Hospital Guest, Contractor, and IoT Segmentation
A regional hospital has 1,200 staff, 300 daily guests, and 450 clinical IoT devices. Staff use WPA2-Enterprise with Active Directory and ClearPass. Guests use an open SSID with a controller-hosted captive portal on a 192.168.50.0/24 VLAN, and guests can ping one another. Clinical IoT uses one shared PSK that was printed in a vendor manual and has not changed in three years. A security review requires three outcomes: contractors must be sponsored by staff and expire after 8 hours; IoT devices must be inventoried and segmented from clinical systems; guests must not reach each other or any hospital subnet. The hospital has Aruba Mobility Controllers, ClearPass, and Aruba APs. No new hardware budget is available. The clinical IoT devices cannot run 802.1X supplicants.
1. Design the contractor onboarding and enforcement flow using the existing ClearPass and controller. What must be true for the 8-hour expiry to be enforced?
Read the worked answer
Use ClearPass Guest for contractor self-registration, but require a named staff sponsor to approve before the account is enabled. The account should have an 8-hour expiration and be mapped by ClearPass to a contractor role, not to the staff VLAN. The controller must enforce that role with a VLAN and ACL that allows only the contractor destinations.
For the 8-hour limit to be real, ClearPass must send a Change of Authorization at expiry or the controller session timeout must be no longer than 8 hours; otherwise an already-associated device can stay connected. The sponsor approval should be logged. Do not issue a shared contractor PSK, because it cannot be tied to a person or expired reliably.
2. What is the risk of the current IoT PSK, and what is a practical migration that does not require new hardware or supplicants?
Read the worked answer
The shared PSK gives no per-device identity. Anyone who learns it can join the IoT VLAN, and one leaked device cannot be revoked without changing every device. That is unacceptable for 450 clinical devices. A practical migration is to inventory devices in ClearPass, assign each device or device group its own Multi-PSK if the deployed ArubaOS/AP release supports it, and put IoT in a dedicated VLAN/role with an ACL that permits only required clinical servers. If Multi-PSK is not available, use per-device MAC authentication plus profiling as an interim control, but treat MAC spoofing as a risk. Rotate the old PSK immediately and remove it after migration.
3. How would you stop guest-to-guest and guest-to-hospital traffic at the controller, and what test proves it?
Read the worked answer
Create a guest role that permits DHCP and DNS to the guest gateway and blocks all RFC1918/hospital subnets, then block guest-to-guest traffic with the controller/SSID inter-user blocking option where available and back it with an ACL. Do not rely on the captive portal alone. Test from two guest clients: ping each other and ping a known clinical address; both must fail. Test DNS and internet access; both must still work. Check the controller user role and datapath ACL counters to confirm the rules are hit, not just configured.