Wireless Access

Reply
Occasional Contributor I
Posts: 9
Registered: ‎02-15-2015

ClearPass - best practice assigning VLANs with multiple sites based on requesting network device?

Hello all,

 

Can anyone please recommend the best practice for the following scenario:

 

- multiple sites with Dell switches running dot1x, need ClearPass to return a different VLAN ID based on the site where the request originates (different VLAN IDs are used per site).

 

I had thought that I could perhaps have a different service defined per site based on a device group or device, however doesn't seem to be an option when defining the service rules.

 

There also doesn't seem to be an option for role mapping or enforcement policy based on requesting network device either - any thoughts appreciated.

 

Cheers

MVP
Posts: 1,412
Registered: ‎11-30-2011

Re: ClearPass - best practice assigning VLANs with multiple sites based on requesting network device

[ Edited ]

you can certainly do it in the service selection screen. so create different services for different locations.

Guru Elite
Posts: 8,330
Registered: ‎09-08-2010

Re: ClearPass - best practice assigning VLANs with multiple sites based on requesting network device

In your enforcement profile, you can select a network device. Create a new profile for each VLAN and add the appropriate switch(es) to the list. 

In your service, create your enforcement rule and return all of those profiles. 

ClearPass will return the appropriate VLAN ID depending on the authentication request. 


Thanks, 
Tim

Tim Cappalli | Aruba Security TME
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Occasional Contributor I
Posts: 9
Registered: ‎02-15-2015

Re: ClearPass - best practice assigning VLANs with multiple sites based on requesting network device

Thanks for the advice guys, that's great.

 

I've added a service rule for requests from a group of devices are a site:

Type: Connection

Name: NAD-IP-Address

Operator: BELONGS_TO_GROUP

Value: <group name>

 

Cheers

Highlighted
Guru Elite
Posts: 20,808
Registered: ‎03-29-2007

Re: ClearPass - best practice assigning VLANs with multiple sites based on requesting network device

[ Edited ]

As always with Aruba and ClearPass, there are a number of ways to do the same thing.  If you only wanted a single enforcement policy you can configure each NAS with a "Data" attribute signifying the VLAN that you would want data to be placed on.  You can use the namespace "%{Device:Attribute}" to return that value in an enforcement policy.  The namespace will replace %{Device:Attribute} with the value of the attribute pulled from the authenticating NAS (Device) and send it as a radius attribute (in this case the attribute is data).  For example, if I have a switch defined like below in ClearPass and I specify a "Data" attribute:

switch1.png

I could simply return the Value of the VLAN as a Device:<attribute> namespace like this:

enforce1.png

If an authentication comes into ClearPass from that switch and hits that enforcement profile, it will return a VLAN of 4 for that authentication.  You can define each switch with its own Data attribute to return whatever VLAN number corresponds to that switch.

 

There are many places where a few floors have one vlan for data, the next set of floors have a different vlan for data and so on and so on.  The strategy above allows you any return any value that is defined as an attribute in a NAS in CPPM as a radius attribute.  While there is definite utility for a list of rules where "NAD-IP-Address belong to group" the strategy above allows you to be more granular and have a single enforcement policy.  Again; just another way to do it.

 

I hope this helps.

 

 

 



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Occasional Contributor I
Posts: 9
Registered: ‎02-15-2015

Re: ClearPass - best practice assigning VLANs with multiple sites based on requesting network device

That's fantastic, and simplifies everything - especially for remote sites.

 

Cheers and thanks for taking the time!

Search Airheads
Showing results for 
Search instead for 
Did you mean: