Security

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks

I'm confused as to what you are doing.  Known vs Unknown is used by MAC auth and the endpoint database cleanup criteria.  The setting shouldn't have any impact for TEAP since you're using credentials with TLS or PEAP.  After you've successfully authenticated the device use an endpoint action to automatically mark the endpoint as known if that is what you need to do.

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks

Hello @chulcher

The problem is that the device is not authenticated properly as the dock has a different ethernet Mac address. That is conflicting with the existed one on Intune. 

I am going to work on the machine auth then since that is my only roadblock as of right now. 

I'm confused as to what you are doing.  Known vs Unknown is used by MAC auth and the endpoint database cleanup criteria.  The setting shouldn't have any impact for TEAP since you're using credentials with TLS or PEAP.  After you've successfully authenticated the device use an endpoint action to automatically mark the endpoint as known if that is what you need to do.

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks

Hi

Can you share the configuration of your role mapping and enforcement policies? Do you have any condition in the policies that evaluates if the status is Known?

As Carson mentioned, the status should only have impact in some use cases with MAC authentication, like guest MAC caching.

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks

Hello @jonas.hammarback

Maybe that is a good idea. I could put a place a polices that evaluate when a device a marked unknown. I will look at that option. 

Here are my enforcement and roles screenshots.

I already have devices sync from Intune. But when I pug into the dock, it gets a different Mac address from the dock ethernet card. So Clearness think it is a new device and does not know how to classify it.

You can see from the screenshot that second one is known and the first one is from the docking station. 

Thanks

Hi

Can you share the configuration of your role mapping and enforcement policies? Do you have any condition in the policies that evaluates if the status is Known?

As Carson mentioned, the status should only have impact in some use cases with MAC authentication, like guest MAC caching.

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks

Is there something in the role mapping policy that is evaluating the endpoint status?  I see nothing in the enforcement policy.

Hello @jonas.hammarback

Maybe that is a good idea. I could put a place a polices that evaluate when a device a marked unknown. I will look at that option. 

Here are my enforcement and roles screenshots.

I already have devices sync from Intune. But when I pug into the dock, it gets a different Mac address from the dock ethernet card. So Clearness think it is a new device and does not know how to classify it.

You can see from the screenshot that second one is known and the first one is from the docking station. 

Thanks

Hi

Can you share the configuration of your role mapping and enforcement policies? Do you have any condition in the policies that evaluates if the status is Known?

As Carson mentioned, the status should only have impact in some use cases with MAC authentication, like guest MAC caching.

Hello Guys,

I have configured Teap successfully on wireless. Thank you everyone for their input. I am facing a new problem on the wire side. 

At my company we use docking station to plug in our ethernet cable and the docking station as a different MAC address than the wireless one. Every time I tried a new dock,

Clearpass associated the host name to the dock Mac-address but it come up as unknown in the endpoint. 

Unless, I make that Mac-address know, Clearness would always reject the computer on the TEAP config. Should I configure the teap differently because it is impossible to note

every docking station mac-address.

Any help would be appreciated.

Thanks