Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Clearpass: CLI enforcements if client disconnects

This thread has been viewed 9 times

  • 1.  Clearpass: CLI enforcements if client disconnects

    Posted Aug 15, 2016 12:39 PM

    Hi all,

     

    I'm new to Aruba Clearpass and this my first post in this great community. I have implemented some CLI policy enforcements with Clearpass (SSH to Comware switches) - they are working perfect. My question - is there any way to execute CLI actions if a device logs off? Perhaps using the Radius Accounting or some kind of other magic? Thank you for some advice

     

    Best Regards



  • 2.  RE: Clearpass: CLI enforcements if client disconnects

    Posted Aug 16, 2016 04:57 AM

    You could look in to the use of 802.1x machine authentication. Certainly for Windows devices, machine authentication (if enabled) takes place at logon and logoff. You can use this to assign a more restrictive role or VLAN to devices when only machine authentication is passed.

    Basically the logic works as follows:

    ClearPass authenticates a machine and assigns a restrictive role/VLAN.

    ClearPass authenticates a user and this in combination with the already authenticated machine assigns a full access role/VLAN.

    If machine authentication is seen after this it would indicate a client has rebooted or logged off. This could then assign the more restrictive role.

     

    I would recommend labbing this up and seeing if this can provide what you want.



  • 3.  RE: Clearpass: CLI enforcements if client disconnects

    Posted Aug 16, 2016 07:53 AM

    Thanks you, David - that's simple and clean solution - i really like it. In the current environment i have lots of devices which need mac auth. Any additional ideas for this case?

     

    Best Regards



  • 4.  RE: Clearpass: CLI enforcements if client disconnects

    EMPLOYEE
    Posted Aug 16, 2016 07:56 AM
    There's no need for CLI enforcement. Comware supports RADIUS. You can leverage 802.1X with MAC fallback


  • 5.  RE: Clearpass: CLI enforcements if client disconnects

    Posted Aug 16, 2016 11:03 AM

    In this case, i'm using both. RADIUS for VLAN assignment and CLI enforcement for specific speed/duplex settings due bad cabling which causing issues with some end devices. One possible solution would be to set the speed/duplex settings back to default, if "devices all other" authenticated. I though that perhaps there is some smarter solution that i have missed.

     

    Best Regards