Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Onboarding Concurrent with Profiling

This thread has been viewed 15 times

  • 1.  Onboarding Concurrent with Profiling

    Posted May 17, 2022 05:09 PM
    We have a CP with Profiling enabled for different switches (ACX, Cisco, AOS)
    On AOS Switch it´s default to send both (MAB, 802.1x) to Clearpass
    On ACX we have set the command "port-access onboarding-method concurrent enable" on every Port
    Cisco´s order is 802.1x first and then MAB. After 5s of no EAP Response of the Client, it is sending the MAB to the Clearpass

    So if some Computer restarts, the MAC Address is seen first on the Switchport and the Client isn´t ready for EAP. So the Switch is sending MAB Request to CP, CP is sending the Profiling Vlan back. In the meantime the Supplicant is ready for EAP Handshake, but unfortunatelly Clearpass is sending Port-Bounce to the Switch because Profiling is finish. And it reapeats and repeats all the time.

    What is the solution for something like that? Unfortunatelly there is nothing in the Enforcement Guide of Clearpass


  • 2.  RE: Onboarding Concurrent with Profiling

    EMPLOYEE
    Posted May 20, 2022 10:31 AM
    Do you see the same issue on all three switch architectures? Or just on one?

    If profiling finishes on MAC authentication, it should only send a bounce once when the profiling changes. On the next authentications, if the profiling does not change, there should not be another bounce. Also, your client should be much faster than 5 seconds before it would try 802.1X, so this needs investigation as well.

    It will be hard to provide a further useful suggestion based on the available information.

    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 3.  RE: Onboarding Concurrent with Profiling

    Posted May 23, 2022 08:44 AM
    Hi!

    Since the mac-adress is the same for both 802.1x and Mac-auth, shouldn't you already have this client profiled and Known? That would mean it shouldn't get a profiling dance.. Usually only get that dance when the device is new.

    You could try to not use the profiling bit in the mac-auth service tab, but rather have enforcement policy do it. Like - add an update to Endpoint when the device does 802.1x, and during mac-auth you could test for that attribute and just give it a low session time. Once 802.1x kicks in that is increased anyway.

    ------------------------------
    John-Egil Solberg |
    ACMX | ACCX
    ------------------------------

    Original Message