. Special considerations will be investigated as
more device demonstrations occur.

Policy - Wired
Once the essential prerequisites are completed, the first policy can be investigated. The
demonstration will start with a basic MSCHAPv2 802.1x Wired authentication and then proceed
to various combinations of methods.

802.1x Wired
802.1x Wired behavior is predictable and has fewer surprises than the wireless realm. A basic
802.1x policy will be constructed for the first demonstration, allowing user-based authentication
via Windows 802.1x supplicant.

Create Authentication Source

Previously, the ClearPass Policy Manager was joined to the Active Directory Domain, but an
authentication method will also be needed to enable AD-based authentication.
 24
Aruba Clearpass -Brett Koelling 2024

Source Creation Menu

The following screenshots will display the various tabs and information needed to add the Active
Directory authentication source.
 25
Aruba Clearpass -Brett Koelling 2024

Source General Settings

Active Directory Bind Settings

 26
Aruba Clearpass -Brett Koelling 2024

The attributes page can be left as-is. Confirm the correct information on the summary page and
save the configuration. The Active Directory source should now be ready to use. It is important
to reiterate that this is a lab. Do not join with THE domain admin account and scope down the
user groups as much as possible in a production environment.

Service Construction (802.1x Wired PEAP/MSCHAPv2)

With the authentication source in place, the policy can now be built. In ClearPass, these are
referred to as Services.

ClearPass Service Menu

Add a service and specify the prepackaged template of 802.1x Wired. Add a service description
from this page and identify the qualifying match parameters. The default values used will work
for this first demonstration.
 27
Aruba Clearpass -Brett Koelling 2024

802.1x Wires Service Configuration

In the next tab, Authentication, the method of MSCHAPv2 and the AD source will be specified.

Service Authentication configuration

The role and enforcement policy can be the default for this specific example. We will explore
both of these configurations later.
 28
Aruba Clearpass -Brett Koelling 2024

Service Summary

With the service in place, the network device configuration must be examined to allow
ClearPass to be used as the chosen authentication server.

802.1x Wired Device Configs

Cisco IOS-XE
The following are the minimum steps to ensure reliable authentication from a Cisco IOS-XE
device.

Enable AAA Services

aaa new-model

Add RADIUS Server

radius server CPPM
address ipv4 100.64.100.129 auth-port 1812 acct-port 1813
key CLEARPASS123!

Create RADIUS server group

aaa group server radius Clearpass
server name CPPM

Enable Dynamic Authorization (CoA)

 29
Aruba Clearpass -Brett Koelling 2024

aaa server radius dynamic-author

client 100.64.100.129 server-key CLEARPASS123!
port 3799

Enable dot1x globally

dot1x system-auth-control

Enable AAA profiles

aaa authentication dot1x default group Clearpass
aaa authorization network default group Clearpass

Interface Configuration
interface GigabitEthernet1/0/23
description DOT1x_DEMO
switchport access vlan 909
switchport mode access
authentication host-mode multi-host
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication violation replace
mab
dot1x pae authenticator
end

Verification Commands
show aaa servers
test aaa group radius username password new-code
show run aaa
 30
Aruba Clearpass -Brett Koelling 2024

Aruba OS-CX
The following are the minimum steps to ensure reliable authentication from an Aruba OS-CX
device.

Specify ClearPass Server

radius-server host 100.64.100.129

Set Server Key

radius-server host 100.64.100.129 key plaintext KEYEXAMPLE

Set Appropriate VRF

radius-server host 100.64.100.129 vrf mgmt

Set Downloadable User Role (ClearPass specific deployment)

radius-server host 100.64.100.129 clearpass-username <user>
clearpass-password <pass>

Enable server tracking

radius-server host 100.64.100.129 tracking enable vrf mgmt

Configure tracking mode

radius-server host 100.64.100.129 tracking-mode any

Enable Dynamic Authorization

radius dyin-authorization enable

Set Dynamic Auth Key

radius dyn-authorization client 100.64.100.129 secret-key plaintext <key>

Allow AAA fail-through (If the method fails, try next)

aaa authentication allow-fail-through

Enable dot1x
aaa authentication port-access dot1x authenticator enable
 31
Aruba Clearpass -Brett Koelling 2024

