Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Clearpass - Profiling/Importing fixed ip address device

This thread has been viewed 40 times

  • 1.  Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 04, 2022 08:42 PM

    Hello everyone,

    We have a number of existing CCTV currently with fixed ip address and would like to import to clearpasss to setup mac-authentication with the switch user role.

    Just wondering if I can do a bulk import to the endpoints database without going through the device profiling.  
    Can I categories it or  set up some attribute to mark those as "permitted known" device"?

    I believe device profiling is more suitable for new devices.
    However, I still want put some control to the "unknown" device so it will not be assigned to the same user role as the "known" device automatically.

    Thanks in advance for any suggestion.


  • 2.  RE: Clearpass - Profiling/Importing fixed ip address device

    EMPLOYEE
    Posted Sep 04, 2022 10:58 PM
    yes you can import them through XML import.
    you can export one to see the XML formatted file


    https://www.arubanetworks.com/techdocs/ClearPass/6.9/PolicyManager/Content/CPPM_UserGuide/Admin/EndpointsHelp.html

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------

    Original Message


  • 3.  RE: Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 06, 2022 01:00 AM
    Thanks a lot, much appreciated.
    Original Message


  • 4.  RE: Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 06, 2022 02:19 AM
    Hello,

    You can also use the Guest Devices repository which is easy to manage and import csv list. 

    Another advantage of this method is that you can delegate devices creation / import to Guest Operator without giving full Policy Manager access

    Regards

    Christian
    Original Message


  • 5.  RE: Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 07, 2022 12:20 AM
    Good option! Thank you.
    Just wonder if we can profile the devices with clearpass scanning only.
    Original Message


  • 6.  RE: Clearpass - Profiling/Importing fixed ip address device

    EMPLOYEE
    Posted Sep 07, 2022 04:24 AM
    also be aware that we have a tool for converting CSV/TSV to XML to be imported into clearpass endpoints
    https://ase.arubanetworks.com/solutions/id/91

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------

    Original Message


  • 7.  RE: Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 07, 2022 08:16 PM
    That's good tool. Thank you!
    Original Message


  • 8.  RE: Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 13, 2022 03:08 AM
    It does not work. When XML populated with new mac addresses who never recognized by clearpass before, endpoint repository won't take it. Only mac addresses are imported.
    Original Message


  • 9.  RE: Clearpass - Profiling/Importing fixed ip address device

    EMPLOYEE
    Posted Sep 13, 2022 05:03 AM
    Import through API or XML will not set profiling information. It does set the Known/Unknown status, and you can import attributes. The original question was just about setting the Known flag, which works. You may see expected behavior, if you only set profiling data.

    Profiling data is what is discovered by the system, and may change if the device changes, so there is a design reason why you can't import profiling attributes.

    If you also want to set the device type, you could do that through a device attribute and test that in your policy; or as mentioned earlier use the Guest Device Database, which is similar on setting attributes but in a slightly different form. If you need to have non-admins manage the device registrations, using the Guest Device Database is probably the best option; if it is just admins or API access the Endpoint Database is a good choice.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 10.  RE: Clearpass - Profiling/Importing fixed ip address device

    Posted Sep 13, 2022 07:27 AM
    Hi Herman,

    Thanks for the reply once again.

    Can I consider to say that Guest Device registration is actually a manual way of profiling ?

    Yeah I found your YouTube video very helpful about setting the guest operator profiles.

    But I never explored API myself. Does it require to open some ports in the firewall to allow traffic to clearpass ? What is the source and destination ? Is it NAD to clearpass, or from endpoint to clearpass ?
    Original Message