Security

I know there has bee a lot of questions on how to return the username instead of the mac address with Clearpass Guest and MAC caching so I thought I would post a quick how to on the policy manager side.

Couple notes:

1. Remember you will still need to set up the controller and captive portal in CPGuest

2. You must have insight enabled.

3. You must have Endpoint Repository as an authorization source. 

As of ClearPass 6.x and AOS 6.2, when doing MAC caching, you can return the username tied to the MAC address instead of the MAC address to the controller.

1. You start by creating a Guest Mac auth service with start here or service templates(Pre 6.3).

2. This is what the basic enforcement will look like..

3. Create a new RADIUS Enforcement Profile in CPPM. Set the return attributes below:

Radius:IETF User-Name=%{Endpoint:Username}.

4. In your Enforcement Policy, include the above Enforcement Profile. Make sure to include a check for Endpoint:Username Exists.

ONe other side note is that you can use the same concept to return the username of the person who registered a device with MACTRAC.  Here is an example of where I send back the name of the user that registered an apple TV.

Radius:IETF User-Name=%{Endpoint:Sponsor name}.

This doesn't work with Instant APs though.

Please vote for my feature request here https://arubanetworkskb.secure.force.com/prm/ideas/viewIdea.apexp?id=08740000000LEbJ

Thanks for sharing! Instant indeed doesn't do anything with the User-Name attribute with MAC authentication. Same goes for Cisco WLC and lot of other vendors.

Correct this setup is for Aruba Controller and Aruba MAS switches. It does come in handy when you are looking at the devices in Airwave for trouble shooting. 

For example in my lab. I return

Sponsor Name for MACTRAC/Airgroup devices

Username for Guests

Static attribute "Aruba AP" for my wired Access Points

is profiling needed for the MAC cache part only? or does it have a relation to the setting of username?

Returning the username is only dependent on there being a username or sponsor account tied to the endpoint device or guest device.

Info:

Starting with Instant 6.4.2-4.1.1.1 this seems to work!

Just Reply "User-Name" with your Accept-Response!

Also the first Accounting (Acct-Status-Type = Start) comes back with the new username, the IAP Webpage also shows immediately the correct username.

Kind Regards

Folke

As of some point (I'm working on a 6.6.8 machine now) the correct way to return the Sponsor Name from Device Registration is:

%{Authorization:[Guest Device Repository]:SponsorName}