Security

last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

difference between downloadable acl and downloadbale User Roles

This thread has been viewed 6 times

  • 1.  difference between downloadable acl and downloadbale User Roles

    Posted Sep 19, 2019 02:43 PM

    Hello im searching for a information source about the main differences between downloadable User Roles and dacl. We have a mixed environment with 2530 and 2540 switches. The documantation for clearpass Captive Portal for both switches describes the use of Nas Filter Rules (dacl?).From my understanding the 2540 could also use DUR, wouldn't it be better then? Which possibilties do i miss whith my 2530 switches and dacl only?
    regards Niklas



  • 2.  RE: difference between downloadable acl and downloadbale User Roles
    Best Answer

    EMPLOYEE
    Posted Sep 20, 2019 02:47 AM

    Downloadable user roles should always be preferred.

     

    It gives you more flexibility. A user role can contain QoS, VLAN etc as well wheras the acl only provides rules.

     

     



  • 3.  RE: difference between downloadable acl and downloadbale User Roles
    Best Answer

    EMPLOYEE
    Posted Sep 20, 2019 02:51 AM

    User roles combine all access attributes for a user in a single object, so it is more flexible than and manageable than separate ACLs.

     

    This video series has in the start a nice explanation on the concepts in the first episodes.

     

    Also note that you can have local user roles on the 2530. The feature that you won't have versus the 2540 is that you can't download the role content from ClearPass but you can configure it on the switch itself and return the role name from ClearPass.



  • 4.  RE: difference between downloadable acl and downloadbale User Roles

    Posted Sep 20, 2019 03:05 AM

    thank you, this clarifies it for me.