Aruba ClearPass APC cheat sheet

ClearPass Policy Manager (CPPM) is the policy decision point; NADs (switches, controllers, APs) act as policy enforcement points relaying RADIUS requests.

Core services: Policy Manager (policy engine), Guest (sponsor/guest workflows), OnGuard (endpoint health), Onboard (certificate provisioning), and Insight (reporting/analytics).

Standard authentication flow: NAD sends RADIUS Access-Request to CPPM, CPPM runs the service's authentication method, then evaluates role mapping and enforcement policies, and returns Accept/Reject with VSAs.

Services are matched top-down by ordered rules; the first matching service processes the request, so rule ordering determines which policy path executes.

Role mapping assigns a Role attribute to the request context; enforcement policies then use roles plus other attributes to build the returned authorization.

ClearPass uses a publisher/subscriber cluster model; the publisher holds the configuration database and subscribers replicate configuration from it.

RADIUS and TACACS+ are the primary AAA protocols; TACACS+ is used mainly for device administration, RADIUS for network access.

Insight runs as a separate service/host role and stores reporting and accounting data; it is not required for real-time authentication decisions.

Licensing is capacity-based: Access licenses cover RADIUS/TACACS+ authentications, Onboard licenses cover device onboarding, OnGuard licenses cover health checks, and Guest licenses cover guest accounts.

A hardware or virtual appliance requires a valid platform license applied before services can be used; the license is tied to the appliance identity.

Cluster roles include publisher, subscriber, and standalone; a standalone node performs all roles on one appliance.

The publisher is the single source of configuration truth; subscribers pull configuration and must be able to reach the publisher over the management network.

Virtual appliances are deployed as OVF/OVA images and require adequate CPU, RAM, and disk per the sizing guide; undersizing affects authentication throughput.

Certificate-based deployments should use a CA-signed HTTPS/RADIUS certificate on each node; the publisher's certificate is used for cluster trust.

Backups and configuration exports are performed from the publisher; restoring configuration is a publisher-level operation.

Time synchronization (NTP) must be consistent across nodes; clock skew breaks certificate validation and cluster trust.

Enforcement policies consist of ordered rules; each rule has a condition (role/attributes) and an action profile set (RADIUS VSAs, VLAN, role, ACL, or posture result).

Common enforcement actions: assign a VLAN, apply a downloadable role/ACL, return a session timeout, or send a CoA to change authorization mid-session.

Role mapping maps authentication results (e.g., AD group, posture status) to a Role used in enforcement conditions.

Posture enforcement can return Accept, Reject, or Quarantine; quarantine typically places the endpoint in a remediation VLAN or restricted role.

Enforcement profiles are reusable action definitions; multiple enforcement policies can reference the same profile.

The default enforcement policy applies when no rule matches; it should be explicitly defined to avoid unintended open access.

CoA (Change of Authorization, RFC 5176) lets ClearPass re-evaluate and change an active session without requiring reauthentication.

Conditions can combine attributes with AND/OR logic and can reference authorization sources, endpoint attributes, and time-of-day.

Configuration objects include services, authentication sources, role mappings, enforcement policies, enforcement profiles, and endpoints.

A service binds together the matching rule, authentication methods, authentication sources, role mapping policy, and enforcement policy.

Authentication methods include PAP, CHAP, MS-CHAPv2, EAP-PEAP, EAP-TLS, EAP-TTLS, and EAP-FAST; the method must match what the NAD and supplicant negotiate.

Endpoint attributes (MAC, device category, OS) are stored in the endpoint repository and can be used as policy conditions.

Static hosts and device groups allow pre-registration of known devices for authorization decisions.

Admin accounts and role-based admin privileges control who can modify policy; audit logs record configuration changes.

Configuration changes on the publisher propagate to subscribers; verify replication status after major changes.

Services can be enabled/disabled and ordered; a disabled service is skipped during request matching.

Supported identity sources include Active Directory, LDAP, local user database, SQL database, RADIUS proxy, and token servers.

Active Directory joins use machine credentials; ClearPass queries AD over LDAP/Kerberos for authentication and group membership.

EAP-TLS requires client and server certificates; it is the strongest common method and does not transmit passwords.

