Security

Hi everyone - So my company has been using the intune clearpass extension v6 on our network.  We are currently have periodic sync enabled, and we are using HTTP realtime authorizations.  We are noticing that there is a great deal of latency to connect to Office 365\Intune to query device info.

We also have to account for random MAC Addresses and for device that do not pass MAC Addresses to Intune.  So I was told that periodic sync cannot be used without HTTP realtime auth.

Does anyone have a best practices document outside of the normal configuration?  For example, should we have multiple AzureAD app registrations for our various clearpass nodes.

The 'trick' is to use the Intune Device ID and you can still use the synchronized data from the endpoint database and would not need realtime.

The ClearPass, Azure AD, and Intune presentation from Atmosphere Local can help you to get some better view and the pro/cons for HTTP Realtime vs synchronized.

Hi everyone - So my company has been using the intune clearpass extension v6 on our network.  We are currently have periodic sync enabled, and we are using HTTP realtime authorizations.  We are noticing that there is a great deal of latency to connect to Office 365\Intune to query device info.

We also have to account for random MAC Addresses and for device that do not pass MAC Addresses to Intune.  So I was told that periodic sync cannot be used without HTTP realtime auth.

Does anyone have a best practices document outside of the normal configuration?  For example, should we have multiple AzureAD app registrations for our various clearpass nodes.

Thank you Herman for this info!  Is there a way that ClearPass can "pick and choose" which method to use based upon availability of the MAC Address in the database.  For example if we have a surface hub that doesn't send the proper MAC Address to Intune....or interms of randomized mac.

SO if MAC not found...use realtime lookup....or if MAC present from periodic sync...do not use Realtime lookup?

Let me know if that makes sense.

Thanks!

The 'trick' is to use the Intune Device ID and you can still use the synchronized data from the endpoint database and would not need realtime.

The ClearPass, Azure AD, and Intune presentation from Atmosphere Local can help you to get some better view and the pro/cons for HTTP Realtime vs synchronized.

Hi everyone - So my company has been using the intune clearpass extension v6 on our network.  We are currently have periodic sync enabled, and we are using HTTP realtime authorizations.  We are noticing that there is a great deal of latency to connect to Office 365\Intune to query device info.

We also have to account for random MAC Addresses and for device that do not pass MAC Addresses to Intune.  So I was told that periodic sync cannot be used without HTTP realtime auth.

Does anyone have a best practices document outside of the normal configuration?  For example, should we have multiple AzureAD app registrations for our various clearpass nodes.

I see the point, but I don't think there are 'conditional Authorization sources'; ClearPass can query multiple authentication sources in parallel or no specific order, and it will just try all of them.

For this use-case you may open an idea in the Aruba Innovation Zone to see if there are more customers running into the same issue. BTW, if you have significant delays with the real-time lookups, where for me everything under a second would not really be significant for the purpose, then it's good to open a TAC case to investigate why that happens.

Thank you Herman for this info!  Is there a way that ClearPass can "pick and choose" which method to use based upon availability of the MAC Address in the database.  For example if we have a surface hub that doesn't send the proper MAC Address to Intune....or interms of randomized mac.

SO if MAC not found...use realtime lookup....or if MAC present from periodic sync...do not use Realtime lookup?

Let me know if that makes sense.

Thanks!

The 'trick' is to use the Intune Device ID and you can still use the synchronized data from the endpoint database and would not need realtime.

The ClearPass, Azure AD, and Intune presentation from Atmosphere Local can help you to get some better view and the pro/cons for HTTP Realtime vs synchronized.

Hi everyone - So my company has been using the intune clearpass extension v6 on our network.  We are currently have periodic sync enabled, and we are using HTTP realtime authorizations.  We are noticing that there is a great deal of latency to connect to Office 365\Intune to query device info.

We also have to account for random MAC Addresses and for device that do not pass MAC Addresses to Intune.  So I was told that periodic sync cannot be used without HTTP realtime auth.

Does anyone have a best practices document outside of the normal configuration?  For example, should we have multiple AzureAD app registrations for our various clearpass nodes.

I see the point, but I don't think there are 'conditional Authorization sources'; ClearPass can query multiple authentication sources in parallel or no specific order, and it will just try all of them.

For this use-case you may open an idea in the Aruba Innovation Zone to see if there are more customers running into the same issue. BTW, if you have significant delays with the real-time lookups, where for me everything under a second would not really be significant for the purpose, then it's good to open a TAC case to investigate why that happens.

Thank you Herman for this info!  Is there a way that ClearPass can "pick and choose" which method to use based upon availability of the MAC Address in the database.  For example if we have a surface hub that doesn't send the proper MAC Address to Intune....or interms of randomized mac.

SO if MAC not found...use realtime lookup....or if MAC present from periodic sync...do not use Realtime lookup?

Let me know if that makes sense.

Thanks!

The 'trick' is to use the Intune Device ID and you can still use the synchronized data from the endpoint database and would not need realtime.

The ClearPass, Azure AD, and Intune presentation from Atmosphere Local can help you to get some better view and the pro/cons for HTTP Realtime vs synchronized.

Hi everyone - So my company has been using the intune clearpass extension v6 on our network.  We are currently have periodic sync enabled, and we are using HTTP realtime authorizations.  We are noticing that there is a great deal of latency to connect to Office 365\Intune to query device info.

We also have to account for random MAC Addresses and for device that do not pass MAC Addresses to Intune.  So I was told that periodic sync cannot be used without HTTP realtime auth.

Does anyone have a best practices document outside of the normal configuration?  For example, should we have multiple AzureAD app registrations for our various clearpass nodes.