Aruba Network Security Expert (Written) cheat sheet

Zero Trust model: no implicit trust from network location; every session is authenticated, authorized, and encrypted based on policy, not on being 'inside' the perimeter.

Defense in depth layers: physical, network segmentation, identity/AAA, endpoint posture, encryption, monitoring; a control failure at one layer must not collapse the others.

Purdue/ISA-style zoning maps IT, DMZ, and OT/ICS into separate trust zones with explicit inter-zone policy; the DMZ terminates external sessions before any internal resource is reached.

Dynamic Segmentation assigns users/devices to roles and VLANs/tunnels by policy rather than static port or SSID mapping, so a compromised endpoint is contained to its role scope.

Role-based policy design: derive roles from identity (802.1X, MPSK, MAC, captive portal) plus posture, then apply per-role ACLs, VLANs, and QoS consistently across wired and wireless.

High availability design: redundant ClearPass nodes (cluster with publisher/subscriber), redundant controllers/gateways, and RADIUS failover ordering with dead-server detection timers.

Least privilege for management planes: separate out-of-band management VLAN, restrict admin source subnets, and never expose controller or ClearPass admin UI to untrusted zones.

Threat modeling (STRIDE) applied per zone: spoofing, tampering, repudiation, information disclosure, DoS, elevation - each maps to a specific control such as 802.1X, TLS, or role ACL.

802.1X EAP exchange: supplicant ↔ authenticator (switch/AP/controller) over EAPOL, authenticator ↔ authentication server (RADIUS) over EAP; the switch only relays, it does not terminate EAP.

EAP methods: EAP-TLS = mutual certificate (most secure, needs client certs); PEAP/EAP-TTLS = server cert plus inner MSCHAPv2 or other; EAP-TLS is preferred for managed devices.

RADIUS attributes that drive authorization: Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-ID=VLAN ID; Filter-Id or Aruba-User-Role carries role/ACL.

RADIUS accounting (Start/Interim/Stop) is separate from authentication and is what feeds session tracking, CoA targets, and endpoint last-seen data.

RADIUS CoA/Disconnect (RFC 5176) lets ClearPass push a role change or session teardown to the NAD without waiting for reauthentication; the NAD must permit CoA from the server.

MAC authentication (MAB) is weak - a MAC is spoofable - so treat MAB as a fallback role with restricted access, not as proof of identity.

Role assignment precedence in Aruba: a RADIUS-returned role overrides the initial role; cached roles and server-derived roles are evaluated by configured precedence rules.

802.1X host modes: multi-host (one auth for many), single-host (one device per port), and multi-domain (separate data and voice authentications on one port).

ClearPass service types: RADIUS (802.1X/MAB), TACACS+ (device admin), Web Authentication (captive portal), Onboard (certificate provisioning), OnGuard (agent posture), and Profiler.

Policy evaluation order: service → role mapping → enforcement policy → enforcement profiles; the first matching enforcement rule wins unless continue rules are configured.

Profiler identifies device type from DHCP fingerprints, MAC OUI, SNMP, NetFlow, and Nmap scans; the resulting device category can feed role mapping and enforcement.

OnGuard posture checks (AV, patch level, disk encryption, firewall) return health tokens; non-compliant endpoints are placed in a remediation role until they re-qualify.

Onboard issues client certificates from an internal CA to managed devices so EAP-TLS can be used; BYOD devices get a device identity without manual cert install.

ClearPass cluster: one publisher plus subscribers; configuration is replicated from publisher, and RADIUS auth can be served by any node for load and failover.

Guest and captive portal flows: web auth service authenticates against local or AD source, then role maps to a guest VLAN with time-limited access and sponsor approval.

CoA from ClearPass requires the NAD to be reachable and to trust the CoA source; verify shared secret and CoA port (default 3799) when role changes do not take effect.

TLS handshake: server presents certificate chain; client validates chain to a trusted root, checks validity dates, hostname/SAN match, and revocation (CRL/OCSP).

Certificate fields that matter for RADIUS/EAP: Subject CN, SAN (DNS/IP), Extended Key Usage (Server Auth for servers, Client Auth for supplicants), and key usage.

ClearPass and controller HTTPS require a server certificate whose SAN matches the FQDN clients use; a mismatch causes supplicant or browser trust failures even if the chain is valid.

