Network Access Control and Endpoint Visibility (ClearPass Policy Manager)
Policy model
ClearPass evaluates requests through services (what triggers evaluation), role mappings and enforcement policies/profiles (what is returned), and authentication sources (AD, LDAP, local, certificate stores). Order matters: services are matched top-down, so a broad catch-all service placed above a specific one shadows it. Understand the difference between an enforcement profile (the attributes returned) and an enforcement policy (the rule set choosing profiles).
Visibility
Endpoint profiling infers device type from fingerprints (DHCP, MAC OUI, hostname, SNMP, NMAP). Profiling is probabilistic, not authoritative - treat it as context, not proof. OnGuard provides posture (agent-based or agentless) covering patch level, AV status, and domain membership. Posture results feed enforcement, often into a quarantine or remediation role.
Traps
- Service ordering errors are the most common misconfiguration trap.
- Confusing authorization sources with authentication sources.
- Assuming a profile match is definitive; unknown devices often land in a default profile.
- Forgetting that posture checks require the endpoint to report - an unreachable agent is not a pass.
Worked example
A printer fails 802.1X and falls back to MAB. The correct design is a service matching MAB requests, profiled as a printer, returning a device role with limited access - not granting it the employee role because the MAC looked familiar.