Security

Dear all, 

 

I am new in CPPM, so please help me on this.

 

i have a Aruba controller, & a CPPM, 

 

Now i want to create users in cppm's internal DB, and assign them to different vlan but using

one SSID.

 

Means  one SSID is there  [ CORP ], and if sales person connect to it, the he/she will get a vlan. And if technical person connect to it then he/ she will get different vlan.

 

how can i do this ?

 

kindly tell me what things will be required..

 

 

 

First create the roles you need , Sales , IT , etc..

 

Then add the new users to the local db and assign the roles to each user

 

Then create an enforcement profile with the VLANs you are planning to send to the controller based on the TIPS ROLE condition wheter is Sales or IT

 

 

And finally in your policy use the TIPS ROLE condition to send the VLAN assignment

Thank you victor....

 

Now i understand,  and also its working.

 

thank you again, you are a great man.

Hi, same problem but a little diference. I have around 2500 users and I would need 1000 of them with a different vlan EACH one (on a big congress center, for shaping, monitoring etc). It's this solution escalable to 1000_1500 different roles_vlans? (No matter how mu h time it cost to configure) It's there a better way?

Thanks!

Why would you put 2500 users into 1000 different VLANS?

Well do t think on the tipycall guest/corporative architechture, we act sometimes as a "little service provider". There is a lot of reasons, to isolate users, have different n3 an n2 configs, monitor separated traffic. Sometimes we have high technologicall venues (1000 and up exhibitors) and we have to configure in very very short time (hours) so many different and sometimes complex lans and had the hability to change, troubleshoot. No other way than vlans I guess to do that.

What is the identity store you're using?

Hi, I haven't it configured. I'm preparing a clearpass pilot for big venue center at barcelona and I know this is an historic request that they solve by dot1x. That causes tons of complaints with windows users. We solve it with aruba quick connect for autoconfig pcs but not very efficient (users need wifi to reach the url).

Hi All,

 

I know this threat is old, but I have the same requirements to do and your sample is correct. I jus would like to know what services can I use in this case and also what changes needs to be done on the controller side.

Hi, not simple but very effective. In clearpass side basically two services (mac authenticaton and 802.1x windows) and CoA action. The tip is the action sequence:

1- user connect to ssid, is marked as unknown so a captive portal is displayed (I used my own captive from a ftp server, not clearpass one).

2- user connects with user y password under the captive (local clearpass users on this case).

3- Controller assign vlan defined to this web authentication SSID

4- CoA action to force user authenticate again

5- automatically user connects again and is marked as KNOWn. Vlan configured for the user (as atribute in clearpass) can be assigned secure in layer 2.

 

*Users must exist as local on clearpass and have Vlan as attribute, but I´m sure t can be done from AD, LDAP.

 

 

¿What about Controller side? (cisco on this case)

- Global confi: add the clearpass as a radius (authentication and accounting)

- SSID:

- It must be maped to a Interface Group instead interface (group of vlans)

-under security tab:

layer2, enable MAC Filtering.

layer 3 , enable On MAC Filter failure, configure a preauthentication ACL,Override Global Config, Web Auth type redirect to external server (add https://whateverURL),

AAA Servers: add clearpass IP for authent and accounting

 

ACL parameters it depends, restrict all you can but permit DNS and UDP to the clearpass (and the captive portal IP).

 

Before going crazy...CoA delay default values don´t use to achieve goals,  probably you will have to test a lot to find the correct.

---

@thenatural33wrote:

Hi All,

 

I know this threat is old, but I have the same requirements to do and your sample is correct. I jus would like to know what services can I use in this case and also what changes needs to be done on the controller side.

---

 

---

@thenatural33wrote:

Hi All,

 

I know this threat is old, but I have the same requirements to do and your sample is correct. I jus would like to know what services can I use in this case and also what changes needs to be done on the controller side.

---