Enable MAB
aaa authentication port-access mac-auth enable

Interface Configuration
interface 1/1/1
description 1x_PORT
no shutdown
no routing
vlan access 1000
aaa authentication port-access client-limit 3
aaa authentication port-access dot1x authenticator
cached-reauth
cached-reauth-period 60
max-eapol-requests 1
max-retries 1
quiet-period 5
discovery-period 10
enable

Verification commands
show aaa authentication port-access dot1x authenticator interface 1/1/1
client-status

show port-access clients

Supplicant Configuration
With ClearPass and the device configured, the Windows supplicant must apply the correct
configuration to supply the correct details.
 32
Aruba Clearpass -Brett Koelling 2024

Authentication General
 33
Aruba Clearpass -Brett Koelling 2024

Settings Menu
 34
Aruba Clearpass -Brett Koelling 2024

Additional Settings

ClearPass Verification
The authentication flow can begin with the network device and the client configured. A
ClearPass log detailing the authentication details will be generated if all is well.

Authentication Log Location

 35
Aruba Clearpass -Brett Koelling 2024

The Aruba access tracker will detail the services used and the attributes received.
As more complex policies are created, the Tracker will become one of the most visited areas. A
solid understanding of the RADIUS flows and how the attributes are being inspected will aid in
navigating failures.

Authentication Summary
 36
Aruba Clearpass -Brett Koelling 2024

RADIUS attributes received

This concludes the simple 802.1x demonstration. In the next iteration, Certificates will be added
to the mix. Any network device configuration placed for the wired side will be left as is with no
need for alteration as we investigate more involved methods.

802.1x Wired EAP-TLS (Certificate Authentication)

The biggest challenge of using EAP-TLS is certificate distribution. With EAP-TLS, both the
server and client are authenticated via certificate, which increases security.

Windows Settings
In the initial demonstration, the Windows group policy will auto-enroll the users to receive a
certificate from the domain CA. The certificate can be viewed from the Microsoft management
center (Win+R mmc).
 37
Aruba Clearpass -Brett Koelling 2024

Continuing with the Windows configuration, the authentication setting under the specific
interface must be altered.

Certificate method specification

 38
Aruba Clearpass -Brett Koelling 2024

Navigate to the settings page after selecting the certificate option on the drop-down menu.
Verify the server identity on this page, and specify the root certificate to verify with.

802.1x Certificate Settings

With those quick changes, the Windows client can participate in certificate-based authentication.
 39
Aruba Clearpass -Brett Koelling 2024

ClearPass Policy
A new service will be created to keep things clean and manageable. The construction is similar
to the previous example, with some minor changes.

Clearpass EAP-TLS Service

Some new options will be utilized on the authentication page. EAP-TLS will be the method used,
and the certificate to be used for this service will be specified (previously uploaded via CSR).

ClearPass Service Authentication

 40
Aruba Clearpass -Brett Koelling 2024

Everything else can be left as default, and the policy can be saved. The Auth flow should now
succeed. The EAP-TLS method has been utilized, and certificate details can now be viewed in
the computed attributes from the input details.

EAP-TLS with cert information

Wireshark of EAP-TLS use

 41
Aruba Clearpass -Brett Koelling 2024

802.1x Wired EAP-TLS CN/DN Comparison

Building upon the demonstration that was just used, a further layer of security can be added to
the flow. In the previous demonstration, a valid certificate was used, but the initial username
sent within the authentication request was not verified against the value in the certificate. With
the additional check, not only will cert validity be checked, but the username and cert value
must match. The change needed is minor, as the authentication method is the only alteration. To
create the necessary process, navigate to the Authentication configuration menu.

Authentication method

A new authentication method must be created with the certificate comparison field populated. In
this demonstration, the distinguished name will be reviewed.
 42
Aruba Clearpass -Brett Koelling 2024

Custom EAP-TLS Method Settings

The newly created method must now be specified in the EAP-TLS service. Once that change
has been confirmed, a new authentication attempt can be made and should be successful.

New method specification

 43
Aruba Clearpass -Brett Koelling 2024

Successful login with additional check

With minor changes, additional security can be added to the 802.1x flow. This method ensures
that both the username sent and the certificate match, validating the fact that this request came
from the source specified.

MAC Authentication Bypass

MAB is used when a device can not utilize 802.1x, which means it can not send a certificate or
username. This authentication method allows tracking “everything else” on the network. One of
the steeper challenges with MAB is assessing a device and giving it proper access. If you can
imagine a warehouse full of sensors, no one wants to go through and allowlist 500 MAC
addresses by hand. Luckily, DHCP helper commands can be utilized to assist ClearPass in
gaining a better understanding of what is trying to access the network. Rules can then be
constructed based on the information received from the DHCP request.

