Security

First of all I want to make it clear, I am NEW to clearpass haha with that disclaimer...

I wan to create a new condition on clear pass as follows:
If the device vendor is on a list of pre-selected vendors allows them

So, I went to my policy and I clicked on "add rule" the rule editor showed up and I selected this options:
Type: Device
Name: Device Vendor
Operator: [BELONGS_TO] - Also tried [CONTAINS] and other options
Value: NOTHING, that is the problem, no option shows up, what am I doing wrong?    <<<<<<<<<

Thanks in advance

------------------------------
Andres Solano
------------------------------

What are you trying to do? The Type: Device, I think is about the switch/AP. If you want to check the end-user device that is connecting, Endpoint or Authorization:[Endpoint Repository] will get you information about that.

It would help if you can in more detail describe what you are trying to set up, and even more important the functionality behind it that you want to achieve. Also what you have done already? Are you doing wired? Wireless? Type of authentication? You can do many things with ClearPass, and many things can be even done in multiple ways.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Original Message:
Sent: Sep 16, 2021 01:51 PM
From: Andres Solano
Subject: New condition value not showing up

First of all I want to make it clear, I am NEW to clearpass haha with that disclaimer...

I wan to create a new condition on clear pass as follows:
If the device vendor is on a list of pre-selected vendors allows them

So, I went to my policy and I clicked on "add rule" the rule editor showed up and I selected this options:
Type: Device
Name: Device Vendor
Operator: [BELONGS_TO] - Also tried [CONTAINS] and other options
Value: NOTHING, that is the problem, no option shows up, what am I doing wrong?    <<<<<<<<<

Thanks in advance

------------------------------
Andres Solano
------------------------------

Thanks for your reply.

I have configured 802.1x auth using EAP. All switches are Cisco devices, and ClearPass Manager runs version 6.9.6.
So far I was able to get my self authenticated after enabling this on a single port of a specific switch, the next step is to roll this over to all other ports, but there are some devices that do not support 802.1x like printers, badge readers, CCTV enpoints,  ip phones, vending machines, smart TVs and more. So I was hoping to do is to allow these devices by default, either by identifying them by type or by MAC vendor or so.
I know about the endpoint repository, but managing it would be really painful because the amount of devices is huge and could change over time with no one informing us about the new devices.
Initially I thought on creating some sort of rule to "allow all" but creating a log that mentions it was not authenticated so we can act on it before closing the door to the device, but I guess it doesn't make any sense from the protocol/solution perspective.
Any ideas on how to to and maintain this?

------------------------------
Andres Solano
------------------------------

Original Message:
Sent: Sep 17, 2021 11:24 AM
From: Herman Robers
Subject: New condition value not showing up

What are you trying to do? The Type: Device, I think is about the switch/AP. If you want to check the end-user device that is connecting, Endpoint or Authorization:[Endpoint Repository] will get you information about that.

It would help if you can in more detail describe what you are trying to set up, and even more important the functionality behind it that you want to achieve. Also what you have done already? Are you doing wired? Wireless? Type of authentication? You can do many things with ClearPass, and many things can be even done in multiple ways.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 16, 2021 01:51 PM
From: Andres Solano
Subject: New condition value not showing up

First of all I want to make it clear, I am NEW to clearpass haha with that disclaimer...

I wan to create a new condition on clear pass as follows:
If the device vendor is on a list of pre-selected vendors allows them

So, I went to my policy and I clicked on "add rule" the rule editor showed up and I selected this options:
Type: Device
Name: Device Vendor
Operator: [BELONGS_TO] - Also tried [CONTAINS] and other options
Value: NOTHING, that is the problem, no option shows up, what am I doing wrong?    <<<<<<<<<

Thanks in advance

------------------------------
Andres Solano
------------------------------

The best approach would be to profile these devices and leverage the profiling info like Type, family etc to return the corresponding VLAN/ACLs.
As these devices might not be 802.1x compatible, you could enable MAB on the switch and create a new service on CPPM for MAC Auth with Allow All MAC auth while having the Profiler TAB enabled.

