Security

last person joined: 19 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Cisco Controller integration with clearpass

This thread has been viewed 17 times

  • 1.  Cisco Controller integration with clearpass

    Posted Oct 04, 2014 12:57 AM

    Does anyone got a technote on how to do it ?:)

     

    I got the integrating it with a Cisco Switch but i cannot find one which is with the Cisco wireless Controller

     

    Cheers

    Carlos



  • 2.  RE: Cisco Controller integration with clearpass

    EMPLOYEE
    Posted Oct 04, 2014 01:39 AM
    What are you trying to do. Guest or .1x

    Here is onboard and .1x

    https://ase.arubanetworks.com/solutions/id/46



  • 3.  RE: Cisco Controller integration with clearpass

    Posted Oct 04, 2014 04:13 AM

    Hi

     

    You looking for 802.1x guide or guest access guide?

     

    Let me know - and i will send u the info i got.



  • 4.  RE: Cisco Controller integration with clearpass

    Posted Oct 04, 2014 09:47 AM

    Yes im looking a 802.1x with cisco WLC

     

    Troy

    The one on the solution ideas its the onboard one with Cisco WLC.   I want 802.1x with cisco WLC

     

    Cheers

    Carlos

     



  • 5.  RE: Cisco Controller integration with clearpass



  • 6.  RE: Cisco Controller integration with clearpass

    Posted Oct 04, 2014 04:00 PM

    Cisco side :
    - Configure an ACL that allows communication to your CPPM throught HTTP/HTTPS, also allow DNS, DHCP . this acl is similar to the captiveportal  And logon-control ACLs on the Aruba side that you for the Guest-Logon role or onboard provisioning role
    - create a network with Layer 2 802.1X and in the Layer 3 use a conditional redirect and select the preauth ACL you previously created
    - Add CPPM as a radius server and enable CoA and radius accounting

    Aruba :
    You can use the onboard templates that already exist on you CPPM the only thing you need to change are the enforcement profiles :
    - For the redirect you need an enforcement profile using the Cisco radius attributes Cisco av-pair and instead sending role you use the URL-redirect:<Onboard URL>
    - You can either assign a VLAN Or send an radius accept so the device gets the default VLAN assigned to the network
    - To send a different you use the Radius ietf
    IETF 64 (Tunnel Type)—Set this to VLAN.
    IETF 65 (Tunnel Medium Type)—Set this to 802
    IETF 81 (Tunnel Private Group ID)—Set this to VLAN ID.