Aruba ClearPass APC key terms

The central ClearPass server role that stores configuration, runs policy evaluation, and hosts services such as RADIUS, TACACS+, and web authentication. It can be deployed as a standalone node or in a cluster with publisher and subscriber roles.

The cluster node that owns the authoritative configuration database and replicates changes to subscribers. Administrative writes, licensing changes, and cluster-wide settings are made here and distributed to the rest of the cluster.

A cluster node that receives a read-only copy of configuration from the publisher and serves authentication and enforcement requests locally. Subscribers can be promoted if the publisher fails, depending on deployment design.

A group of ClearPass nodes joined so they share configuration and can serve requests with redundancy and load distribution. Nodes must have consistent software versions and synchronized time to join successfully.

A top-level policy container that matches incoming requests by type, such as RADIUS or web authentication, and by criteria like vendor or port. Each service holds its own authentication, authorization, and enforcement rule sets.

A policy step that assigns one or more roles to a request based on attributes such as group membership, endpoint posture, or device type. Roles become inputs to enforcement rules later in the policy evaluation flow.

A rule set that decides the final action for a request, such as permit, deny, or apply a role with VLAN or downloadable ACL attributes. Rules are evaluated top-down and the first match typically wins.

A reusable template that defines the attributes returned to a network device when an enforcement policy matches, such as VLAN ID, session timeout, or a downloadable role. Profiles are referenced by enforcement rules.

The mechanism ClearPass uses to validate credentials in a service, such as PAP, MS-CHAPv2, EAP-TLS, or PEAP. The chosen method determines which identity sources can be used and whether the server needs a certificate.

A configured repository ClearPass queries to verify user or device identity, such as Active Directory, LDAP, a local user database, or a SQL database. Multiple sources can be joined in one authentication sequence.

A repository consulted during authorization to retrieve additional attributes about a user or endpoint, separate from the source used to authenticate. Results feed role mapping and enforcement decisions.

A Microsoft directory service commonly joined to ClearPass so domain credentials can be validated and group membership retrieved. ClearPass joins as a domain member and queries domain controllers over LDAP and Kerberos.

A certificate-based EAP method in which both client and server present certificates. It provides strong mutual authentication without passwords but requires certificate provisioning to each endpoint.

A protected EAP tunnel method in which the server authenticates with a certificate and the client authenticates inside the tunnel, often with a username and password. It is widely used for Active Directory credential validation.

The AAA protocol ClearPass uses to receive access requests from network devices and return accept or reject decisions with attributes. It carries authentication and authorization data between the network device and ClearPass.

A switch, controller, or access point configured to send RADIUS requests to ClearPass and enforce the returned attributes. Each device is defined in ClearPass with a shared secret and vendor settings.

Change of Authorization, a RADIUS message that lets ClearPass tell a network device to modify or terminate an existing session. It is used to apply new enforcement after posture changes or to disconnect users.

An attribute sent by the network access device that identifies which device forwarded the request. ClearPass uses it to match devices to configured entries and to apply device-specific policy.

The ClearPass endpoint agent and policy component that checks device health, such as antivirus status, patch level, or disk encryption. Results are reported to ClearPass and can drive remediation or denial of access.

A rule set in OnGuard that evaluates reported endpoint health attributes and assigns a posture status. That status is then used in role mapping and enforcement to permit, deny, or remediate.

An individual OnGuard test that inspects a specific endpoint condition, such as whether antivirus is running or a required patch is installed. Health checks are grouped into posture policies.

A ClearPass module that lets visitors self-register or be sponsored, then receive temporary credentials for network access. It supports customizable portals, approval workflows, and time-limited accounts.

A staff user who reviews, approves, or creates guest accounts on behalf of visitors. Sponsors interact through the guest portal and may be restricted by role to specific guest templates.

A guest workflow where visitors enter their own details on a portal page and receive credentials, sometimes after sponsor approval. It reduces administrative effort compared with sponsor-created accounts.

The process of provisioning devices, such as installing certificates or configuration profiles, so they can connect securely. ClearPass Onboard automates this for supported endpoint platforms.

A customizable portal page presented to users for web-based authentication or guest registration. It can be branded and configured with different authentication methods and terms of use.

A service that issues and signs digital certificates used for EAP-TLS authentication, onboarding, and HTTPS on ClearPass portals. ClearPass can use an internal or external CA.

The entitlement model that determines which ClearPass features and how many endpoints or devices are permitted. Licenses are applied at the publisher and consumed by active endpoints and modules.

The rated limit of concurrent sessions, endpoints, or requests a ClearPass node or cluster can handle. Deployment sizing must account for peak authentication load and enabled modules.

A single ClearPass server instance in a deployment, identified by hostname and IP address. Nodes have roles such as publisher, subscriber, or standalone and must meet hardware requirements.

A role definition pushed from ClearPass to a supported Aruba device so the device can apply role-based policies locally. It reduces the need to preconfigure every role on the network device.

A AAA protocol supported by ClearPass for authenticating and authorizing administrative access to network devices. It separates authentication, authorization, and accounting and can return command-level permissions.

The ClearPass reporting and monitoring component that collects and displays authentication, endpoint, and system data. It helps with troubleshooting trends and audit reporting across the deployment.

A live view in Policy Manager showing recent authentication requests with their matched service, policy, and result. It is a primary tool for diagnosing why a request was accepted or rejected.

A record of administrative changes made in ClearPass, including who changed what and when. It supports accountability and change tracking during troubleshooting and compliance reviews.

The ClearPass component that discovers and classifies endpoints by fingerprinting attributes such as MAC vendor, DHCP, and user agent. Endpoint profiles feed role mapping and enforcement decisions.

A device record stored in ClearPass that holds identity, profiling, and posture information about a connecting client. Endpoint records are used in policy decisions and can be managed in bulk.

A built-in tool that evaluates a hypothetical request against current services and policies without live traffic. It shows which rules match and helps validate configuration changes safely.