Security

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey

Hi Jeffrey

No, you can't create a new custom database in ClearPass, in that case you must host the database on an external database server and configure this server as a source for ClearPass to look in to validate the MAC address. But this is maybe a bit of over working the solution.

Instead you can utilize the already present device database, Guest Device Repository.
With this database you can assign a device a specific role and only grant the devices in the database access according to the assigned roles.
Even though the database is named Guest Device Repository and the administration is done under the /guest part of ClearPass it's not limited to only guest devices.

Also, if you configure Guest Operator Profiles you can delegate permissions to handle different types of devices based on AD groupd or other authorization information.
One group can be assigned permissions to add and delete security cameras another group to handle card readers for the doors etc.
If you have a need to deligate administration to local or regional staff this solution is good, as they can only handle the devices within their responsibility.

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey

Thanks for your response Jonas,

I am looking in the guest section of Clearpass right now and am I seeing this page.
We actually have two groups of devices that need to be checked; 'security' and 'utility'. Is it possible to add those two role-names to the list at 'account-role' that can be seen in the screenshot above? And is it then possible to check for this specific role in the rolemapping / enforcement in the service to send back the correct profile?

Kind regards,

Jeffrey

Hi Jeffrey

No, you can't create a new custom database in ClearPass, in that case you must host the database on an external database server and configure this server as a source for ClearPass to look in to validate the MAC address. But this is maybe a bit of over working the solution.

Instead you can utilize the already present device database, Guest Device Repository.
With this database you can assign a device a specific role and only grant the devices in the database access according to the assigned roles.
Even though the database is named Guest Device Repository and the administration is done under the /guest part of ClearPass it's not limited to only guest devices.

Also, if you configure Guest Operator Profiles you can delegate permissions to handle different types of devices based on AD groupd or other authorization information.
One group can be assigned permissions to add and delete security cameras another group to handle card readers for the doors etc.
If you have a need to deligate administration to local or regional staff this solution is good, as they can only handle the devices within their responsibility.

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey

Hi All,

Alternatively why dont we use Static Host List and list all the MACs there ?

SHL is also 'database' resides in local, to use it just configure it as one of the Authentication Source and configure the policy based on that. You can create multiple SHL so that u can group it inside different different Authc Source Profile.

Hope my explanation clear. :)

Thanks for your response Jonas,

I am looking in the guest section of Clearpass right now and am I seeing this page.
We actually have two groups of devices that need to be checked; 'security' and 'utility'. Is it possible to add those two role-names to the list at 'account-role' that can be seen in the screenshot above? And is it then possible to check for this specific role in the rolemapping / enforcement in the service to send back the correct profile?

Kind regards,

Jeffrey

Hi Jeffrey

No, you can't create a new custom database in ClearPass, in that case you must host the database on an external database server and configure this server as a source for ClearPass to look in to validate the MAC address. But this is maybe a bit of over working the solution.

Instead you can utilize the already present device database, Guest Device Repository.
With this database you can assign a device a specific role and only grant the devices in the database access according to the assigned roles.
Even though the database is named Guest Device Repository and the administration is done under the /guest part of ClearPass it's not limited to only guest devices.

Also, if you configure Guest Operator Profiles you can delegate permissions to handle different types of devices based on AD groupd or other authorization information.
One group can be assigned permissions to add and delete security cameras another group to handle card readers for the doors etc.
If you have a need to deligate administration to local or regional staff this solution is good, as they can only handle the devices within their responsibility.

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey

Thanks for your response Matchabear,

This is a better solution for my question. But how do I add a static host list as an authentication source to my service?

Hi All,

Alternatively why dont we use Static Host List and list all the MACs there ?

SHL is also 'database' resides in local, to use it just configure it as one of the Authentication Source and configure the policy based on that. You can create multiple SHL so that u can group it inside different different Authc Source Profile.

Hope my explanation clear. :)

Thanks for your response Jonas,

I am looking in the guest section of Clearpass right now and am I seeing this page.
We actually have two groups of devices that need to be checked; 'security' and 'utility'. Is it possible to add those two role-names to the list at 'account-role' that can be seen in the screenshot above? And is it then possible to check for this specific role in the rolemapping / enforcement in the service to send back the correct profile?

