Wireless Access

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

ClearPass sends back the role and the VLAN via Aruba Radius Attributes.  It is by far the most flexible solution.

If you hardcode a VLAN to a role, that limits where you can (re)use that role, due to the hardcoded VLAN.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Original Message:
Sent: Sep 09, 2021 11:02 AM
From: Michael Dickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Original Message:
Sent: 9/9/2021 11:02:00 AM
From: mldickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Thanks for the replies. I should have mentioned that this is a very unique role and a dedicated vlan. No re-use of either (don't we always say that?!). What I'm hearing is in this case it may be personal choice. Of course, if the role is to be reused elsewhere it's best to let CPPM policy handle vlan assignment.

I'm leaving the vlan field blank in the role and letting CPPM assign the role + vlan via policy. This is how I originally had it but had wondered about it

Bonus question: Which takes precedent if the role were configured for a vlan and CPPM policy assigns a different vlan? Mostly curious not wishing to try this!!

Thanks again!

Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Original Message:
Sent: Sep 09, 2021 11:14 AM
From: Jim Lucas
Subject: assigned vlan within role vs vlan assignment via clearpass policy

If the role is universal, it is probably best to assign the vlan within the role.  In some instances, we might re-use a role, but assign different vlans based on other criteria, such as geographical/physical location.  

--

Jim Lucas

Network Manager

415 Kehoe

101 Broad Street

Plattsburgh, NY 12901

(o) 518-564-5322

(f)  518-564-4252

plattsburgh.edu

Original Message:
Sent: 9/9/2021 11:02:00 AM
From: mldickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Configure it and let us know.  Not having a VLAN hardcoded to a role creates fewer issues down the road.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
------------------------------

Original Message:
Sent: Sep 09, 2021 01:06 PM
From: Michael Dickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Thanks for the replies. I should have mentioned that this is a very unique role and a dedicated vlan. No re-use of either (don't we always say that?!). What I'm hearing is in this case it may be personal choice. Of course, if the role is to be reused elsewhere it's best to let CPPM policy handle vlan assignment.

I'm leaving the vlan field blank in the role and letting CPPM assign the role + vlan via policy. This is how I originally had it but had wondered about it

Bonus question: Which takes precedent if the role were configured for a vlan and CPPM policy assigns a different vlan? Mostly curious not wishing to try this!!

Thanks again!

Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst

Original Message:
Sent: Sep 09, 2021 11:14 AM
From: Jim Lucas
Subject: assigned vlan within role vs vlan assignment via clearpass policy

If the role is universal, it is probably best to assign the vlan within the role.  In some instances, we might re-use a role, but assign different vlans based on other criteria, such as geographical/physical location.  

--

Jim Lucas

Network Manager

415 Kehoe

101 Broad Street

Plattsburgh, NY 12901

(o) 518-564-5322

(f)  518-564-4252

plattsburgh.edu

Original Message:
Sent: 9/9/2021 11:02:00 AM
From: mldickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Original Message:
Sent: 9/9/2021 1:07:00 PM
From: mldickson
Subject: RE: assigned vlan within role vs vlan assignment via clearpass policy

Thanks for the replies. I should have mentioned that this is a very unique role and a dedicated vlan. No re-use of either (don't we always say that?!). What I'm hearing is in this case it may be personal choice. Of course, if the role is to be reused elsewhere it's best to let CPPM policy handle vlan assignment.

I'm leaving the vlan field blank in the role and letting CPPM assign the role + vlan via policy. This is how I originally had it but had wondered about it

Bonus question: Which takes precedent if the role were configured for a vlan and CPPM policy assigns a different vlan? Mostly curious not wishing to try this!!

Thanks again!

Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Original Message:
Sent: Sep 09, 2021 11:14 AM
From: Jim Lucas
Subject: assigned vlan within role vs vlan assignment via clearpass policy

If the role is universal, it is probably best to assign the vlan within the role.  In some instances, we might re-use a role, but assign different vlans based on other criteria, such as geographical/physical location.  

--

Jim Lucas

Network Manager

415 Kehoe

101 Broad Street

Plattsburgh, NY 12901

(o) 518-564-5322

(f)  518-564-4252

plattsburgh.edu

Original Message:
Sent: 9/9/2021 11:02:00 AM
From: mldickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

We decided to assign Vlan to the role but use a named vlan pool. That gives us the flexibility of using different Vlan Ids per controller if necessary.

I also believe it is not recommended to use the authenticated role. Create a role more descriptive & granular if possible.

------------------------------
Bruce Osborne ACCP ACMP
Liberty University

The views expressed here are my personal views and not those of my employer
------------------------------

Original Message:
Sent: Sep 09, 2021 11:02 AM
From: Michael Dickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Thanks. I'll try to test that if I get a chance. We dropped this role into production so I'll have to start new. We have many granular and specific authenticated roles!

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

Original Message:
Sent: Sep 10, 2021 07:27 AM
From: Bruce Osborne
Subject: assigned vlan within role vs vlan assignment via clearpass policy

We decided to assign Vlan to the role but use a named vlan pool. That gives us the flexibility of using different Vlan Ids per controller if necessary.

I also believe it is not recommended to use the authenticated role. Create a role more descriptive & granular if possible.

------------------------------
Bruce Osborne ACCP ACMP
Liberty University

The views expressed here are my personal views and not those of my employer

Original Message:
Sent: Sep 09, 2021 11:02 AM
From: Michael Dickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------

One other trick I found useful. If I create a policy (ACL) that is for one particular role I name it "role-" and then the role name. That makes policy management much easier.

For example, we have a couple of guest roles 
guest-limited is bandwidth restricted.
guest-full has no bandwidth restriction.

Both use the policy role-guest-limited. ( Most of our guests are bandwidth limited.)

------------------------------
Bruce Osborne ACCP ACMP
Liberty University

The views expressed here are my personal views and not those of my employer
------------------------------

Original Message:
Sent: Sep 10, 2021 10:10 AM
From: Michael Dickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Thanks. I'll try to test that if I get a chance. We dropped this role into production so I'll have to start new. We have many granular and specific authenticated roles!

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst

Original Message:
Sent: Sep 10, 2021 07:27 AM
From: Bruce Osborne
Subject: assigned vlan within role vs vlan assignment via clearpass policy

We decided to assign Vlan to the role but use a named vlan pool. That gives us the flexibility of using different Vlan Ids per controller if necessary.

I also believe it is not recommended to use the authenticated role. Create a role more descriptive & granular if possible.

------------------------------
Bruce Osborne ACCP ACMP
Liberty University

The views expressed here are my personal views and not those of my employer

Original Message:
Sent: Sep 09, 2021 11:02 AM
From: Michael Dickson
Subject: assigned vlan within role vs vlan assignment via clearpass policy

Hi all,,

AOS 6.5 and Clearpass 6.8

Have two ways to do something and looking for the most appropriate. I create an authenticated role on the controller and can assign a vlan to it. Or I can not assign a vlan to the role and through policy have Clearpass pass the role and also assign a vlan.

Six of one? Any advantages of one options over the other?

Thanks,
Mike

------------------------------
Michael Dickson
Network Engineer
University of Massachusetts Amherst
------------------------------