EAP-TLS requires the client certificate's EKU to include Client Authentication and the issuing CA to be trusted by the RADIUS server's EAP trust list.

Management access hardening: SSHv2 only, disable Telnet/HTTP, restrict admin subnets, use TACACS+ or RADIUS for admin AAA with command authorization, and enable idle timeouts.

SNMPv3 with authPriv (SHA auth + AES privacy) replaces SNMPv1/v2c community strings, which travel in cleartext.

WPA3 uses SAE (Simultaneous Authentication of Equals) for a dictionary-attack-resistant PSK handshake; WPA3-Enterprise can add 192-bit Suite-B cryptography.

Key management: rotate RADIUS shared secrets and device certificates on a schedule; shared secrets are used for RADIUS message integrity and CoA trust, so a leak enables spoofed auth.

Rogue AP detection compares detected BSSIDs against the authorized AP list; classification is rogue (on wire, unauthorized), interfering (off wire, same SSID), or neighbor (off wire, different SSID).

WIDS/WIPS events include evil twin (same SSID, different BSSID), honeypot AP, ad-hoc network, and DoS/flood signatures; containment is a separate action from detection.

DHCP snooping blocks rogue DHCP servers; dynamic ARP inspection and IP source guard block ARP spoofing and IP spoofing, and both depend on the DHCP snooping binding table.

ClearPass and controller logs plus syslog to a collector are the primary evidence trail; correlate auth failures, CoA events, and role changes by endpoint MAC and username.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, lessons learned; containment for a compromised endpoint is often a role change to quarantine.

RADIUS auth failure spikes (Access-Reject, EAP timeout) usually indicate supplicant misconfig, expired certs, or a shared-secret mismatch - check server logs before blaming the client.

Monitoring baselines: track auth success rate, CoA delivery success, profiler category drift, and rogue AP counts; deviations from baseline are the detection signal.

Quarantine role design: deny all except remediation and DNS/DHCP, and require reauthentication or CoA to exit quarantine after posture is fixed.

Dynamic Segmentation on Aruba: user/device role determines VLAN and policy, and traffic can be tunneled to a gateway (per-role tunnel) instead of being locally switched.

Tunnel types: GRE for user-based tunneling, IPSec for secure site-to-site or overlay; role-based tunnel selection lets a single SSID/port serve multiple policy domains.

Device profiles on Aruba switches (and port profiles) apply a set of attributes - VLAN, PoE, auth mode - when a device is detected, enabling automated port provisioning.

Wired 802.1X: the switch is the authenticator; port states are unauthorized/authorized; a RADIUS role can push a VLAN or downloadable ACL after auth.

Wireless: WPA2/WPA3-Enterprise with 802.1X and RADIUS; WPA2-PSK with MPSK (multi-PSK) gives per-device keys and per-key roles without per-user identity.

MPSK on Aruba lets each device get a unique PSK mapped to a role, so a single leaked key can be revoked without rekeying the whole SSID.

Role-based ACLs should be applied as both ingress and egress where supported, and should deny inter-role traffic by default (deny-all then permit).

Captive portal on wired and wireless uses web auth; combine with role mapping so guest, BYOD, and corporate devices land in distinct roles from the same SSID or port.

ClearPass REST API and extension interfaces let external systems trigger role changes, endpoint updates, and CoA; integration requires an API client with scoped permissions.

TACACS+ for device admin AAA separates authentication (who), authorization (what commands), and accounting (what was done); it encrypts the full payload, unlike RADIUS.

Syslog, SNMP traps, and streaming telemetry feed SIEM; normalize auth events and CoA results so correlation across ClearPass, controllers, and switches is possible.

Troubleshooting order for 802.1X: verify link/EAPOL, check supplicant method and certs, verify RADIUS reachability and shared secret, then check service/role mapping and enforcement.

Use ClearPass Access Tracker to see the full policy evaluation trace for a single request: service match, role mapping, enforcement, and returned attributes.

Packet capture points: supplicant (EAPOL), NAD uplink (RADIUS to server), and server (auth logs); the first failing hop localizes the fault.

Common failure signatures: EAP timeout = no RADIUS response or wrong secret; Access-Reject = credentials/cert/posture; wrong VLAN = missing Tunnel attributes or role precedence.

Automation guardrails: test CoA and role changes in a lab service first, version-control policy exports, and keep a rollback path before bulk policy pushes.

