Security

Hi,

 

I'm looking for a way to register students consoles which don't support WPA2-Ent and have come across a few articles suggesting registering them in the guest device repository on Clearpass Guest.

To do this would i be best to add this as an authentication source in the Guest MAC authentication? 

This would appear like it might work, but the MAC auth fails due to attributes it looks for in the insight repository. (which was in by default).

Is this setting neccessary or is there a better way to do this?

 

thanks 

What does your enforcement policy look like? It seems the authentication isn't matching anything in you enforcement and being rejected.

This is the enforcement policy. Again its on the default setup. Role will equal guest , but it looks like the insight repository is whats killing it. Does this play a key part security wise for auth?

We're just about to roll this out here. Starting with Game Consoles only and restricting who can connect to a WPA2-PSK net based upon their DHCP signatures

Netx step os a batch of airgroup aware devices. 

We have 

1). PSK net with easy to remember PSK

2). Clearpass Guest device registration

3).Mac auth using [Guest Device Repository]

4). Role based enforcement

Rgs

A

We've killed all our PSK networks. They just aren't secure enough and we can't identify specific users on them which is a key requirement for us.

You're missing the rules to check for the registered devices.

Yeah, what Tim said above.

You could very easily get this working by adding a rule to your enforcement which says:

If authentication source equals guest device repository -> Allow access

This may not be the best way to get it working but should point you in the right direction.

Thanks, I was hoping to make sure i was doing this in the most secure manner. I didnt want to just hack a solution in if it was going to bypass recommended measures.  Are the insight rules even needed?

No, you can use the newer way with the MAC-Auth Expiry attribute. Take a look at the ClearPass Solution Guide for Wired Policy Enforcement for examples of a device registration plus guest policy. It's essentially the same wired vs wireless.

In additin to Tim's comment above, ensure the place the [Guest Device Repository] above the [Endpoint Repository] under the authentication sources.