Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

802.1x without AD

This thread has been viewed 20 times

  • 1.  802.1x without AD

    Posted Mar 17, 2024 05:25 PM

    Hello,

    Is it possible to create a service with Authentication only based on the client presenting a valid Device certificate that is trusted by ClearPass?

    Devices are managed by MS Intune and they are not in on-prem AD. Certificates are issued to devices by on-prem CA + Intune (with Intune Certificate Connector app).
    We would like to have a service where ClearPass checks client's certificate and if it is valid - give access to the network. What should we select as Authentication source?

    We only have entry licenses, so cannot install ClearPass-Intune extension.



  • 2.  RE: 802.1x without AD

    Posted Mar 18, 2024 01:52 AM

    Hi,

    I'll say technically you can, I've got a ClearPass service that has the authentication method as EAP-TLS (or EAP-TEAP) with the Endpoints repository as the only authentication source:

    Then use Certificate: <OPTION> CONTAINS <VALUE>* and assign a role.

    * Match against your trusted CA

    Then you can create enforcement policies based on the roles:

    I'm also using the ClearPass-Intune extension to made other policy/enforcement decisions but I think you get the idea.


    Original Message


  • 3.  RE: 802.1x without AD

    Posted Mar 18, 2024 06:10 AM

    Yes, that works.
    Trust the corresponding CA in ClearPass and deactivate the authorization in the Authentication Method

    Be careful, the authentication method applies to all authentication requests processed by the service.
    You can create a dedicated service for these requests.
    The Intune ID is probably used as the user name. You can filter the user name in the service rule with a reg-ex.


    ------------------------------
    Regards,

    Waldemar
    ACCX # 1377, ACEP, ACX - Network Security
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------

    Original Message


  • 4.  RE: 802.1x without AD

    Posted Mar 18, 2024 07:03 AM

    Thank you, friends,

    I combined your suggested configuration (Role mappings, enforcement and authentication method without authorization required). 

    We will test 802.1x at the end of the week.


    Original Message