Profiling Configuration
In the simple deployment, all that is needed to enable profiling is a DHCP helper command on
the VLAN interface where you wish to perform MAB.

interface Vlan909
description AUTH_DEMO
ip address 10.90.9.1 255.255.255.0
ip helper-address 100.64.100.129
ip ospf 100 area 0
end
 44
Aruba Clearpass -Brett Koelling 2024

When the switch receives a DHCP request on the specific VLAN, it replicates the request and
sends it to ClearPass. ClearPass can then extract the critical information needed. After
completing the DHCP process, ClearPass displays further information about the connected
host.

Endpoint information location

Endpoint details with profiling

You can see the profiling information on the right-hand pane when selecting the endpoint. This
can be adjusted as needed if a device is wrongly profiled. This simple configuration eases the
burden of adequately tracking MAB-based clients.
 45
Aruba Clearpass -Brett Koelling 2024

MAB Policy Construction

A simple MAB policy that allows all MAC addresses but forces a port bounce once the device
has been profiled can be constructed. This will enable the administrator to act upon the device
profiling information. Theoretically, you can have a restricted network that allows the bare
minimum, which acts as a catalyst to profile the device. Once the device has been profiled,
ClearPass will have the correct details to take action.

MAB Service general settings

 46
Aruba Clearpass -Brett Koelling 2024

MAB Service Authentication Settings

For this example, the roles and enforcement settings can be left as is. The final change must be
made under the profiler tab.

Profiler Settings
 47
Aruba Clearpass -Brett Koelling 2024

The settings above indicate that all profiled devices trigger a RADIUS CoA to bounce the port.
This will cause the user to reauthenticate, which can be assessed based on the profiler values.
A MAB flow can be observed with the configuration displayed thus far in place.

MAB + CoA Wireshark

Access Tracker

In the CleaPass tracker, two authentication requests will be seen.

Roles and enforcement will be reviewed to demonstrate the actions that can be triggered based
on the profiling details.

Roles and Enforcement

In the previous example, the MAC Authentication flow was reviewed. Profiling was utilized to
provide additional details regarding the device. Upon profiling completion, the ClearPass server
sends a RADIUS request to the switch to bounce the port. Roles and Enforcement will now be
able to specify the details learned and push further action down to the switch.
 48
Aruba Clearpass -Brett Koelling 2024

The first step is to create the roles. The initial role configuration is simply an identifier.

Role configuration

A role that specifies the name of PROFILED_COMPUTER will be created, which will be called
in a mapping policy.

Computer role

A default role will also be created to aid in understanding the mapping process.
 49
Aruba Clearpass -Brett Koelling 2024

Default Role

The created roles will then be called in a mapping policy. The Mapping configuration page is
found within the same ClearPass menu.

Role Mapping Location

A simple name will be given, and the previously created default role will be used for this role.
The default role is applied if no mappings are made. Think of this as an implicit role at the end of
the map.

Default Role Creation

 50
Aruba Clearpass -Brett Koelling 2024

Rule mapping configuration

The following mapping rules are used to inspect the endpoint repository. If an endpoint has been
profiled as a computer, it assigns the role of PROFILED_COMPUTE. The rule can be saved
along with the mapping. An Enforcement policy will utilize the role maps to assign an action
based on role. The first component will be the enforcement profile.

Enforcement Profile Menu Location

Profiles can perform numerous actions within Clearpass and the network, such as assigning
ACLs and VLANs. A computer will be placed into the correct compute VLAN in this example.
 51
Aruba Clearpass -Brett Koelling 2024

Profile Settings

ClearPass includes preconfigured profile templates, saving time as they already have the
correct RADIUS parameters to be sent. On the next page, we only need to update the VLAN
number to be used.

VLAN Enforcement

The profile can then be saved. Next, navigate through the same sub-menu and create the
enforcement policy.
 52
Aruba Clearpass -Brett Koelling 2024

Enforcement policy settings

The previously configured components will be specified within the Rules page. This flow states
that if the PROFILED_COMPUTER role is assigned, the RADIUS action will be triggered to
place the user in the compute VLAN.

