Security

last person joined: 20 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Evil Twin detection Onguard

This thread has been viewed 5 times

  • 1.  Evil Twin detection Onguard

    Posted May 20, 2020 09:12 PM

    What exactly does the evil twin detection in onguard do? It's not clear from the user guide. Thanks



  • 2.  RE: Evil Twin detection Onguard
    Best Answer

    EMPLOYEE
    Posted May 21, 2020 10:51 AM

    Hi,

     

    I checked this internally and it seems this feature is intended to detect "Evil twins" on the wired network. It is part of ClearPass 6.8.3. It detects if there is any system that has duplicate IP address, MAC address, to an existing network endpoint. OnGuard will notify Policy Manager of a potential Evil Twin so an action can be taken like to alert administrators and/or modify the access policy to quarantine the risk..