Identity, Authentication, and Access Control (ClearPass and AAA)
Core concepts
Master the AAA flow: supplicant → authenticator (switch/controller) → authentication server (ClearPass) → identity store (AD, LDAP, local, SQL, token). Know EAP methods: EAP-TLS (certificate both sides, strongest), PEAP/EAP-TTLS (server cert, inner method such as MSCHAPv2), and the risks of unprotected inner methods. Understand RADIUS attributes (Calling-Station-Id, NAS-Port-Type, User-Name, Filter-Id) and how they feed role mapping. Know 802.1X supplicant, authenticator, and authentication server roles, plus MAB for devices that cannot do 802.1X and its spoofing weakness.
ClearPass services
A ClearPass service is a matching rule set (type, conditions) that selects an authentication method and role mapping. Enforcement policies evaluate attributes and return a role or profile. Understand posture (health checks) and onboarding (device provisioning with certificates) as separate services. Know that role mapping can key on AD group, endpoint attributes, or device type.
Traps to watch
Don't confuse authentication method with role mapping - one verifies identity, the other assigns authorization. MAB is not secure authentication; it identifies by MAC only. PEAP validates the server certificate, not the client, unless inner methods add client auth. RADIUS is UDP with shared-secret protection; the secret is not user authentication.
Rule of thumb
Trace the attribute chain: what the supplicant sends → what the NAS adds → what ClearPass matches → what role returns. Any break in that chain is the answer to a troubleshooting question.