Enforcement Rules

With the Enforcement policy caved, these configured policies can now be called in the MAC
authentication policy.
 53
Aruba Clearpass -Brett Koelling 2024

The policy can be saved, and the auth flow can commence. During the initial authentication, the
device is not yet profiled and will receive the default role. This will allow the device to request a
DHCP address, and ClearPass will receive that mirrored information and be able to profile the
device.

Access Tracker with DEFAULT_ROLE

 54
Aruba Clearpass -Brett Koelling 2024

Once the device is profiled, the service is set to send a RADIUS AVP to bounce the port. When
the port recovers, the device will begin its authentication flow again. The second authentication
displays the configured role, and a Wireshark verification shows the correct VLAN ID sent via
the RADIUS packet.

Computer role assigned

 55
Aruba Clearpass -Brett Koelling 2024

RADIUS message with VLAN value

At this point in the lab, an unknown device can authenticate via MAC address and undergo
profiling, and then the ClearPass policy can act upon those collected attributes.

Policy - Wireless
The wireless medium will utilize near-identical policies to authenticate users and enforce policy
within ClearPass. The one significant addition in this section will be Guest authentication. I have
excluded guest authentication from the wired sections because I consider that a corner case in
2024. The first method to be explored for uniformity will be simple 802.1x with a username.

802.1x Wireless
Basic Service Construction
The initial wireless service will mirror the initial wired configuration and verify based on the
username sent in the RADIUS message against the Active Directory source. The basic service
construction will look for wireless-based authentication from a specific SSID.

ClearPass Connection Attribute

 56
Aruba Clearpass -Brett Koelling 2024

The Authentication method can allow various profiles as long as the source is AD. In the future,
the methods will be scoped down for certificate-based authentication.

The role and enforcement section can be left blank in the default state for this initial
demonstration. With the policy in place, an authentication can now be attempted via a wireless
access point. This specific attempt will be made from the IOS-XE WLC.
 57
Aruba Clearpass -Brett Koelling 2024

EAP-TLS Service Construction

Certificate-based authentication with wireless networks utilizes the same flow and additional
checks as the wired-based option. The only real difference is the supplicant configuration, which
will be examined in this section. The ClearPass Service will be nearly identical to the previous
example authenticated by user/password. The authentication method will be scoped down to
EAP-TLS, and ClearPass will specify a cert for use.
 58
Aruba Clearpass -Brett Koelling 2024

All previous configurations can remain once the services have been updated to reflect the
changes above.

EAP-TLS Wireless Supplicant Configuration

When using a certificate for a wireless network, the Windows supplicant is more complex than
the wired side. A wireless network must be manually created via the control panel. In an
 59
Aruba Clearpass -Brett Koelling 2024

Enterprise environment, this configuration can be pushed via GPO and be transparent to end
users.

Control Panel New Connection

 60
Aruba Clearpass -Brett Koelling 2024

Manually connect to wireless.

 61
Aruba Clearpass -Brett Koelling 2024

Specify SSID

Change connection settings to reveal security config

 62
Aruba Clearpass -Brett Koelling 2024

Select Certificate Option

With the demonstrated settings in place, the Windows device can now utilize the certificate
received from the domain controller for authentication.
 63
Aruba Clearpass -Brett Koelling 2024

Wireless Device Config

Aruba Instant AP
The following are the minimum steps to ensure reliable authentication from an Aruba Instant AP.

Create New Network

VLAN Assignment for WLAN

The next page presents many options, the most important being the first three. Here, you can
specify the ClearPass server, which will take you to another menu to create a new server
instance.
 64
Aruba Clearpass -Brett Koelling 2024

Basic Security Settings

Server Settings

The final page allows access rules to be assigned and the option to download roles. For this
example, this will be left in the default configuration.
 65
Aruba Clearpass -Brett Koelling 2024

Network Access Setting

This configuration will allow basic authentication over the Aruba Wireless infrastructure.

Cisco WLC AireOS

To add a RADIUS server to the Cisco AireOS WLC, you will first navigate to the security tab.
Use the “new” button on the top right of the page.

Cisco WLC Security

The basic details of your specific deployment of ClearPass will then need to be entered.
 66
Aruba Clearpass -Brett Koelling 2024

RADIUS Server Settings

This RADIUS server can then be called in a WLAN configuration possessing WPA2/2 with
enterprise security.

WLAN Security Settings

 67
Aruba Clearpass -Brett Koelling 2024

WLAN AAA Settings

The settings demonstrated are the necessary configurations for Cisco AireOS controllers.

