Integration with Aruba and Third-Party Infrastructure
Aruba integration
ClearPass integrates with Aruba controllers, access points, and switches as RADIUS clients (NADs). Aruba infrastructure supports roles, downloadable user roles (DUR), and CoA. Traps: DUR requires the controller/switch to support it and the correct role configuration; and the NAD shared secret must match on both sides.
Third-party integration
ClearPass integrates with third-party switches, wireless controllers, firewalls, and VPNs via standard RADIUS. Vendor-specific attributes come from dictionaries - the correct dictionary must be present for the NAD's attributes to be understood. MDM/EMM integration feeds endpoint attributes for posture/role. SIEM/syslog integration forwards events.
NAD configuration
On each NAD, configure ClearPass as RADIUS server(s), set the shared secret, enable CoA (RFC 5176), and define the AAA method list. Traps: forgetting CoA configuration; mismatched secrets; missing dictionary; and NADs that don't send the attributes the service matches on.
Traps in questions
- Assuming all NADs support the same attributes - vendor differences matter.
- Forgetting the dictionary for vendor-specific attributes.
- Overlooking that MDM integration requires API/connector setup.
- Confusing role (logical) with DUR (downloaded role pushed to device).
Rule of thumb
Integration is a two-sided contract: ClearPass must send attributes the NAD understands, and the NAD must send attributes ClearPass matches on. Verify dictionary, shared secret, and CoA support.
Worked example
An Aruba controller must apply a downloadable role. ClearPass returns the DUR attribute; the controller must support DUR and have the role defined. If the role doesn't apply, check DUR support, the role name, and CoA configuration. For a third-party switch, confirm its dictionary and that it sends the SSID/port attributes the service matches.