AAA, NAC, Guest Access & BYOD

Requirement:

Customize ClearPass SSH login to allow AD users to login to ClearPass CLI using AD accounts.

• ClearPass versions prior to 6.8.0 only allows CLI login with "appadmin" as username
• Starting from 6.8.0, CLI login can be customized to allow other users like AD users to use their AD credentials to login in ClearPass SSH access
• CLI login with usernames other than appadmin username generates TACACS request and will be visible in access tracker
• We can create customized TACACS login service in ClearPass to handle this requests.

• Please use following service rules to differentiate TACACS SSH login request from other TACACS requests:

• You could map AD or any source as user authentication source in Authentication section
• Authorization and roles can be defined for users based on requirement
• Important part of this configuration is to create a TACACS+ enforcement profile. Profile should be configured as below:

Note: Privilege for all CLI/SSH user logins will be same (i.e. Super Administrator) and cannot be modified/customized as of now.

• Snippets of access tracker request: