ClearPass Fundamentals and Architecture
What ClearPass is
Aruba ClearPass Policy Manager is a network access control (NAC) platform. It authenticates users and devices, evaluates policy, and returns an enforcement decision (permit, deny, VLAN, role, downloadable role, or CoA). Candidates must separate the policy decision point (PDP) - ClearPass itself - from the policy enforcement point (PEP) - the switch, controller, or gateway that applies the result.
Core services
ClearPass runs several services on one appliance or VM: Policy Manager (the administrative core and policy engine), ClearPass Guest (visitor management portal), OnGuard (endpoint health agent), Onboard (certificate provisioning for BYOD), and Insight (reporting and monitoring). Understand that these are licensed/activated modules, not separate products you install independently.
The request flow
A supplicant authenticates to a network device (802.1X, MAC auth, or web auth). The device sends a RADIUS Access-Request to ClearPass. ClearPass runs the service (matching rules), authenticates against an authentication source, runs role mapping and enforcement policies, and returns attributes. The device enforces them.
Traps
Questions love to blur the order of evaluation. Remember: service selection → authentication → role mapping → enforcement. Also know that a service can be matched on RADIUS attributes, device type, SSID, or endpoint attributes; the first matching service wins based on its ordered rules. Another trap: confusing the Policy Manager node with publisher/subscriber cluster roles - the publisher holds the configuration database and pushes it to subscribers.
Rule of thumb
If a packet is denied, ask: was the right service selected? Did authentication succeed? Did role mapping assign the expected role? Only then check enforcement. Work top-down; most "denied" tickets are service-matching or authentication-source issues, not enforcement.
Worked example
A guest SSID uses web auth. The service matches on NAS-Port-Type and SSID. Authentication hits the guest user repository. Role mapping assigns "Guest." Enforcement returns a captive-portal role and a bandwidth contract. Trace each stage to isolate faults.