------------------------------
SANDEEP YADAV
Global Escalation Center, ACCP
------------------------------

Original Message:
Sent: Sep 20, 2021 12:18 PM
From: Andres Solano
Subject: New condition value not showing up

Thanks for your reply.

I have configured 802.1x auth using EAP. All switches are Cisco devices, and ClearPass Manager runs version 6.9.6.
So far I was able to get my self authenticated after enabling this on a single port of a specific switch, the next step is to roll this over to all other ports, but there are some devices that do not support 802.1x like printers, badge readers, CCTV enpoints,  ip phones, vending machines, smart TVs and more. So I was hoping to do is to allow these devices by default, either by identifying them by type or by MAC vendor or so.
I know about the endpoint repository, but managing it would be really painful because the amount of devices is huge and could change over time with no one informing us about the new devices.
Initially I thought on creating some sort of rule to "allow all" but creating a log that mentions it was not authenticated so we can act on it before closing the door to the device, but I guess it doesn't make any sense from the protocol/solution perspective.
Any ideas on how to to and maintain this?

------------------------------
Andres Solano

Original Message:
Sent: Sep 17, 2021 11:24 AM
From: Herman Robers
Subject: New condition value not showing up

What are you trying to do? The Type: Device, I think is about the switch/AP. If you want to check the end-user device that is connecting, Endpoint or Authorization:[Endpoint Repository] will get you information about that.

It would help if you can in more detail describe what you are trying to set up, and even more important the functionality behind it that you want to achieve. Also what you have done already? Are you doing wired? Wireless? Type of authentication? You can do many things with ClearPass, and many things can be even done in multiple ways.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 16, 2021 01:51 PM
From: Andres Solano
Subject: New condition value not showing up

First of all I want to make it clear, I am NEW to clearpass haha with that disclaimer...

I wan to create a new condition on clear pass as follows:
If the device vendor is on a list of pre-selected vendors allows them

So, I went to my policy and I clicked on "add rule" the rule editor showed up and I selected this options:
Type: Device
Name: Device Vendor
Operator: [BELONGS_TO] - Also tried [CONTAINS] and other options
Value: NOTHING, that is the problem, no option shows up, what am I doing wrong?    <<<<<<<<<

Thanks in advance

------------------------------
Andres Solano
------------------------------

Thanks Sandeep,

Do you happen to have  sample configuration or guide for this solution you are proposing?

Regards,

------------------------------
Andres Solano
Sr Network Engineer
San Jose
------------------------------

Original Message:
Sent: Sep 20, 2021 08:24 PM
From: Sandeep Yadav
Subject: New condition value not showing up

The best approach would be to profile these devices and leverage the profiling info like Type, family etc to return the corresponding VLAN/ACLs.
As these devices might not be 802.1x compatible, you could enable MAB on the switch and create a new service on CPPM for MAC Auth with Allow All MAC auth while having the Profiler TAB enabled.

------------------------------
SANDEEP YADAV
Global Escalation Center, ACCP

Original Message:
Sent: Sep 20, 2021 12:18 PM
From: Andres Solano
Subject: New condition value not showing up

Thanks for your reply.

I have configured 802.1x auth using EAP. All switches are Cisco devices, and ClearPass Manager runs version 6.9.6.
So far I was able to get my self authenticated after enabling this on a single port of a specific switch, the next step is to roll this over to all other ports, but there are some devices that do not support 802.1x like printers, badge readers, CCTV enpoints,  ip phones, vending machines, smart TVs and more. So I was hoping to do is to allow these devices by default, either by identifying them by type or by MAC vendor or so.
I know about the endpoint repository, but managing it would be really painful because the amount of devices is huge and could change over time with no one informing us about the new devices.
Initially I thought on creating some sort of rule to "allow all" but creating a log that mentions it was not authenticated so we can act on it before closing the door to the device, but I guess it doesn't make any sense from the protocol/solution perspective.
Any ideas on how to to and maintain this?

------------------------------
Andres Solano

Original Message:
Sent: Sep 17, 2021 11:24 AM
From: Herman Robers
Subject: New condition value not showing up

What are you trying to do? The Type: Device, I think is about the switch/AP. If you want to check the end-user device that is connecting, Endpoint or Authorization:[Endpoint Repository] will get you information about that.