PEAP/MS-CHAPv2 uses a server certificate for the tunnel and validates user credentials inside it; clients must trust the server certificate.

Authorization sources enrich the request with group/attribute data after authentication succeeds; they do not authenticate by themselves.

Local users are stored on ClearPass and are useful for fallback or service accounts but lack central lifecycle management.

LDAP filters and attribute mappings determine which directory attributes become authorization attributes in policy.

Machine authentication (computer account) can be combined with user authentication to distinguish domain-joined endpoints.

Guest flows include self-registration, sponsor approval, and social/credential-based login; each is defined by a web login page and a guest service.

Sponsors approve or create guest accounts through the Guest portal; sponsor roles determine approval authority.

Guest accounts have configurable start/end times and expiration; expired accounts fail authentication.

The guest captive portal is presented via RADIIS CoA/redirect from the NAD when an unauthenticated client connects.

Onboard provisions device certificates through an enrollment portal; the endpoint then authenticates with EAP-TLS using the issued certificate.

Onboard requires a certificate authority configured in ClearPass and a device profile that defines enrollment eligibility.

Device profiling identifies endpoint type (OS, manufacturer) to drive registration and onboarding decisions.

Guest and Onboard portals use HTTPS and should present a trusted certificate to avoid client warnings.

OnGuard is an endpoint agent that reports posture (OS patches, antivirus, firewall, disk encryption, running processes) to ClearPass.

The OnGuard agent communicates with ClearPass over HTTPS; posture results are evaluated by enforcement policy.

Posture policies define health checks and required states; non-compliant endpoints can be quarantined or remediated.

Remediation actions can include directing the user to update software or a remediation portal.

OnGuard supports persistent and dissolvable (web-based) agents; persistent agents provide continuous posture checks.

Agent health checks run at connect time and can be re-evaluated on a schedule or on network change.

OnGuard requires the agent to be installed and the endpoint to trust the ClearPass server certificate.

Posture status is exposed as an attribute (e.g., Healthy/Quarantined) usable in role mapping and enforcement.

Access Tracker shows the full request path: matched service, authentication result, role mapping, and enforcement outcome for each request.

The Event Viewer / audit logs record system and configuration events; use them to correlate failures with changes.

Common failure causes: wrong shared secret, certificate trust issues, unmatched service, failed identity source lookup, or enforcement reject.

RADIUS shared secrets must match exactly between NAD and ClearPass; mismatches produce silent drops or rejects.

Insight provides reports on authentication trends, failures, and accounting; use it to spot systemic issues.

Packet captures on the NAD and ClearPass (RADIUS 1812/1813, HTTPS 443) help isolate where a request fails.

Service order matters in troubleshooting: a request may match an earlier, unintended service before reaching the intended one.

Verify cluster replication and NTP sync when behavior differs between nodes.

Aruba controllers and switches act as RADIUS clients (NADs); configure ClearPass as the RADIUS server with matching shared secrets.

Aruba ClearPass integrates with Aruba Central, Mobility Controllers, and Aruba switches for role/VLAN enforcement via RADIUS VSAs.

Third-party NADs (Cisco, Juniper, etc.) are supported as generic RADIUS clients; vendor-specific VSAs must match the NAD's expected format.

RADIUS CoA (RFC 5176) is used to change authorization on Aruba and third-party NADs after posture or policy changes.

ClearPass can integrate with external services such as MDM, firewalls, and SIEM via extension/context servers and syslog.

For 802.1X, the NAD must be configured with the correct EAP method and point to ClearPass as the authentication server.

Aruba OS-CX and ArubaOS use downloadable user roles and per-role ACLs returned by ClearPass enforcement.

Certificate-based integrations require importing the ClearPass server certificate into NAD trust stores where applicable.

Policy decision vs enforcement: ClearPass decides, the NAD enforces; the NAD must support the VSAs ClearPass returns.

Service matching precedes authentication; authentication precedes role mapping; role mapping precedes enforcement.

The publisher holds the config DB; subscribers are read-only replicas for configuration and serve authentication load.

Insight is a separate reporting role and stores accounting/reporting data, not live policy state.

Guest, Onboard, and OnGuard are optional service modules enabled by license.

TACACS+ is for device administration; RADIUS is for network access control.