Cisco WLC IOS-XE

To add a RADIUS server in newer Cisco IOS-XE WLCs navigate to the following section.

Create RADIUS Server

 68
Aruba Clearpass -Brett Koelling 2024

The details for your specific instance of ClearPass will then be provided.

Add RADIUS server details

An authentication list must be created to be called in the WLAN configuration.

You can add the radius server group from this page and specify the type as dot1x.
 69
Aruba Clearpass -Brett Koelling 2024

With these parameters in place, the AAA config can be called in a WLAN configuration.

This concludes the necessary configuration for ClearPass when utilizing a Cisco IOS-XE WLC.
 70
Aruba Clearpass -Brett Koelling 2024

Meraki AP
The Meraki AP setup is one of the most straightforward when bringing in a RADIUS server. All
the needed configurations are conducted on a single page upon creating a new SSID.
The first is to specify the correct security settings to allow 802.1x.

No Splash page will be needed for the simulated corporate access.

The RADIUS server will then need to be specified. When using ClearPass, you should utilize
the Aruba-Role specification.
 71
Aruba Clearpass -Brett Koelling 2024

This concludes the Meraki Configuration.

Policy WebAuth (Wireless)

Web Authentication has warranted its own section, encompassing another subset of
authentication and configuration methods. Web-based authentication will be used for networks
that require some type of action to gain access to the network without an account (initially).
These configurations are primarily found in hotels or event spaces where some kind of
acknowledgment is needed to gain access to the network. ClearPass has an entire suite
dedicated solely to Web Authentication.

ClearPass Guest Flow Theory

Discussing how the user is even directed to a captive portal will ease the burden of following the
configuration flow, especially since different devices uniquely configure these flows. The
examination will be divided into sections, with the first covering the authentication method and
redirect process.
 72
Aruba Clearpass -Brett Koelling 2024

Simple diagram flow of redirect

The first configuration point will be the standalone access point or controller. An SSID will need
to be configured to allow for MAC authentication. The specific configuration will depend on the
vendor. The AP will then pass the MAC address as the RADIUS username to the ClearPass
server. A configured service will handle the MAC authentication attempt. If the user has not
previously authenticated or their account has expired, a role will be assigned that triggers a
RADIUS flow. The specific flow for new/expired users will forward an ACL/VLAN with an
accompanying redirect URL. The AP will then redirect all client traffic attempts to the URL,
forcing the user to complete the necessary steps to log in to the network.

Once the user has completed the necessary actions prompted by the web authentication page,
specific attributes will be assigned to the MAC address. ClearPass will then send some
reauthentication method, forcing the client to be assessed again. ClearPass will now possess
additional details, allowing the policy to be evaluated based on said values.
 73
Aruba Clearpass -Brett Koelling 2024

As shown above, the guest user can now authenticate, and ClearPass will discover the
additional roles and determine access. The web authentication flow allows an unknown
endpoint to access a network and be assessed to determine access without administrator
intervention. This process also enables some user tracking.

ClearPass Policy Construction

The service construction in ClearPass involves creating a large number of objects. Luckily,
some wizards make life easy.

Wizard Flow

Wizard needed

The Guest Authentication with MAC Caching wizard will initially create most of the necessary
objects. When naming the objects, the wizard allows the input of a prefix. A recognizable
naming prefix will make life much easier down the road.

Wizard prefix name

The SSID to be used for web authentication is a required value. For the time being, this can be
an arbitrary value, as changing it is very straightforward within the service.
 74
Aruba Clearpass -Brett Koelling 2024

Specify SSID

The following options pertain to the access duration for the predetermined roles. This is entirely
determined by user preference/need. Once the account has expired, the end user will be
required to complete the web authentication process again to gain access to the network.

Account expiration by MAC/Role

The final configuration page will determine the enforcement type. This deployment will use
Aruba roles to steer clients to specific flows. The Captive Portal Access field specifies which role
will be directed to the captive portal. This will become easier to grasp as implementation
progresses. The number of devices per user and the assigned roles for the specific user groups
are also specified. These are kept the same for simplicity in the demo, as ClearPass already
defines these values.

