Guest Access and Onboarding
ClearPass Guest
ClearPass Guest provides visitor management: self-registration, sponsor approval, kiosk provisioning, and captive portal workflows. Guests authenticate via web auth or a guest account, and enforcement typically returns a guest role, VLAN, and bandwidth contract.
Onboarding
Onboard provisions client certificates for BYOD devices so they can use EAP-TLS. The workflow: device connects, is redirected to the Onboard portal, the user authenticates, Onboard issues a certificate (often via SCEP/EST), and the device reconnects using EAP-TLS. Traps: Onboard requires a certificate authority (internal or supported), and devices must trust the onboarding CA.
Captive portal mechanics
Web auth redirects the client to a portal; after login, ClearPass returns a role and CoA. Traps: the NAD must support web auth/redirect; HTTPS portals need proper certificates; and the redirect URL must be reachable pre-authentication.
Traps in questions
- Confusing Guest (visitor accounts) with Onboard (certificate provisioning).
- Assuming Onboard works without a CA and trust chain.
- Forgetting that sponsor approval is a workflow option, not mandatory.
- Overlooking bandwidth contracts and session timeouts in guest enforcement.
Rule of thumb
Guests = temporary accounts + web auth + restricted role. BYOD = Onboard certificates + EAP-TLS + device trust. Keep the two workflows distinct.
Worked example
A visitor self-registers, a sponsor approves, the account is created in the guest repository, the visitor logs into the captive portal, ClearPass returns the Guest role with a bandwidth contract and session timeout, and CoA applies it. For BYOD, the employee onboards, receives a certificate, and reconnects with EAP-TLS to a corporate role.