Have you reached out to your Aruba ClearPass partner?
Create a new "Web-based Authentication" service.
Host CheckType EQUALS Authentication
Connection Src-IP-Address EQUALS 127.0.0.1
Use the Guest User Repository as the authentication source.
Use [Guest Roles] for role mapping.
Create an enforcement policy with a rule that uses the CoA Bounce Host port and also create an enforcement profile to update the endpoint attributes.