Roles are derived attributes, not identity sources; they are computed by role mapping policies.

Access, Onboard, OnGuard, and Guest licenses are separate capacity pools; running out of a pool blocks the corresponding workflow.

Platform license is required per appliance before services start.

Publisher is the config source of truth; subscribers must reach it over the management network.

NTP consistency across nodes is required for certificate and cluster trust.

Virtual appliances are sized by CPU/RAM/disk per the sizing guide; undersizing limits throughput.

Backups/exports are taken from the publisher.

Cluster trust relies on the publisher certificate; CA-signed certs are recommended.

Enforcement rules are ordered; first match wins, so specific rules must precede general ones.

Enforcement profiles are reusable action sets referenced by enforcement policies.

CoA (RFC 5176) re-authorizes an active session without reauthentication.

Posture outcomes map to Accept, Reject, or Quarantine enforcement.

Role mapping converts authentication/authorization results into a Role attribute.

Default enforcement policy must be explicitly defined to avoid unintended access.

Conditions combine attributes with AND/OR and can include time-of-day and endpoint attributes.

A service binds matching rule, auth methods, auth sources, role mapping, and enforcement.

Authentication method must match what the NAD and supplicant negotiate.

Endpoint repository stores MAC/device attributes usable as policy conditions.

Static hosts/device groups pre-register known devices for authorization.

Admin RBAC and audit logs govern and record configuration changes.

Publisher propagates config to subscribers; verify replication after changes.

Disabled services are skipped during request matching.

Identity sources: AD, LDAP, local DB, SQL, RADIUS proxy, token servers.

AD joins use machine credentials; queries use LDAP/Kerberos for auth and group data.

EAP-TLS uses client+server certs and transmits no password.

PEAP/MS-CHAPv2 tunnels credentials; clients must trust the server cert.

Authorization sources enrich attributes after authentication; they do not authenticate.

LDAP filters/attribute mappings determine which attributes reach policy.

Machine auth can be combined with user auth to identify domain-joined endpoints.

Guest flows: self-registration, sponsor approval, credential/social login.

Sponsor roles determine who can approve or create guest accounts.

Guest accounts have configurable start/end times; expired accounts fail auth.

Captive portal is presented via NAD redirect/CoA for unauthenticated clients.

Onboard issues device certificates via an enrollment portal; devices then use EAP-TLS.

Onboard requires a configured CA and a device profile defining eligibility.

Device profiling identifies endpoint type to drive registration/onboarding.

Guest/Onboard portals use HTTPS and should present a trusted certificate.

OnGuard reports posture: patches, antivirus, firewall, encryption, processes.

Agent communicates with ClearPass over HTTPS; results feed enforcement.

Posture policies define health checks and required states.

Non-compliant endpoints can be quarantined or remediated.

Remediation can direct users to update software or a remediation portal.

Persistent and dissolvable agents exist; persistent gives continuous checks.

Posture status is an attribute usable in role mapping and enforcement.

Agent must trust the ClearPass server certificate.

Access Tracker shows matched service, auth result, role mapping, and enforcement per request.

Event Viewer/audit logs correlate failures with configuration changes.

Common causes: shared secret mismatch, cert trust, unmatched service, identity source failure, enforcement reject.

RADIUS shared secrets must match exactly between NAD and ClearPass.

Insight reports reveal authentication trends and systemic failures.

Packet captures (RADIUS 1812/1813, HTTPS 443) isolate failure points.

Service order can cause unintended service matches.

Check cluster replication and NTP when nodes behave differently.

Aruba controllers/switches are RADIUS clients (NADs) with matching shared secrets.

ClearPass integrates with Aruba Central, Mobility Controllers, and Aruba switches for role/VLAN enforcement.

Third-party NADs are generic RADIUS clients; vendor-specific VSAs must match their format.

CoA (RFC 5176) changes authorization on Aruba and third-party NADs.

External integrations (MDM, firewall, SIEM) use extension/context servers and syslog.

802.1X requires the NAD to use the correct EAP method and point to ClearPass.

ArubaOS/OS-CX support downloadable roles and per-role ACLs from ClearPass.

Import the ClearPass server certificate into NAD trust stores where required.