Security

Reply
Frequent Contributor II
Posts: 122
Registered: ‎01-19-2013

Clearpass & OnGuard (wired cisco)

Anyone running CPPM with OnGuard? How do you implement enforcement? Vlan DACL? How does it inform users they are in a remediation ?


This is a Cisco Wired environment.
MVP
Posts: 4,271
Registered: ‎07-20-2011

Re: Clearpass & OnGuard (wired cisco)

Read this doc :
http://community.arubanetworks.com/aruba/attachments/aruba/amigopod/1301/1/#page19
Thank you

Victor Fabian
Lead Mobility Engineer @ Integration Partners
AMFX | ACMX | ACDX | ACCX | CWAP | CWDP | CWNA
Frequent Contributor II
Posts: 122
Registered: ‎01-19-2013

Re: Clearpass & OnGuard (wired cisco)

Thanks for the link. I did set that up and got it working however not really sure how the OnGuard piece functions. And how we will inform our wired users that don't have the agent.

I'd really like to have a DACL enforcement. With no Vlan switching.
Aruba
Posts: 1,542
Registered: ‎06-12-2012

Re: Clearpass & OnGuard (wired cisco)

OnGuard is a very flexable module and I would recomend to work with the local SE or partner on setting it up.

 

We are constantly releasing new How-To documents and I will post a notice here when its avaible. 

Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Frequent Contributor II
Posts: 122
Registered: ‎01-19-2013

Re: Clearpass & OnGuard (wired cisco)

Thanks we had a demo but we didn't get a full demo. Couldn't really find any how-to on the OnGuard piece. Document I did find seems tie in with Clearpass guest. I'm interested how OnGuard will notify users to remediate.

Thanks. I'll look forward to more how-to's :-)
Aruba
Posts: 1,542
Registered: ‎06-12-2012

Re: Clearpass & OnGuard (wired cisco)

You have the option to have the persistent client auto remediate without moving the client to a remediation role, or you can bounce or apply a role or DACL to the client and force the user to a captive portal to inform them to self remediate. 

 

When a client is healthy 

screenshot_01 May. 23 00.10.gif

 

In my lab I have a sample posture to look for notepad.exe and if the agent finds the program running it will close the program and post a notification to the agent without moving the client to a different role. Again its very flexible so its comes down to what you would like to do. That's why its important to work with a local SE until a current document is posted.

 

screenshot_02 May. 23 00.12.gif

 

Thank You,
Troy

--Give Kudos: found something helpful, important, or cool? Click Kudos Star in a post.

--Problem Solved? Click "Accepted Solution" in a post.
Frequent Contributor II
Posts: 122
Registered: ‎01-19-2013

Re: Clearpass & OnGuard (wired cisco)

Thanks we did work with our SE. He just was not a Clearpass specialist. Do you know how clearpass can force a captive portal for a computer? Is this done using a radius url redirect or a specific vlan. He only showed us things on our aruba controller so it was not applicable to our wired network.

Thanks for all your help.
MVP
Posts: 1,413
Registered: ‎11-30-2011

Re: Clearpass & OnGuard (wired cisco)

i think this applies somewhat for the wired side if it isn't aruba:

http://community.arubanetworks.com/t5/ClearPass-formerly-known-as/Wired-Captive-Portal/td-p/57292

 

i build something similar and did use seperate vlans for healthy and unhealthy clients, the client can show a message and you do need it to do health checking, without your choices are limited.

Frequent Contributor II
Posts: 122
Registered: ‎01-19-2013

Re: Clearpass & OnGuard (wired cisco)

Any documents on how to deploy the OnGuard agent to computers in a cisco wired environment? IE computer that has credentials but someone uninstalled agent or never was installed. ??
Aruba Employee
Posts: 12
Registered: ‎10-24-2012

Re: Clearpass & OnGuard (wired cisco)

Most end up using domain policy to just force the client down. There are many examples of Domain policy to install applications.

The general Idea is that the computer will do a Machine Auth that will get a DACL for the quarantine network that has access to the basics (DNS,ICMP, CPPM and normally AV server and AD);

Domain policy pushes onguard to the machine when it refreshes the domain policy.
When a user logs in the get [Machine Auth][User Auth] and Unknown role which can be another DACL

Onguard then runs and bounces the clients NIC

 

User comes in again with the above but healthy and gets the full DACL.

Your DACL's have to be exact or the cisco switch will not accept it. Meaning, no conflicting rules, not leading or trailing spaces.

(a conflicting rule would be something like allow UDP any any and another rule that says allow DNS any any, since DNS is UDP 53 cisco treats it as conflicting rules; at least it did on the build I was using);

 

Since I am not allowed to disclose client information, I can say there are several VERY large companies that are using onGuard with cisco, one specifically using DACL's.

 

Let me know if you have any other questions.

Search Airheads
Showing results for 
Search instead for 
Did you mean: