ClearPass OnGuard
What OnGuard does
OnGuard is the endpoint health/posture agent. It checks the endpoint (OS patches, antivirus, firewall, disk encryption, registry, processes) and reports posture to ClearPass. ClearPass then enforces: healthy endpoints get full access; unhealthy endpoints get remediation (a quarantine VLAN or restricted role).
Components
- OnGuard agent on the endpoint.
- Health classes defining required checks.
- Posture policies that evaluate results.
- Remediation actions (redirect to a remediation portal, instructions).
Traps: OnGuard requires the agent installed and licensed; posture evaluation depends on the agent reporting; and CoA is used to re-evaluate when posture changes mid-session.
Agent vs. agentless
OnGuard can operate with the persistent agent or in limited agentless modes. Trap: assuming full posture checks work without the agent - many checks require it.
Traps in questions
- Confusing health class (what to check) with posture policy (what result triggers what action).
- Forgetting OnGuard needs a module license.
- Assuming posture changes apply without CoA.
- Overlooking that remediation may require a separate VLAN/role.
Rule of thumb
Posture = check + evaluate + remediate. Healthy → full role; unhealthy → quarantine role; fixed → CoA to full role. Always confirm the agent is installed and licensed.
Worked example
A laptop connects via 802.1X and authenticates. OnGuard reports antivirus disabled. The posture policy marks it unhealthy, and enforcement returns a quarantine role/VLAN with remediation instructions. After the user enables antivirus, OnGuard re-reports, and ClearPass issues CoA to move the session to the full-access role.