Security

last person joined: yesterday 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Automatically identify the switch family in ClearPass

  • 1.  Automatically identify the switch family in ClearPass

    Posted Dec 18, 2020 06:44 AM

    Hi

    I have a similar question as in this thread https://community.arubanetworks.com/community-home/digestviewer/viewthread?MID=32088.

    Is it possible to automate the detection of the different switch families sending requests to ClearPass instead of manually add switches or subnets to Network Device Groups?

    In a specific case I have a mix of many different Aruba and HPE switches. Old Comware switches, Aruba 2530, Aruba 2930F and some Aruba CX 6300 switches.

    The intention is to implement Downloadable User Roles on the 2930F and CX switches, but as they need different DUR's I need to identify the type of switch sending the request to be able to assign correct enforcement profiles. I also need to be able to identify 2530 and Comware switches to send correct VLAN enforcements to them.

    I would prefer if it's possible to automatically identify the switch type based on the Radius request without any manual input at all. If that's not possible, is there any attribute we can modify on the switch to send a specific value for each switch model and in ClearPass use this value to assign correct Roles and Enforcements?



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    ACCX #1335, ACMP
    Aranya AB
    ------------------------------


  • 2.  RE: Automatically identify the switch family in ClearPass

    Posted Dec 21, 2020 06:14 AM

    I have not tried, but you should be able in your service matching rules to match on specific RADIUS attributes that are sent by the different solutions and match the devices in the right service based on that.

    What probably will not work is to return the correct CoA as the Vendor is bound to the RADIUS client definition, but you could even try if that is working.

    One out-of-the-box option would be to 'if not part of device groups' do an HTTP enforcement, which in the background triggers an API call to create a network device of the right type.

    And what you could explore as well is to use RADSEC and make sure the switch type can be determined from the switch's client certificate (not tested, just thinking aloud).



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
    ------------------------------



  • 3.  RE: Automatically identify the switch family in ClearPass

    Posted Dec 21, 2020 07:03 AM

    Interesting thoughts, I will investigate the different types of attributes sent from the switches and see if I'm able to differentiate the switch families. 
    If I can't distinguish the switches I will try the NAS-Identifier attribute as proposed by alagoutte.

    As the customer just have Aruba or old HPE switches, I assume the CoA will work as intended. Otherwise I have to find a way to handle that too.

    The method to trigger an HTTP enforcement and create a network device of the right type is really interesting. But I will try the other ways first.

    Thanks for feedback!



    ------------------------------
    Jonas Hammarback
    ------------------------------



  • 4.  RE: Automatically identify the switch family in ClearPass

    Posted Dec 21, 2020 07:59 AM

    not sure if it is possible to modify NAS-ID on all device (i have already see this issue on some device...)

    But the idea of API is good ! (with PowerArubaCP for example !)

    You don't have a IPAM with list of switch with device type ? (or excel file ?)



    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 5.  RE: Automatically identify the switch family in ClearPass

    Posted Dec 21, 2020 08:24 AM

    Hi

    I think you are right about the issue there it's not possible to modify the NAS-ID on some device types.

    This is a new customer for me, so I don't know the status of IPAM or CMDB yet. 

    PowerArubaCP is something I have never utilized, but thanks for the tips! I will take a look on that.



    ------------------------------
    Jonas Hammarback
    ------------------------------



  • 6.  RE: Automatically identify the switch family in ClearPass

    Posted Dec 21, 2020 06:16 AM

    Hi Jonas,

    Do you have look to configure NAS-ID for example ? (on the switch)



    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------