Zero Trust model: no implicit trust from network location; every session is authenticated, authorized, and encrypted based on policy, not on being 'inside' the perimeter.

Defense in depth layers: physical, network segmentation, identity/AAA, endpoint posture, encryption, monitoring; a control failure at one layer must not collapse the others.

Purdue/ISA-style zoning maps IT, DMZ, and OT/ICS into separate trust zones with explicit inter-zone policy; the DMZ terminates external sessions before any internal resource is reached.

Dynamic Segmentation assigns users/devices to roles and VLANs/tunnels by policy rather than static port or SSID mapping, so a compromised endpoint is contained to its role scope.

Role-based policy design: derive roles from identity (802.1X, MPSK, MAC, captive portal) plus posture, then apply per-role ACLs, VLANs, and QoS consistently across wired and wireless.

High availability design: redundant ClearPass nodes (cluster with publisher/subscriber), redundant controllers/gateways, and RADIUS failover ordering with dead-server detection timers.

Least privilege for management planes: separate out-of-band management VLAN, restrict admin source subnets, and never expose controller or ClearPass admin UI to untrusted zones.

Threat modeling (STRIDE) applied per zone: spoofing, tampering, repudiation, information disclosure, DoS, elevation - each maps to a specific control such as 802.1X, TLS, or role ACL.

802.1X EAP exchange: supplicant ↔ authenticator (switch/AP/controller) over EAPOL, authenticator ↔ authentication server (RADIUS) over EAP; the switch only relays, it does not terminate EAP.

EAP methods: EAP-TLS = mutual certificate (most secure, needs client certs); PEAP/EAP-TTLS = server cert plus inner MSCHAPv2 or other; EAP-TLS is preferred for managed devices.

RADIUS attributes that drive authorization: Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-ID=VLAN ID; Filter-Id or Aruba-User-Role carries role/ACL.

RADIUS accounting (Start/Interim/Stop) is separate from authentication and is what feeds session tracking, CoA targets, and endpoint last-seen data.

RADIUS CoA/Disconnect (RFC 5176) lets ClearPass push a role change or session teardown to the NAD without waiting for reauthentication; the NAD must permit CoA from the server.

MAC authentication (MAB) is weak - a MAC is spoofable - so treat MAB as a fallback role with restricted access, not as proof of identity.

Role assignment precedence in Aruba: a RADIUS-returned role overrides the initial role; cached roles and server-derived roles are evaluated by configured precedence rules.

802.1X host modes: multi-host (one auth for many), single-host (one device per port), and multi-domain (separate data and voice authentications on one port).

ClearPass service types: RADIUS (802.1X/MAB), TACACS+ (device admin), Web Authentication (captive portal), Onboard (certificate provisioning), OnGuard (agent posture), and Profiler.

Policy evaluation order: service → role mapping → enforcement policy → enforcement profiles; the first matching enforcement rule wins unless continue rules are configured.

Profiler identifies device type from DHCP fingerprints, MAC OUI, SNMP, NetFlow, and Nmap scans; the resulting device category can feed role mapping and enforcement.

OnGuard posture checks (AV, patch level, disk encryption, firewall) return health tokens; non-compliant endpoints are placed in a remediation role until they re-qualify.

Onboard issues client certificates from an internal CA to managed devices so EAP-TLS can be used; BYOD devices get a device identity without manual cert install.

ClearPass cluster: one publisher plus subscribers; configuration is replicated from publisher, and RADIUS auth can be served by any node for load and failover.

Guest and captive portal flows: web auth service authenticates against local or AD source, then role maps to a guest VLAN with time-limited access and sponsor approval.

CoA from ClearPass requires the NAD to be reachable and to trust the CoA source; verify shared secret and CoA port (default 3799) when role changes do not take effect.

TLS handshake: server presents certificate chain; client validates chain to a trusted root, checks validity dates, hostname/SAN match, and revocation (CRL/OCSP).

Certificate fields that matter for RADIUS/EAP: Subject CN, SAN (DNS/IP), Extended Key Usage (Server Auth for servers, Client Auth for supplicants), and key usage.

ClearPass and controller HTTPS require a server certificate whose SAN matches the FQDN clients use; a mismatch causes supplicant or browser trust failures even if the chain is valid.

EAP-TLS requires the client certificate's EKU to include Client Authentication and the issuing CA to be trusted by the RADIUS server's EAP trust list.

Management access hardening: SSHv2 only, disable Telnet/HTTP, restrict admin subnets, use TACACS+ or RADIUS for admin AAA with command authorization, and enable idle timeouts.

SNMPv3 with authPriv (SHA auth + AES privacy) replaces SNMPv1/v2c community strings, which travel in cleartext.

WPA3 uses SAE (Simultaneous Authentication of Equals) for a dictionary-attack-resistant PSK handshake; WPA3-Enterprise can add 192-bit Suite-B cryptography.

Key management: rotate RADIUS shared secrets and device certificates on a schedule; shared secrets are used for RADIUS message integrity and CoA trust, so a leak enables spoofed auth.

Rogue AP detection compares detected BSSIDs against the authorized AP list; classification is rogue (on wire, unauthorized), interfering (off wire, same SSID), or neighbor (off wire, different SSID).

WIDS/WIPS events include evil twin (same SSID, different BSSID), honeypot AP, ad-hoc network, and DoS/flood signatures; containment is a separate action from detection.

DHCP snooping blocks rogue DHCP servers; dynamic ARP inspection and IP source guard block ARP spoofing and IP spoofing, and both depend on the DHCP snooping binding table.

ClearPass and controller logs plus syslog to a collector are the primary evidence trail; correlate auth failures, CoA events, and role changes by endpoint MAC and username.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, lessons learned; containment for a compromised endpoint is often a role change to quarantine.

RADIUS auth failure spikes (Access-Reject, EAP timeout) usually indicate supplicant misconfig, expired certs, or a shared-secret mismatch - check server logs before blaming the client.

Monitoring baselines: track auth success rate, CoA delivery success, profiler category drift, and rogue AP counts; deviations from baseline are the detection signal.

Quarantine role design: deny all except remediation and DNS/DHCP, and require reauthentication or CoA to exit quarantine after posture is fixed.

Dynamic Segmentation on Aruba: user/device role determines VLAN and policy, and traffic can be tunneled to a gateway (per-role tunnel) instead of being locally switched.

Tunnel types: GRE for user-based tunneling, IPSec for secure site-to-site or overlay; role-based tunnel selection lets a single SSID/port serve multiple policy domains.

Device profiles on Aruba switches (and port profiles) apply a set of attributes - VLAN, PoE, auth mode - when a device is detected, enabling automated port provisioning.

Wired 802.1X: the switch is the authenticator; port states are unauthorized/authorized; a RADIUS role can push a VLAN or downloadable ACL after auth.

Wireless: WPA2/WPA3-Enterprise with 802.1X and RADIUS; WPA2-PSK with MPSK (multi-PSK) gives per-device keys and per-key roles without per-user identity.

MPSK on Aruba lets each device get a unique PSK mapped to a role, so a single leaked key can be revoked without rekeying the whole SSID.

Role-based ACLs should be applied as both ingress and egress where supported, and should deny inter-role traffic by default (deny-all then permit).

Captive portal on wired and wireless uses web auth; combine with role mapping so guest, BYOD, and corporate devices land in distinct roles from the same SSID or port.

ClearPass REST API and extension interfaces let external systems trigger role changes, endpoint updates, and CoA; integration requires an API client with scoped permissions.

TACACS+ for device admin AAA separates authentication (who), authorization (what commands), and accounting (what was done); it encrypts the full payload, unlike RADIUS.

Syslog, SNMP traps, and streaming telemetry feed SIEM; normalize auth events and CoA results so correlation across ClearPass, controllers, and switches is possible.

Troubleshooting order for 802.1X: verify link/EAPOL, check supplicant method and certs, verify RADIUS reachability and shared secret, then check service/role mapping and enforcement.

Use ClearPass Access Tracker to see the full policy evaluation trace for a single request: service match, role mapping, enforcement, and returned attributes.

Packet capture points: supplicant (EAPOL), NAD uplink (RADIUS to server), and server (auth logs); the first failing hop localizes the fault.

Common failure signatures: EAP timeout = no RADIUS response or wrong secret; Access-Reject = credentials/cert/posture; wrong VLAN = missing Tunnel attributes or role precedence.

Automation guardrails: test CoA and role changes in a lab service first, version-control policy exports, and keep a rollback path before bulk policy pushes.

