ClearPass Policy Manager Configuration
Configuration building blocks
Policy Manager configuration centers on services, authentication sources, role mapping policies, enforcement policies and profiles, and dictionaries. A service defines matching rules (which requests it handles) and references an authentication method and source. Services are ordered; the first match is used.
Services in detail
A service has match rules (RADIUS attributes, SSID, NAS, endpoint type), an authentication configuration (method and sources), and can reference role mapping and enforcement. Traps: a service with no matching rule matches everything; misordered services shadow later ones; and the authentication source order matters for failover.
Authentication sources
Sources include Active Directory, LDAP, local user database, SQL, and token servers. Configure the source, test connectivity, and set the authorization attributes used downstream. Trap: an AD source that authenticates but returns no group attributes will break role mapping that depends on groups.
Role mapping and enforcement
Role mapping evaluates rules against authentication and endpoint attributes to assign a role. Enforcement policies evaluate role plus conditions to return profiles. Traps: rule order within a policy matters (first match wins); a missing "else" rule leaves sessions with no role; and enforcement profiles must contain valid attributes for the target NAD.
Dictionaries and attributes
Dictionaries define vendor-specific attributes. If a NAD needs a vendor attribute, the correct dictionary must be present.
Rule of thumb
Build and test bottom-up: source → role mapping → enforcement profile → enforcement policy → service. Test each layer with the built-in test tools before wiring the service.
Worked example
To allow domain computers on a corporate VLAN: create an AD source (test it), a role mapping rule matching the computer group → "Domain Computer," an enforcement profile returning the corporate VLAN, an enforcement policy mapping that role to the profile, and a service matching the wired SSID/port type that references all of it.