Network Access Control and Enforcement
NAC concepts
NAC controls who and what gets on the network and what they can reach. ClearPass supports 802.1X (supplicant-based), MAC authentication (device-based), and web authentication (captive portal). The enforcement result is expressed as RADIUS attributes - VLAN, role, ACL, downloadable role, or CoA - that the NAD applies.
Roles and enforcement
Role mapping assigns a logical role (e.g., Employee, Guest, Unknown) based on authentication and endpoint attributes. Enforcement policies then translate roles and conditions into enforcement profiles. A profile contains the actual RADIUS attributes (e.g., Tunnel-Private-Group-ID for VLAN, Filter-Id for ACL).
Change of Authorization (CoA)
CoA lets ClearPass re-evaluate a session and push new enforcement without re-authentication - critical for OnGuard posture changes or endpoint profiling updates. Traps: CoA requires NAD support and correct shared secrets; a CoA to a device that doesn't support RFC 5176 will silently fail.
Profiling
ClearPass profiles endpoints using DHCP, MAC OUI, LLDP/CDP, and other fingerprints to identify device type. Profiling feeds role mapping and enforcement (e.g., put printers on a printer VLAN). Trap: profiling is passive inference, not authentication - don't confuse a profile with an authenticated identity.
Traps in questions
- Enforcement profiles return attributes; enforcement policies choose which profiles apply.
- Default enforcement applies when no policy matches - know its behavior.
- MAC auth is device authentication, not user authentication.
- CoA changes an existing session; it does not create a new one.
Rule of thumb
Think in layers: authenticate → assign role → apply enforcement profile → NAD enforces. For posture or profiling changes mid-session, use CoA.
Worked example
An unknown device authenticates via MAC auth, profiles as a printer, maps to the "Printer" role, and enforcement returns a printer VLAN via Tunnel-Private-Group-ID. If it later profiles differently, CoA re-pushes the new VLAN.