It would help if you can in more detail describe what you are trying to set up, and even more important the functionality behind it that you want to achieve. Also what you have done already? Are you doing wired? Wireless? Type of authentication? You can do many things with ClearPass, and many things can be even done in multiple ways.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 16, 2021 01:51 PM
From: Andres Solano
Subject: New condition value not showing up

First of all I want to make it clear, I am NEW to clearpass haha with that disclaimer...

I wan to create a new condition on clear pass as follows:
If the device vendor is on a list of pre-selected vendors allows them

So, I went to my policy and I clicked on "add rule" the rule editor showed up and I selected this options:
Type: Device
Name: Device Vendor
Operator: [BELONGS_TO] - Also tried [CONTAINS] and other options
Value: NOTHING, that is the problem, no option shows up, what am I doing wrong?    <<<<<<<<<

Thanks in advance

------------------------------
Andres Solano
------------------------------

You could follow the Wired Policy Guide, It has examples for both Cisco as well as Aruba Switches with Profiler config on CPPM

https://support.hpe.com/hpesc/public/docDisplay?docId=a00091135en_us

------------------------------
SANDEEP YADAV
Global Escalation Center, ACCP
------------------------------

Original Message:
Sent: Sep 21, 2021 10:27 AM
From: Andres Solano
Subject: New condition value not showing up

Thanks Sandeep,

Do you happen to have  sample configuration or guide for this solution you are proposing?

Regards,

------------------------------
Andres Solano
Sr Network Engineer
San Jose

Original Message:
Sent: Sep 20, 2021 08:24 PM
From: Sandeep Yadav
Subject: New condition value not showing up

The best approach would be to profile these devices and leverage the profiling info like Type, family etc to return the corresponding VLAN/ACLs.
As these devices might not be 802.1x compatible, you could enable MAB on the switch and create a new service on CPPM for MAC Auth with Allow All MAC auth while having the Profiler TAB enabled.

------------------------------
SANDEEP YADAV
Global Escalation Center, ACCP

Original Message:
Sent: Sep 20, 2021 12:18 PM
From: Andres Solano
Subject: New condition value not showing up

Thanks for your reply.

I have configured 802.1x auth using EAP. All switches are Cisco devices, and ClearPass Manager runs version 6.9.6.
So far I was able to get my self authenticated after enabling this on a single port of a specific switch, the next step is to roll this over to all other ports, but there are some devices that do not support 802.1x like printers, badge readers, CCTV enpoints,  ip phones, vending machines, smart TVs and more. So I was hoping to do is to allow these devices by default, either by identifying them by type or by MAC vendor or so.
I know about the endpoint repository, but managing it would be really painful because the amount of devices is huge and could change over time with no one informing us about the new devices.
Initially I thought on creating some sort of rule to "allow all" but creating a log that mentions it was not authenticated so we can act on it before closing the door to the device, but I guess it doesn't make any sense from the protocol/solution perspective.
Any ideas on how to to and maintain this?

------------------------------
Andres Solano

Original Message:
Sent: Sep 17, 2021 11:24 AM
From: Herman Robers
Subject: New condition value not showing up

What are you trying to do? The Type: Device, I think is about the switch/AP. If you want to check the end-user device that is connecting, Endpoint or Authorization:[Endpoint Repository] will get you information about that.

It would help if you can in more detail describe what you are trying to set up, and even more important the functionality behind it that you want to achieve. Also what you have done already? Are you doing wired? Wireless? Type of authentication? You can do many things with ClearPass, and many things can be even done in multiple ways.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Sep 16, 2021 01:51 PM
From: Andres Solano
Subject: New condition value not showing up

First of all I want to make it clear, I am NEW to clearpass haha with that disclaimer...

I wan to create a new condition on clear pass as follows:
If the device vendor is on a list of pre-selected vendors allows them

So, I went to my policy and I clicked on "add rule" the rule editor showed up and I selected this options:
Type: Device
Name: Device Vendor
Operator: [BELONGS_TO] - Also tried [CONTAINS] and other options
Value: NOTHING, that is the problem, no option shows up, what am I doing wrong?    <<<<<<<<<

Thanks in advance

------------------------------
Andres Solano
------------------------------