Access configuration
 75
Aruba Clearpass -Brett Koelling 2024

Once complete, the wizard will create various role mappings, enforcement profiles, policies, and
two new services. These services will be labeled MAC Authentication and User Authentication
with MAC Caching. These policies will work out of the box for an Aruba deployment, but in this
demonstration, we will utilize a Cisco 9800 controller, which requires additional configuration.
This additional configuration will aid in policy exploration and understanding.

MAC Authentication Service

The first investigation will be the MAC Authentication service created by the wizard process. As
mentioned, this demo will utilize a Cisco 9800, which means the SSID specification must be
altered.

The specified match conditions need to match the Cisco RADIUS value rather than the Aruba.
This value will be as follows:

Radius:Cisco Cisco-AVPair EQUALS cisco-wlan-ssid=CP-DEMO

The following changes will be the redirect URL presented to the AP. Again, this will need to be a
Cisco-specific format. The redirect is triggered via the enforcement settings.

The enforcement profile of the DEMO-GUEST-MAC-CACHE_Captive Portal Profile can be

altered via the enforcement configuration page. Due to the nature of the 9800 WLC, an ACL and
redirect URL will be added to the profile.
 76
Aruba Clearpass -Brett Koelling 2024

Both of the additions will utilize the match options of

Radius:Cisco Cisco-AVPair EQUALS

Which will be followed by specific values

url-redirect-acl=REDIRECT

url-redirect=https://100.64.100.129/guest/guest_register.php?cmd-login&mac=%{Connection:Client-Mac-
Address-Hyphen}&switchip=%{Radius:IETF:NAS-IP-Address}

*Use your specific ClearPass IP/FQDN in the URL

The policy can now be saved with the changes made, and the correct information will be sent to
the wireless controller upon authentication. A test can be conducted to verify the configuration
so far. Upon connecting to the configured SSID, users will be sent to the Aruba guest
registration page. From this page, a user can input their name and email address, which can
then be placed in a queue for activation via an administrator. In this example, the guest user can
register without any admin activation.
 77
Aruba Clearpass -Brett Koelling 2024

ClearPass Default Web Auth Page

Upon accepting the terms of use and registering, the user is pushed to the next page, where
they can log in via a single button. The authentication method for this still needs to be
configured but will be covered next.

Error in login

To remedy the log-in issue, a service must be created for Web Authentication to reference a
specified repository. In this instance, the guest user repository will be utilized.
The most involved configuration will be creating a new enforcement policy. The enforcement
policy will execute various actions upon successful login with credentials found in the guest
repository.
 78
Aruba Clearpass -Brett Koelling 2024

WebAuth Policy

Many objects created in the initial Wizard will be called in the actions. These will impose a
device limit, bandwidth limit, MAC expiration, etc. One of the most important is the
CP_MAC-CAHCE Guest MAC Caching action. This will give the user the tag to be allowed on
the network. Finally, a Cisco AVP for session reauthentication is sent to force the user to
reauthenticate. If the user successfully registers and logs in, additional tags will be present, and
network access will be allowed.

Web Page Config

The other change that must be made is within the web page settings. These can be configured
by navigating the ClearPass Guest menu.

Guest Menu
 79
Aruba Clearpass -Brett Koelling 2024

From the guest menu, our focus will be on the configuration of the self-registration page.

Self-registration edit location

Select Edit
 80
Aruba Clearpass -Brett Koelling 2024

Advanced editor

Some parameters will be changed in the Advanced editor to allow the web page to be used with
the Cisco controller. First, the vendor selection must match your implementation; then, we will
use a CoA to force the reauthentication.

General Login Settings

 81
Aruba Clearpass -Brett Koelling 2024

Pre Auth Check

Pre-Auth checks allow additional messages to inform the user of a login error, which this
example will not use.

Login Delay

The login delay allows time for the CoA to complete.

Login Verification
With those settings in place, a login should now be possible. After clicking login, a 10-second
delay is initiated.

Login with delay

 82
Aruba Clearpass -Brett Koelling 2024

On the back end, ClearPass is sending the CoA from the Web Authentication service.
This forces the client (Wireless Controller) to reauthenticate the session. Upon this re-auth, the
correct attributes are placed in Clearpass, and the user can access the network.

Backend CoA traffic

For one final flow investigation, the diagram below will display what happens during Web
authentication.

WebAuth Flow Simplified

 83
Aruba Clearpass -Brett Koelling 2024

Adding additional options to Web Authentication Login

Use cases arise where, beyond guest authentication, another repository may need to be used
for Web Authentication, or both options must coexist. This demonstration will add an AD
credential-based login to the existing Web Authentication flow. This will be enabled via a simple
tag mechanism. This flow will be activated when a user selects the option to use an existing
account on the Web Authentication screen.

Additional login options

Active Directory will be added as an authentication source in the Webauth policy.

AD Addition to source

The enforcement policy for users authenticating via AD will have most of the same policies
found in the Guest flow, with one attribute added. In our example, an arbitrary attribute value will
be used.
 84
Aruba Clearpass -Brett Koelling 2024

AD Compute tag profile

When a user authenticates via the WebAuth service, the employee role is assigned if the Active
Directory identity is used.

AD Employee Role

When a user has been identified as an employee, the AD_COMPUTER_TAG enforcement

action is triggered.
 85
Aruba Clearpass -Brett Koelling 2024

AD Tag enforcement

The final action of the enforcement policy caused the device to re-authenticate. When the
device is evaluated, it now possesses the AD compute tag, which is then utilized to assign the
MAC Cache and Employee role, allowing network access.
 86
Aruba Clearpass -Brett Koelling 2024

The user will now be allowed access while still following the expiration rules.

WebAuth Device Configurations

Cisco IOS-XE Controller

Rather than copying and pasting what already exists, Cisco has a very good guide for getting
the initial configuration set in the IOS-XE controller. Configure 9800 WLC and Aruba ClearPass
- Guest Access & FlexConnect

Aire-OS
Throughout the lab progression, I updated my Cisco AP to the 17.x software train to join the
9800. This Aire-OS demonstration will be untested but demonstrated/
 87
Aruba Clearpass -Brett Koelling 2024

No L2 Security with MAC Filtering

AAA Override and Radius NAC

 88
Aruba Clearpass -Brett Koelling 2024

Create a redirect ACL to be called in the AVP

Meraki
The Meraki configuration is relatively straightforward.
 89
Aruba Clearpass -Brett Koelling 2024
 90
Aruba Clearpass -Brett Koelling 2024

In the Group Policy section, you specify the roles assigned via ClearPass. From here, you can
specify Layer 7 and Layer 3 firewall entries that will be placed when a user with that role
accesses the network.

These names must match the ClearPass role exactly.

Aruba IAP
The Aruba IAP setup provides improved configuration flow as ClearPass and Instant access
points “speak the same language”. The initial steps are straightforward and then role
assignments will be utilized to force users to the captive portal.
 91
Aruba Clearpass -Brett Koelling 2024

Create SSID

Assign appropriate VLAN for your environment.

 92
Aruba Clearpass -Brett Koelling 2024

Security setting to specify an External splash page and the associated CPPM profile
 93
Aruba Clearpass -Brett Koelling 2024

CPPM External captive portal profile

The URL will be the exact string used in the Cisco redirect, with the slight quirk that the base IP
is specified in a separate box.

/guest/guest_register.php?cmd-login&mac=%{Connection:Client-Mac-Address-Hyphen}&switchi
p=%{Radius:IETF:NAS-IP-Address}
 94
Aruba Clearpass -Brett Koelling 2024

Role assignment

The role assignment rule acts just like the ClearPass policy. Requests will be sent to the
ClearPass policy manager, which returns a role. The role matches an existing role on the Instant
Virtual controller, and the proper action is taken based on that role.

The flow in use here is:

If Endpoint unknown:
Role = PORTAL

If Endpoint in repo:
Role = GUEST
GUEST = Full Access

The role access configuration is as follows.

 95
Aruba Clearpass -Brett Koelling 2024

PORTAL role

GUEST role

The configured redirect in CPPM sends the role of PORTAL, which then enforces the captive
portal via the instant controller.

CPPM redirect

The user will then go through the Web Authentication Process and be assigned the Guest role.
CPPM will then send the RADIUS message containing the User Role.

CPPM RADIUS Reply

 96
Aruba Clearpass -Brett Koelling 2024

The IAP controller will receive this and grant the user full access. The role policy can be tailored
to any specific access need and remain straightforward in its implementation.

Summary
This document lays the groundwork for complex policy. Various devices were explored to
demonstrate ClearPasses' flexibility as a chosen access server. Secure network access is
commonplace in today's environments, and many NAC deployments have been in place for
many years. Transitioning or rebuilding a new solution can be a huge undertaking. Hopefully, lab
environments and simple guides like this can help ease the burden. Thank you for reading!