Security

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

A device is marked "machine authenticated" whenever the mac address has passed machine authentication in the past.  There is a timeout value that would purge that state, but unfortunately, the machine authenticated role is renewed every time the device user authenticates, if the machine authentication role has not expired for that mac address.

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

Hi Colin,

This device was before a domain PC and passed machine authentication in the past. After that, we took out from the domain the PC. That could answer the question, but the Machine Authentication Cache Timeout is set to 24 hours, and we took the PC out of the domain a week ago. Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? By the way, no user authentication happens, now is only MAC authentication service.

A device is marked "machine authenticated" whenever the mac address has passed machine authentication in the past.  There is a timeout value that would purge that state, but unfortunately, the machine authenticated role is renewed every time the device user authenticates, if the machine authentication role has not expired for that mac address.

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? - Yes.

Hi Colin,

This device was before a domain PC and passed machine authentication in the past. After that, we took out from the domain the PC. That could answer the question, but the Machine Authentication Cache Timeout is set to 24 hours, and we took the PC out of the domain a week ago. Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? By the way, no user authentication happens, now is only MAC authentication service.

A device is marked "machine authenticated" whenever the mac address has passed machine authentication in the past.  There is a timeout value that would purge that state, but unfortunately, the machine authenticated role is renewed every time the device user authenticates, if the machine authentication role has not expired for that mac address.

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

Hi Colin,

What a pitty, that's confusing. And when you say "device user authenticates", in my case the device user authentication refers to device MAC authentication, right?

Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? - Yes.

Hi Colin,

This device was before a domain PC and passed machine authentication in the past. After that, we took out from the domain the PC. That could answer the question, but the Machine Authentication Cache Timeout is set to 24 hours, and we took the PC out of the domain a week ago. Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? By the way, no user authentication happens, now is only MAC authentication service.

A device is marked "machine authenticated" whenever the mac address has passed machine authentication in the past.  There is a timeout value that would purge that state, but unfortunately, the machine authenticated role is renewed every time the device user authenticates, if the machine authentication role has not expired for that mac address.

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

If your timeout is 24 hours, I would do nothing with that device for 24 hours and see what happens.

Hi Colin,

What a pitty, that's confusing. And when you say "device user authenticates", in my case the device user authentication refers to device MAC authentication, right?

Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? - Yes.

Hi Colin,

This device was before a domain PC and passed machine authentication in the past. After that, we took out from the domain the PC. That could answer the question, but the Machine Authentication Cache Timeout is set to 24 hours, and we took the PC out of the domain a week ago. Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? By the way, no user authentication happens, now is only MAC authentication service.

A device is marked "machine authenticated" whenever the mac address has passed machine authentication in the past.  There is a timeout value that would purge that state, but unfortunately, the machine authenticated role is renewed every time the device user authenticates, if the machine authentication role has not expired for that mac address.

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?

Honestly, you can just not have any rules that act upon Machine Authentication role in a service that does mac authentication.

If your timeout is 24 hours, I would do nothing with that device for 24 hours and see what happens.

Hi Colin,

What a pitty, that's confusing. And when you say "device user authenticates", in my case the device user authentication refers to device MAC authentication, right?

Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? - Yes.

Hi Colin,

This device was before a domain PC and passed machine authentication in the past. After that, we took out from the domain the PC. That could answer the question, but the Machine Authentication Cache Timeout is set to 24 hours, and we took the PC out of the domain a week ago. Do you mean the machine authentication role is renewed when the device user authenticates regardless of the Machine Authentication Cache Timeout setting? By the way, no user authentication happens, now is only MAC authentication service.

A device is marked "machine authenticated" whenever the mac address has passed machine authentication in the past.  There is a timeout value that would purge that state, but unfortunately, the machine authenticated role is renewed every time the device user authenticates, if the machine authentication role has not expired for that mac address.

Hi Shpat,

The article talks when you uses 802.1x authentication, which is not my case. I am using MAC authentication, and the PC is not configured for 802.1x.

Have you read this article Clearpass 6.7 Deployment Guide

There is a section named Role Assignment with Machine Authentication Enabled where you can see more information.

Hope this helps

Hi community,

I have created a service for MAC authentication. I am testing right now and have a phone and a PC, I have both in a static host list. When they pass authentication, my phone got role [User Authenticated], and my PC got roles [User Authenticated] and [Machine Authenticated]. Is this normal behaviour? I thought the Machine Authenticated role is only for domain PCs. Any idea?