Clearpass & OnGuard (wired cisco)

[sdr53]

Anyone running CPPM with OnGuard? How do you implement enforcement? Vlan DACL? How does it inform users they are in a remediation ?


This is a Cisco Wired environment.

[Victor Fabian]

Read this doc :
http://community.arubanetworks.com/aruba/attachments/aruba/amigopod/1301/1/#page19

[sdr53]

Thanks for the link. I did set that up and got it working however not really sure how the OnGuard piece functions. And how we will inform our wired users that don't have the agent.

I'd really like to have a DACL enforcement. With no Vlan switching.

[tarnold]

OnGuard is a very flexable module and I would recomend to work with the local SE or partner on setting it up.

We are constantly releasing new How-To documents and I will post a notice here when its avaible. 

[sdr53]

Thanks we had a demo but we didn't get a full demo. Couldn't really find any how-to on the OnGuard piece. Document I did find seems tie in with Clearpass guest. I'm interested how OnGuard will notify users to remediate.

Thanks. I'll look forward to more how-to's :-)

[tarnold]

You have the option to have the persistent client auto remediate without moving the client to a remediation role, or you can bounce or apply a role or DACL to the client and force the user to a captive portal to inform them to self remediate. 

When a client is healthy 

In my lab I have a sample posture to look for notepad.exe and if the agent finds the program running it will close the program and post a notification to the agent without moving the client to a different role. Again its very flexible so its comes down to what you would like to do. That's why its important to work with a local SE until a current document is posted.

[sdr53]

Thanks we did work with our SE. He just was not a Clearpass specialist. Do you know how clearpass can force a captive portal for a computer? Is this done using a radius url redirect or a specific vlan. He only showed us things on our aruba controller so it was not applicable to our wired network.

Thanks for all your help.

[boneyard]

i think this applies somewhat for the wired side if it isn't aruba:

http://community.arubanetworks.com/t5/ClearPass-formerly-known-as/Wired-Captive-Portal/td-p/57292

i build something similar and did use seperate vlans for healthy and unhealthy clients, the client can show a message and you do need it to do health checking, without your choices are limited.

[sdr53]

Any documents on how to deploy the OnGuard agent to computers in a cisco wired environment? IE computer that has credentials but someone uninstalled agent or never was installed. ??

[gkendzerski]

Most end up using domain policy to just force the client down. There are many examples of Domain policy to install applications.

The general Idea is that the computer will do a Machine Auth that will get a DACL for the quarantine network that has access to the basics (DNS,ICMP, CPPM and normally AV server and AD);

Domain policy pushes onguard to the machine when it refreshes the domain policy.
When a user logs in the get [Machine Auth][User Auth] and Unknown role which can be another DACL

Onguard then runs and bounces the clients NIC

User comes in again with the above but healthy and gets the full DACL.

Your DACL's have to be exact or the cisco switch will not accept it. Meaning, no conflicting rules, not leading or trailing spaces.

(a conflicting rule would be something like allow UDP any any and another rule that says allow DNS any any, since DNS is UDP 53 cisco treats it as conflicting rules; at least it did on the build I was using);

Since I am not allowed to disclose client information, I can say there are several VERY large companies that are using onGuard with cisco, one specifically using DACL's.

Let me know if you have any other questions.