Zero Trust model: no implicit trust from network location; every session is authenticated, authorized, and encrypted based on policy, not on being 'inside' the perimeter.

Defense in depth layers: physical, network segmentation, identity/AAA, endpoint posture, encryption, monitoring; a control failure at one layer must not collapse the others.

Purdue/ISA-style zoning maps IT, DMZ, and OT/ICS into separate trust zones with explicit inter-zone policy; the DMZ terminates external sessions before any internal resource is reached.

Dynamic Segmentation assigns users/devices to roles and VLANs/tunnels by policy rather than static port or SSID mapping, so a compromised endpoint is contained to its role scope.

Role-based policy design: derive roles from identity (802.1X, MPSK, MAC, captive portal) plus posture, then apply per-role ACLs, VLANs, and QoS consistently across wired and wireless.

High availability design: redundant ClearPass nodes (cluster with publisher/subscriber), redundant controllers/gateways, and RADIUS failover ordering with dead-server detection timers.

Least privilege for management planes: separate out-of-band management VLAN, restrict admin source subnets, and never expose controller or ClearPass admin UI to untrusted zones.

Threat modeling (STRIDE) applied per zone: spoofing, tampering, repudiation, information disclosure, DoS, elevation - each maps to a specific control such as 802.1X, TLS, or role ACL.

802.1X EAP exchange: supplicant ↔ authenticator (switch/AP/controller) over EAPOL, authenticator ↔ authentication server (RADIUS) over EAP; the switch only relays, it does not terminate EAP.

EAP methods: EAP-TLS = mutual certificate (most secure, needs client certs); PEAP/EAP-TTLS = server cert plus inner MSCHAPv2 or other; EAP-TLS is preferred for managed devices.

RADIUS attributes that drive authorization: Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-ID=VLAN ID; Filter-Id or Aruba-User-Role carries role/ACL.

RADIUS accounting (Start/Interim/Stop) is separate from authentication and is what feeds session tracking, CoA targets, and endpoint last-seen data.

RADIUS CoA/Disconnect (RFC 5176) lets ClearPass push a role change or session teardown to the NAD without waiting for reauthentication; the NAD must permit CoA from the server.

MAC authentication (MAB) is weak - a MAC is spoofable - so treat MAB as a fallback role with restricted access, not as proof of identity.

Role assignment precedence in Aruba: a RADIUS-returned role overrides the initial role; cached roles and server-derived roles are evaluated by configured precedence rules.

802.1X host modes: multi-host (one auth for many), single-host (one device per port), and multi-domain (separate data and voice authentications on one port).

ClearPass service types: RADIUS (802.1X/MAB), TACACS+ (device admin), Web Authentication (captive portal), Onboard (certificate provisioning), OnGuard (agent posture), and Profiler.

Policy evaluation order: service → role mapping → enforcement policy → enforcement profiles; the first matching enforcement rule wins unless continue rules are configured.

Profiler identifies device type from DHCP fingerprints, MAC OUI, SNMP, NetFlow, and Nmap scans; the resulting device category can feed role mapping and enforcement.

OnGuard posture checks (AV, patch level, disk encryption, firewall) return health tokens; non-compliant endpoints are placed in a remediation role until they re-qualify.

Onboard issues client certificates from an internal CA to managed devices so EAP-TLS can be used; BYOD devices get a device identity without manual cert install.

ClearPass cluster: one publisher plus subscribers; configuration is replicated from publisher, and RADIUS auth can be served by any node for load and failover.

Guest and captive portal flows: web auth service authenticates against local or AD source, then role maps to a guest VLAN with time-limited access and sponsor approval.

CoA from ClearPass requires the NAD to be reachable and to trust the CoA source; verify shared secret and CoA port (default 3799) when role changes do not take effect.

TLS handshake: server presents certificate chain; client validates chain to a trusted root, checks validity dates, hostname/SAN match, and revocation (CRL/OCSP).

Certificate fields that matter for RADIUS/EAP: Subject CN, SAN (DNS/IP), Extended Key Usage (Server Auth for servers, Client Auth for supplicants), and key usage.

ClearPass and controller HTTPS require a server certificate whose SAN matches the FQDN clients use; a mismatch causes supplicant or browser trust failures even if the chain is valid.

EAP-TLS requires the client certificate's EKU to include Client Authentication and the issuing CA to be trusted by the RADIUS server's EAP trust list.

Management access hardening: SSHv2 only, disable Telnet/HTTP, restrict admin subnets, use TACACS+ or RADIUS for admin AAA with command authorization, and enable idle timeouts.

SNMPv3 with authPriv (SHA auth + AES privacy) replaces SNMPv1/v2c community strings, which travel in cleartext.

WPA3 uses SAE (Simultaneous Authentication of Equals) for a dictionary-attack-resistant PSK handshake; WPA3-Enterprise can add 192-bit Suite-B cryptography.

Key management: rotate RADIUS shared secrets and device certificates on a schedule; shared secrets are used for RADIUS message integrity and CoA trust, so a leak enables spoofed auth.

Rogue AP detection compares detected BSSIDs against the authorized AP list; classification is rogue (on wire, unauthorized), interfering (off wire, same SSID), or neighbor (off wire, different SSID).

WIDS/WIPS events include evil twin (same SSID, different BSSID), honeypot AP, ad-hoc network, and DoS/flood signatures; containment is a separate action from detection.

DHCP snooping blocks rogue DHCP servers; dynamic ARP inspection and IP source guard block ARP spoofing and IP spoofing, and both depend on the DHCP snooping binding table.

ClearPass and controller logs plus syslog to a collector are the primary evidence trail; correlate auth failures, CoA events, and role changes by endpoint MAC and username.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, lessons learned; containment for a compromised endpoint is often a role change to quarantine.

RADIUS auth failure spikes (Access-Reject, EAP timeout) usually indicate supplicant misconfig, expired certs, or a shared-secret mismatch - check server logs before blaming the client.

Monitoring baselines: track auth success rate, CoA delivery success, profiler category drift, and rogue AP counts; deviations from baseline are the detection signal.

Quarantine role design: deny all except remediation and DNS/DHCP, and require reauthentication or CoA to exit quarantine after posture is fixed.

Dynamic Segmentation on Aruba: user/device role determines VLAN and policy, and traffic can be tunneled to a gateway (per-role tunnel) instead of being locally switched.

Tunnel types: GRE for user-based tunneling, IPSec for secure site-to-site or overlay; role-based tunnel selection lets a single SSID/port serve multiple policy domains.

Device profiles on Aruba switches (and port profiles) apply a set of attributes - VLAN, PoE, auth mode - when a device is detected, enabling automated port provisioning.

Wired 802.1X: the switch is the authenticator; port states are unauthorized/authorized; a RADIUS role can push a VLAN or downloadable ACL after auth.

Wireless: WPA2/WPA3-Enterprise with 802.1X and RADIUS; WPA2-PSK with MPSK (multi-PSK) gives per-device keys and per-key roles without per-user identity.

MPSK on Aruba lets each device get a unique PSK mapped to a role, so a single leaked key can be revoked without rekeying the whole SSID.

Role-based ACLs should be applied as both ingress and egress where supported, and should deny inter-role traffic by default (deny-all then permit).

Captive portal on wired and wireless uses web auth; combine with role mapping so guest, BYOD, and corporate devices land in distinct roles from the same SSID or port.

ClearPass REST API and extension interfaces let external systems trigger role changes, endpoint updates, and CoA; integration requires an API client with scoped permissions.

TACACS+ for device admin AAA separates authentication (who), authorization (what commands), and accounting (what was done); it encrypts the full payload, unlike RADIUS.

Syslog, SNMP traps, and streaming telemetry feed SIEM; normalize auth events and CoA results so correlation across ClearPass, controllers, and switches is possible.

Troubleshooting order for 802.1X: verify link/EAPOL, check supplicant method and certs, verify RADIUS reachability and shared secret, then check service/role mapping and enforcement.

Use ClearPass Access Tracker to see the full policy evaluation trace for a single request: service match, role mapping, enforcement, and returned attributes.

Packet capture points: supplicant (EAPOL), NAD uplink (RADIUS to server), and server (auth logs); the first failing hop localizes the fault.

Common failure signatures: EAP timeout = no RADIUS response or wrong secret; Access-Reject = credentials/cert/posture; wrong VLAN = missing Tunnel attributes or role precedence.

Automation guardrails: test CoA and role changes in a lab service first, version-control policy exports, and keep a rollback path before bulk policy pushes.

Zero Trust model: no implicit trust from network location; every session is authenticated, authorized, and encrypted based on policy, not on being 'inside' the perimeter.

