Security

Reply
Frequent Contributor I
Posts: 72
Registered: ‎12-07-2015

ClearPass 6.6.1 - Custom Fingerprinting Rules

Hi All,

 

I'm using fingerprinting rules to add unknown devices to already categorized Dictionary Identities. It works great, I like this new functionality in 6.6.

 

I had some questions though. When I add a custom fingerprint rule via [Configuration > Identity > Endpoints > 'Select Endpoint' > Update Fingerprint > 'Check add fingerprint rule' > Save] where can I see this rule to either modify or delete it?

 

For example, I added a fingerprint from some HP Thin Clients that were showing as unknown:

 

["1,28,2,3,15,6,119,12,44,47,26,121,42,101,100,192,202,203,137"]

 

I selected Thin Clients, HP, HP ThinClient as options for the rule. I then went into the fingerprints dictionary [Administration > Dictionaries > Fingerprints] and found the HP ThinClients fingerprint.

 

It shows a value of: 

 

[1,3,6,12,15,44,46,47,129,130,160,161,162,163,164,165,166,167,168,191]

 

It's different than what I selected in my rule, and also does not show the custom rule that I added (This is assuming that Device Fingerprints are 1:N relationship to Option55 values).

 

Is there a way to see all the custom rules so that they can be changed or deleted, or even known about? I expect that at some point customers will add in many conflicting rules that could cause problems, looking for ways to troubleshoot.


Close

New Contributor
Posts: 2
Registered: ‎10-24-2016

Re: ClearPass 6.6.1 - Custom Fingerprinting Rules

Bump.

 

I'm also needing this information, where are the custom fingerprinting rules stored so they can be managed?

Guru Elite
Posts: 8,456
Registered: ‎09-08-2010

Re: ClearPass 6.6.1 - Custom Fingerprinting Rules

Administration > Dictionaries > Fingerprints


Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
New Contributor
Posts: 2
Registered: ‎10-24-2016

Re: ClearPass 6.6.1 - Custom Fingerprinting Rules

Perfect, cheers!

Search Airheads
Showing results for 
Search instead for 
Did you mean: