MACHINE AND USER AUTHENTICATION IN WINDOWS WITH CLEARPASS
I have created this tutorial, but let me tell you one thing that, this is not the first tutorial on this topic. You can find another great tutorial on the same in this forum, which also helps me a lot.
Sometimes we need more than just user authentication, in this document I will share the configuration steps needed to enforce machine and user authentication and also put per user based role.SCENARIO:1. If a user complete USER+MACHINE both authentication, then the user will get 'authenticated' role along with VLAN12. If a user complete only any of the above authentication [USER or MACHINE], the user will get 'guest' role along with VLAN2.
INTRODUCTION:The following was completed using Clearpass 6.4.1, a windows 2012, a 3600 running 188.8.131.52 and AP-93.Clearpass is joined to domain and able to access the server.You can find another good guide on the same inHow-to-Machine-AND-User-Authentication-in-Windows-with-ClearpassCONFIGURATION:A. At first we will create one custom endpoint attribute, it will validate our valid device.Go to Administration » Dictionaries » Attributes and in right left corner click on add to add a custom attribute. The attribute should be endpoint attribute and boolean.
B. Now we will configure enforcement profile. For this scenario we need three enforcement profile.Open Configuration » Enforcement » Profiles. Follow this screenshot.First enforcement profile is a post authentication profile to enforce the attribute, for this we will select Clearpass entity update enforcement template.
Now 2nd one for authenticated users. In here we will give the user ‘authenticated’ role and after that assigned them to VLAN1.
3rd profile for the user, who completed only one authentication. Here we will give the user ‘guest’ role along with VLAN2
C. After configuring enforcement profile we have to configure enforcement policy which will bundle all the three enforcement profile.Open Configuration » Enforcement » Policies
D. Now we have configure one role mapping policy to tag information in the request so later we can use it in enforcement profile. Also create one role to map this.Go to Configuration » Identity » Role Mapping
E. Now the most important things, we have to configure one service.Check the summary tab of the service. Remember to enable authorization source in service tab.
Open authentication tab and select AD as a authentication source, EAP-PEAP and EAP-MSCHAPV2 as authentication method [this two is enough to handle the AAA process but if you want or if you have legacy device you always can configure other authentication method].
In controller side nothing to do, just make sure that you have the VLAN and Role configured in controller, because what are you defining[VLAN & Role] here will take effect from the controller.We need to configure our wireless ssid profile to make the both authentication work. Below are the configuration steps.Go to Control Panel\Network and Internet\Manage Wireless Networks click add and add your desired network and go to the setting.
that's all. Now its time to check output
In above user has completed both authentication so it’s got authenticated role along with VLAN1.
In above users has completed only one authentication so it’s got guest role along with VLAN2.
Hope you guys enjoyed.Let me know if there are any questions or follow-ups - I would love to hear them!
@cappalli wrote:Nice job. Just a comment. You should NEVER uncheck validate servercertificate except for testing. If you are not validating the servercertificate, you are better off not using any security.
Thanks Tim for correction,
I configured this in my lab and after I forgot to mention that.
Also sorry for the mistake.
I'm new to Aruba and I would like to ask a question about machine + user authentication.
As I understand, the concept is to set endpoint attribute value to "true" after machine is successfully authenticated. Than user that is using the same endpoint (endpoint recorded during machine authentication) matches appropriate enforcement policy if endpoint attribute's value is still "true".
For how long this endpoint attribute value will stay as "true"?
If I successfully log in to the computer and restart computer and I'm trying to log in angain - is the endpoint attribute value set to "true" already or it has to be set to "true" again?
Machine Authentication Cache Timeout option (24 hours by default): https://www.arubanetworks.com/techdocs/ClearPass/6.7/PolicyManager/index.htm#CPPM_UserGuide/Admin/ServerConfig_serviceparamspolicyserver.htm?Highlight=machine%20authentication%20cache
Closing this thread because it is old. Please use a new thread for further questions.
I'll try this.Please upload the pdf also.
@Rana wrote:Great,I'll try this.Please upload the pdf also.
Now 2nd one for authenticated users. In here we will give the user 'authenticated' role and after that assigned them to VLAN1.
3rd profile for the user, who completed only one authentication. Here we will give the user 'guest' role along with VLAN2
In above user has completed both authentication so it's got authenticated role along with VLAN1.
In above users has completed only one authentication so it's got guest role along with VLAN2.
At Aruba, we believe that the most dynamic customer experiences happen at the Edge. Our mission is to deliver innovative solutions that harness data at the Edge to drive powerful business outcomes.
© Copyright 2021 Hewlett Packard Enterprise Development LPAll Rights Reserved.