Security

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

I'm curious, why are you testing on NAS-Port-Type in a role mapping?

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

I'm curious, why are you testing on NAS-Port-Type in a role mapping?

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

Ah.  But you are filtering the service on that same attribute, right?

I'm curious, why are you testing on NAS-Port-Type in a role mapping?

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

Ah.  But you are filtering the service on that same attribute, right?

I'm curious, why are you testing on NAS-Port-Type in a role mapping?

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert

Ah, that makes more sense then.  I've been bitten by using common items too many times to go that route anymore.

Ah.  But you are filtering the service on that same attribute, right?

I'm curious, why are you testing on NAS-Port-Type in a role mapping?

Dear All,

I am relatively new to Aruba and have been trying to figure out how to configure which certificate field should be used as the identity information when using EAP-TLS.

The devices we need to authenticate are not domain members, but rather printers and phones, which have an "EAP Identity" field in their GUI. However, instead of using this field, we would like to use the Common Name (CN) field from their certificate as the identity.

The reason for this is that the certificates are unique, while the "EAP Identity" field can be modified by anyone. If multiple devices have the same string in that field, the logs could become confusing and difficult to manage.

Any guidance on how to configure this in ClearPass would be greatly appreciated.

Thank you.

Best regards,
Norbert