Defense in depth layers: physical, network segmentation, identity/AAA, endpoint posture, encryption, monitoring; a control failure at one layer must not collapse the others.

Purdue/ISA-style zoning maps IT, DMZ, and OT/ICS into separate trust zones with explicit inter-zone policy; the DMZ terminates external sessions before any internal resource is reached.

Dynamic Segmentation assigns users/devices to roles and VLANs/tunnels by policy rather than static port or SSID mapping, so a compromised endpoint is contained to its role scope.

Role-based policy design: derive roles from identity (802.1X, MPSK, MAC, captive portal) plus posture, then apply per-role ACLs, VLANs, and QoS consistently across wired and wireless.

High availability design: redundant ClearPass nodes (cluster with publisher/subscriber), redundant controllers/gateways, and RADIUS failover ordering with dead-server detection timers.

Least privilege for management planes: separate out-of-band management VLAN, restrict admin source subnets, and never expose controller or ClearPass admin UI to untrusted zones.

Threat modeling (STRIDE) applied per zone: spoofing, tampering, repudiation, information disclosure, DoS, elevation - each maps to a specific control such as 802.1X, TLS, or role ACL.

802.1X EAP exchange: supplicant ↔ authenticator (switch/AP/controller) over EAPOL, authenticator ↔ authentication server (RADIUS) over EAP; the switch only relays, it does not terminate EAP.

EAP methods: EAP-TLS = mutual certificate (most secure, needs client certs); PEAP/EAP-TTLS = server cert plus inner MSCHAPv2 or other; EAP-TLS is preferred for managed devices.

RADIUS attributes that drive authorization: Tunnel-Type=VLAN, Tunnel-Medium-Type=IEEE-802, Tunnel-Private-Group-ID=VLAN ID; Filter-Id or Aruba-User-Role carries role/ACL.

RADIUS accounting (Start/Interim/Stop) is separate from authentication and is what feeds session tracking, CoA targets, and endpoint last-seen data.

RADIUS CoA/Disconnect (RFC 5176) lets ClearPass push a role change or session teardown to the NAD without waiting for reauthentication; the NAD must permit CoA from the server.

MAC authentication (MAB) is weak - a MAC is spoofable - so treat MAB as a fallback role with restricted access, not as proof of identity.

Role assignment precedence in Aruba: a RADIUS-returned role overrides the initial role; cached roles and server-derived roles are evaluated by configured precedence rules.

802.1X host modes: multi-host (one auth for many), single-host (one device per port), and multi-domain (separate data and voice authentications on one port).

ClearPass service types: RADIUS (802.1X/MAB), TACACS+ (device admin), Web Authentication (captive portal), Onboard (certificate provisioning), OnGuard (agent posture), and Profiler.

Policy evaluation order: service → role mapping → enforcement policy → enforcement profiles; the first matching enforcement rule wins unless continue rules are configured.

Profiler identifies device type from DHCP fingerprints, MAC OUI, SNMP, NetFlow, and Nmap scans; the resulting device category can feed role mapping and enforcement.

OnGuard posture checks (AV, patch level, disk encryption, firewall) return health tokens; non-compliant endpoints are placed in a remediation role until they re-qualify.

Onboard issues client certificates from an internal CA to managed devices so EAP-TLS can be used; BYOD devices get a device identity without manual cert install.

ClearPass cluster: one publisher plus subscribers; configuration is replicated from publisher, and RADIUS auth can be served by any node for load and failover.

Guest and captive portal flows: web auth service authenticates against local or AD source, then role maps to a guest VLAN with time-limited access and sponsor approval.

CoA from ClearPass requires the NAD to be reachable and to trust the CoA source; verify shared secret and CoA port (default 3799) when role changes do not take effect.

TLS handshake: server presents certificate chain; client validates chain to a trusted root, checks validity dates, hostname/SAN match, and revocation (CRL/OCSP).

Certificate fields that matter for RADIUS/EAP: Subject CN, SAN (DNS/IP), Extended Key Usage (Server Auth for servers, Client Auth for supplicants), and key usage.

ClearPass and controller HTTPS require a server certificate whose SAN matches the FQDN clients use; a mismatch causes supplicant or browser trust failures even if the chain is valid.

EAP-TLS requires the client certificate's EKU to include Client Authentication and the issuing CA to be trusted by the RADIUS server's EAP trust list.

