Security

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

In order to profile new/unknown devices, you would need to provide them with some form of access. If you reject the authentication, there is no network connectivity at all, so there won't be profiling possible.

One solution would be to add a rule at the bottom of your enforcement policy that just checks for [User Authenticated] (and not further roles) and assign an enforcement that is acceptable for unknown devices, like internet only or even just DHCP such that profiling can happen.

In general, you should not reject authentications, but instead accept those with strict needed or acceptable limited access.

BTW, you probably should not use PEAP. Encryption for that is broken and unless you fully control your client devices really well, you should consider the user (or computer) credentials to be exposed.

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Hi Herman,

like this?

In order to profile new/unknown devices, you would need to provide them with some form of access. If you reject the authentication, there is no network connectivity at all, so there won't be profiling possible.

One solution would be to add a rule at the bottom of your enforcement policy that just checks for [User Authenticated] (and not further roles) and assign an enforcement that is acceptable for unknown devices, like internet only or even just DHCP such that profiling can happen.

In general, you should not reject authentications, but instead accept those with strict needed or acceptable limited access.

BTW, you probably should not use PEAP. Encryption for that is broken and unless you fully control your client devices really well, you should consider the user (or computer) credentials to be exposed.

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Hi Herman,

like this?

In order to profile new/unknown devices, you would need to provide them with some form of access. If you reject the authentication, there is no network connectivity at all, so there won't be profiling possible.

One solution would be to add a rule at the bottom of your enforcement policy that just checks for [User Authenticated] (and not further roles) and assign an enforcement that is acceptable for unknown devices, like internet only or even just DHCP such that profiling can happen.

In general, you should not reject authentications, but instead accept those with strict needed or acceptable limited access.

BTW, you probably should not use PEAP. Encryption for that is broken and unless you fully control your client devices really well, you should consider the user (or computer) credentials to be exposed.

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

I'm don't think that Full-Username has the value 'username'; I typically use 'Tips:Role EQUALS [User-Authenticated]'; so like your rule 4 but without the other Role matches.

As Gorazd mentions, you can set the default enforcement profile as well, but I personally prefer to use the Tips:Role EQUALS [User-Authenticated] as it's always true for authenticated users, but more because it makes your policy more explicit. You see immediately what the policy does at the bottom, where if it falls through to the default poilicy, it's a bit harder to read.

Hi Herman,

like this?

In order to profile new/unknown devices, you would need to provide them with some form of access. If you reject the authentication, there is no network connectivity at all, so there won't be profiling possible.

One solution would be to add a rule at the bottom of your enforcement policy that just checks for [User Authenticated] (and not further roles) and assign an enforcement that is acceptable for unknown devices, like internet only or even just DHCP such that profiling can happen.

In general, you should not reject authentications, but instead accept those with strict needed or acceptable limited access.

BTW, you probably should not use PEAP. Encryption for that is broken and unless you fully control your client devices really well, you should consider the user (or computer) credentials to be exposed.

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Hi Sir,

I have removed the PEAP conditons and just now have two. I am not really sure if I still actually need to replace the Auth Peap Role conditions or having these two conditions only but changing the default provile to Allow access Profile and not deny? also how do I accomplish this? "assign an enforcement that is acceptable for unknown devices, like internet only or even just DHCP such that profiling can happen. In general, you should not reject authentications, but instead accept those with strict needed or acceptable limited access." Thank you so much

I'm don't think that Full-Username has the value 'username'; I typically use 'Tips:Role EQUALS [User-Authenticated]'; so like your rule 4 but without the other Role matches.

As Gorazd mentions, you can set the default enforcement profile as well, but I personally prefer to use the Tips:Role EQUALS [User-Authenticated] as it's always true for authenticated users, but more because it makes your policy more explicit. You see immediately what the policy does at the bottom, where if it falls through to the default poilicy, it's a bit harder to read.

Hi Herman,

like this?

In order to profile new/unknown devices, you would need to provide them with some form of access. If you reject the authentication, there is no network connectivity at all, so there won't be profiling possible.

One solution would be to add a rule at the bottom of your enforcement policy that just checks for [User Authenticated] (and not further roles) and assign an enforcement that is acceptable for unknown devices, like internet only or even just DHCP such that profiling can happen.

In general, you should not reject authentications, but instead accept those with strict needed or acceptable limited access.

BTW, you probably should not use PEAP. Encryption for that is broken and unless you fully control your client devices really well, you should consider the user (or computer) credentials to be exposed.

Are you sending client DHCP request to your ClearPass? 

Generally you need ip helper command on your router/switch to also point to IP address of ClearPass. This way ClearPass will see the DHCP request and can use it for profiling.

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help

Hi, Can someone please help me fix? users are not profiled in clearpass hence rejected... thank you for any help