Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

ClearPass doesn't show both MAC addresses for AirWatch EMM/MDM devices

This thread has been viewed 6 times

  • 1.  ClearPass doesn't show both MAC addresses for AirWatch EMM/MDM devices

    Posted Jul 13, 2016 01:25 PM

    We have AirWatch set up as an EndPoint Context Server in ClearPass Policy Manager (CPPM) and have had great success using AirWatch-learned attributes for making access policy decisions in CPPM. We'd like to start using those attributes for wired connections but the CPPM-to-AirWatch API apparently is only learning the wireless MAC address and not the wired MAC. 

     

    Anybody have experience with this? Does the ClearPass API implementation need to be updated to pull multiple MAC addresses for each device from AirWatch, or perhaps does AirWatch need to be adjusted to give more info during an API call?



  • 2.  RE: ClearPass doesn't show both MAC addresses for AirWatch EMM/MDM devices

    Posted Jul 14, 2016 04:47 AM

    Hey Patrick,

     

    So I've had one of the internal SE's reachout to me as well over this. Basically I need to lookin and see if AW is even sending us the additional wired adapter info. Let me check upon this... if I don't get back to you ping me on email.



  • 3.  RE: ClearPass doesn't show both MAC addresses for AirWatch EMM/MDM devices

    Posted Jul 14, 2016 04:59 AM

    So a quick check of the work-file we ingest from my AW test instance only shows a single MAC address. 

     

    Just so Im clear on whats being asked for here can you layout what your request is for wired attached devices please?



  • 4.  RE: ClearPass doesn't show both MAC addresses for AirWatch EMM/MDM devices

    Posted Jul 14, 2016 08:32 AM
      |   view attached

    Danny, thanks so much for getting back to me. To make a long story short we are trying to use the endpoint attributes learned from AirWatch (in this case, the MAC address to trigger the correct wired 802.1x service as well as if the device is compromised and some other things) to prove to ourselves that the device is a legitimate corporate-owned device that is allowed to have internal access to corporate resources. See the attached screenshot for the role-mapping we want to do. Note that we're already successfully doing this for wireless because that wireless MAC address is being pulled by CPPM from AirWatch.