Management access hardening: SSHv2 only, disable Telnet/HTTP, restrict admin subnets, use TACACS+ or RADIUS for admin AAA with command authorization, and enable idle timeouts.

SNMPv3 with authPriv (SHA auth + AES privacy) replaces SNMPv1/v2c community strings, which travel in cleartext.

WPA3 uses SAE (Simultaneous Authentication of Equals) for a dictionary-attack-resistant PSK handshake; WPA3-Enterprise can add 192-bit Suite-B cryptography.

Key management: rotate RADIUS shared secrets and device certificates on a schedule; shared secrets are used for RADIUS message integrity and CoA trust, so a leak enables spoofed auth.

Rogue AP detection compares detected BSSIDs against the authorized AP list; classification is rogue (on wire, unauthorized), interfering (off wire, same SSID), or neighbor (off wire, different SSID).

WIDS/WIPS events include evil twin (same SSID, different BSSID), honeypot AP, ad-hoc network, and DoS/flood signatures; containment is a separate action from detection.

DHCP snooping blocks rogue DHCP servers; dynamic ARP inspection and IP source guard block ARP spoofing and IP spoofing, and both depend on the DHCP snooping binding table.

ClearPass and controller logs plus syslog to a collector are the primary evidence trail; correlate auth failures, CoA events, and role changes by endpoint MAC and username.

Incident response phases: preparation, detection/analysis, containment, eradication, recovery, lessons learned; containment for a compromised endpoint is often a role change to quarantine.

RADIUS auth failure spikes (Access-Reject, EAP timeout) usually indicate supplicant misconfig, expired certs, or a shared-secret mismatch - check server logs before blaming the client.

Monitoring baselines: track auth success rate, CoA delivery success, profiler category drift, and rogue AP counts; deviations from baseline are the detection signal.

Quarantine role design: deny all except remediation and DNS/DHCP, and require reauthentication or CoA to exit quarantine after posture is fixed.

Dynamic Segmentation on Aruba: user/device role determines VLAN and policy, and traffic can be tunneled to a gateway (per-role tunnel) instead of being locally switched.

Tunnel types: GRE for user-based tunneling, IPSec for secure site-to-site or overlay; role-based tunnel selection lets a single SSID/port serve multiple policy domains.

Device profiles on Aruba switches (and port profiles) apply a set of attributes - VLAN, PoE, auth mode - when a device is detected, enabling automated port provisioning.

Wired 802.1X: the switch is the authenticator; port states are unauthorized/authorized; a RADIUS role can push a VLAN or downloadable ACL after auth.

Wireless: WPA2/WPA3-Enterprise with 802.1X and RADIUS; WPA2-PSK with MPSK (multi-PSK) gives per-device keys and per-key roles without per-user identity.

MPSK on Aruba lets each device get a unique PSK mapped to a role, so a single leaked key can be revoked without rekeying the whole SSID.

Role-based ACLs should be applied as both ingress and egress where supported, and should deny inter-role traffic by default (deny-all then permit).

Captive portal on wired and wireless uses web auth; combine with role mapping so guest, BYOD, and corporate devices land in distinct roles from the same SSID or port.

ClearPass REST API and extension interfaces let external systems trigger role changes, endpoint updates, and CoA; integration requires an API client with scoped permissions.

TACACS+ for device admin AAA separates authentication (who), authorization (what commands), and accounting (what was done); it encrypts the full payload, unlike RADIUS.

Syslog, SNMP traps, and streaming telemetry feed SIEM; normalize auth events and CoA results so correlation across ClearPass, controllers, and switches is possible.

Troubleshooting order for 802.1X: verify link/EAPOL, check supplicant method and certs, verify RADIUS reachability and shared secret, then check service/role mapping and enforcement.

Use ClearPass Access Tracker to see the full policy evaluation trace for a single request: service match, role mapping, enforcement, and returned attributes.

Packet capture points: supplicant (EAPOL), NAD uplink (RADIUS to server), and server (auth logs); the first failing hop localizes the fault.

Common failure signatures: EAP timeout = no RADIUS response or wrong secret; Access-Reject = credentials/cert/posture; wrong VLAN = missing Tunnel attributes or role precedence.

Automation guardrails: test CoA and role changes in a lab service first, version-control policy exports, and keep a rollback path before bulk policy pushes.