Security

Hi all,

 

In cppm i can create policy that if a user brings in his Company owned laptop which happens to be windows laptop, enforce a certain policy. What if a user brings another laptop which is not company owned laptop but again is windows based?

 

What my requirement is that a user should only be allowed to onboard company owned windows laptop and not any other windows laptop? How can we achive this by CPPM without any mac based enforcement(as mac can be easily spoofed).

 

Thanks.

You can do that by Enabling machine authentication, so clearpass will allow access for domain laptop/desktop only.

You can configure company-based laptops to perform machine authentication, and that problem goes away.  Non-company laptops cannot successfuly machine authenticate.

Hi colin..thanks for your reply.

 

Can you please help me where I can enable this setting(enable machine auth) in CPPM.

Machine authentication is a client side configuration. There are some considerations when using machine auth for something like this. Are you working with an Aruba or partner engineer?


Thanks,
Tim

Hi mohan007,

You can follow the below links,

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/How-to-MACHINE-AND-USER-AUTHENTICATION-IN-WINDOWS-WITH-CLEARPASS/td-p/227580

 

http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/How-to-Machine-AND-User-Authentication-in-Windows-with-Clearpass/td-p/208471

Hi Suman, thanks a lot for your reply....the manual creation on SSID profile in end client devices, can we push this configuration from AD to all the end clients or we need to manually create this on each and every device? if yes I would really appreciate if you can help me with the steps for the same.thanks

There you go.

http://www.petenetlive.com/KB/Article/0000923.htm
https://technet.microsoft.com/en-us/magazine/gg266419.aspx

Thanks
SumaN

If you have group policy control over these devices, why not push
certificates down directly instead of going through the Onboard process?

Why not push out certificates via Group Policy? This way you know it is absolutely corporate owned?

Onboard is really designed for BYOD.


Thanks,
Tim