Kind regards,

Jeffrey

Hi Jeffrey

No, you can't create a new custom database in ClearPass, in that case you must host the database on an external database server and configure this server as a source for ClearPass to look in to validate the MAC address. But this is maybe a bit of over working the solution.

Instead you can utilize the already present device database, Guest Device Repository.
With this database you can assign a device a specific role and only grant the devices in the database access according to the assigned roles.
Even though the database is named Guest Device Repository and the administration is done under the /guest part of ClearPass it's not limited to only guest devices.

Also, if you configure Guest Operator Profiles you can delegate permissions to handle different types of devices based on AD groupd or other authorization information.
One group can be assigned permissions to add and delete security cameras another group to handle card readers for the doors etc.
If you have a need to deligate administration to local or regional staff this solution is good, as they can only handle the devices within their responsibility.

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey

Thanks for your response Matchabear,

This is a better solution for my question. But how do I add a static host list as an authentication source to my service?

Hi All,

Alternatively why dont we use Static Host List and list all the MACs there ?

SHL is also 'database' resides in local, to use it just configure it as one of the Authentication Source and configure the policy based on that. You can create multiple SHL so that u can group it inside different different Authc Source Profile.

Hope my explanation clear. :)

Thanks for your response Jonas,

I am looking in the guest section of Clearpass right now and am I seeing this page.
We actually have two groups of devices that need to be checked; 'security' and 'utility'. Is it possible to add those two role-names to the list at 'account-role' that can be seen in the screenshot above? And is it then possible to check for this specific role in the rolemapping / enforcement in the service to send back the correct profile?

Kind regards,

Jeffrey

Hi Jeffrey

No, you can't create a new custom database in ClearPass, in that case you must host the database on an external database server and configure this server as a source for ClearPass to look in to validate the MAC address. But this is maybe a bit of over working the solution.

Instead you can utilize the already present device database, Guest Device Repository.
With this database you can assign a device a specific role and only grant the devices in the database access according to the assigned roles.
Even though the database is named Guest Device Repository and the administration is done under the /guest part of ClearPass it's not limited to only guest devices.

Also, if you configure Guest Operator Profiles you can delegate permissions to handle different types of devices based on AD groupd or other authorization information.
One group can be assigned permissions to add and delete security cameras another group to handle card readers for the doors etc.
If you have a need to deligate administration to local or regional staff this solution is good, as they can only handle the devices within their responsibility.

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey

Thanks for your response Jonas,

I am looking in the guest section of Clearpass right now and am I seeing this page.
We actually have two groups of devices that need to be checked; 'security' and 'utility'. Is it possible to add those two role-names to the list at 'account-role' that can be seen in the screenshot above? And is it then possible to check for this specific role in the rolemapping / enforcement in the service to send back the correct profile?

Kind regards,

Jeffrey

Hi Jeffrey

No, you can't create a new custom database in ClearPass, in that case you must host the database on an external database server and configure this server as a source for ClearPass to look in to validate the MAC address. But this is maybe a bit of over working the solution.

Instead you can utilize the already present device database, Guest Device Repository.
With this database you can assign a device a specific role and only grant the devices in the database access according to the assigned roles.
Even though the database is named Guest Device Repository and the administration is done under the /guest part of ClearPass it's not limited to only guest devices.

Also, if you configure Guest Operator Profiles you can delegate permissions to handle different types of devices based on AD groupd or other authorization information.
One group can be assigned permissions to add and delete security cameras another group to handle card readers for the doors etc.
If you have a need to deligate administration to local or regional staff this solution is good, as they can only handle the devices within their responsibility.

Hello,

I have a question about authenticating some devices. We have some devices on the network which fall under the category 'security'. It is hard to profile them and then send back the correct role to get these devices in the correct VLAN. So what we want to do is create a new local SQL database in Clearpass where we can store the MAC addresses from these devices. Is this possible? And is it possible to use this database as an authentication source in the service to check, if a device that is trying to connect to the network, if the MAC-address is listed in this database?

Kind regards,

Jeffrey