Role-Based Access Control with Aruba ClearPass
A university campus uses Aruba ClearPass for network access control. Students connect via 802.1X with their domain credentials, and IoT devices (like smart TVs and printers) use MAC authentication. The network team wants to enforce that students can only access the internet and internal student resources, while IoT devices are restricted to a specific VLAN and can only communicate with their management server. The edge switches are Aruba 2930M, and the wireless is Aruba 315 APs managed by Aruba Central. The team is concerned about unauthorized devices connecting to the network.
1. How would you design the ClearPass policies to meet these requirements?
Read the worked answer
Create enforcement policies based on user role and device type. For students: authenticate via 802.1X (EAP-PEAP/MSCHAPv2) against Active Directory. Upon successful authentication, assign a role (e.g., 'Student') that maps to a VLAN with access to internet and student resources, enforced via switch ACLs or downloadable roles. For IoT devices: use MAC authentication against a database of known MACs. Assign a role 'IoT' that places the device in an IoT VLAN with ACLs restricting traffic to only the management server IP. Use ClearPass role mapping and enforcement profiles to assign VLAN and ACL. Reasoning: ClearPass can return attributes like Tunnel-Private-Group-ID (VLAN) and Filter-Id (ACL) to the switch. For wireless, the AP forwards client traffic to the controller or gateway where roles are enforced. Ensure that MAC authentication requests are matched to a device database and that unknown MACs are denied or quarantined.
2. What measures would you take to prevent unauthorized devices from connecting?
Read the worked answer
- Enable 802.1X on all switch ports and require authentication for wired access; use MAC authentication as a fallback for devices that don't support 802.1X, but with strict profiling. 2. Implement ClearPass device profiling to detect and classify devices, and only allow known device types. 3. Use port security features like MAC limiting and DHCP snooping on switches. 4. For wireless, use WPA2-Enterprise with 802.1X for students, and for IoT use WPA2-PSK with MAC filtering or separate SSID with MAC authentication. 5. Enable ClearPass OnGuard or similar posture checks for students to ensure they meet security requirements. Reasoning: A combination of authentication, authorization, and accounting (AAA) with profiling and posture checks reduces the risk of unauthorized access. Also, monitor ClearPass logs for failed authentications and alerts.