HP HPE6-A68 Practice Test - Questions Answers, Page 3

Session Timeout (in seconds) - Configure the agent session timeout interval to re-evaluate the system health again. OnGuard triggers auto-remediation using this value to enable or disable AV-RTP status check on endpoint. Agent re-authentication is determined based on session-time out value.

You can specify the session timeout interval from 60 – 600 seconds. Setting the lower value for session timeout interval results numerous authentication requests in Access Tracker page. The default value is 0.

Reference: http://www.arubanetworks.com/techdocs/ClearPass/Aruba_CPPMOnlineHelp/Content/CPPM_User Guide/Enforce/EPAgent_Enforcement.htm

5. Configuring the Aruba Controller

5.1 Add Clearpass as RADIUS Server

Navigate to Configuration > SECURITY > Authentication > Servers

Click on RADIUS Server and enter the Name of your Clearpass Server: myClearpass Click Add Click on myClearpass in the Server List Etc.

Reference: https://community.arubanetworks.com/t5/Security/Step-by-Step-Controller-CPPM-6-5-Captive-Portal-authentication/td-p/229740

The first rule will match, and the Remote Employee ACL will be used.

We see System Posture Status: HEALTHY(0)

End systems that pass all SHV tests receive a Healthy Posture Token, if they fail a single test they receive a Quarantine Posture Token.

Reference: CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 13

https://community.arubanetworks.com/aruba/attachments/aruba/aaa-nac-guest-accessbyod/21122/1/OnGuard%20config%20Tech%20Note%20v1.pdf

OnGuard uses HTTPS to send posture information to the ClearPass appliance. For OnGuard to use

HTTPS, it must have access to the network. If a customer requires 802.1x authentication on the wiredswitch, a separate 802.1x authentication must be used prior to the OnGuard posture check. In thisexample, an 802.1x PEAP-EAP-

MSCHAPv2 authentication is completed first. A separate WebAuthservice must be setup with posture checks to use the OnGuard agent.

Reference: MAC Authentication and OnGuard Posture Enforcement using Dell WSeries ClearPass and Dell Networking Switches (August 2013), page 21

The OnGuard Agent enforcement policy retrieves the posture token. If the token is HEALTHY it returns a healthy message to the agent and bounces the session. If the token is UNHEALTHY it returns an unhealthy message to the agent and bounces the session.

Reference: CLEARPASS ONGUARD CONFIGURATION GUIDE (July 2015), page 27

The Health Check Service requires a profile to terminate the session so that the RADIUS 802.1X authentication Service can use the posture token in a new authentication routine. The terminate session profile will utilize the Change of

Authorization feature to force a re-authentication.

See step 6) below.

Navigate to the list of Enforcement Profiles by selecting, Configuration > Enforcement > Profiles.

2. Click the + Add link in the upper right hand corner.

3. From the Template dropdown menu, choose RADIUS Change of Authorization (CoA).

4. Name the policy.

This example uses Dell Terminate Session as the profile name.

5. Leave all the other settings as default, and click Next > to move to the Attributes tab.

6. On the dropdown menu for Select RADIUS CoA Template, choose IETF-Terminate-Session-IETF.

7. Click Next > and review the Summary tab (Figure 22).

8. Click Save.

Reference: ClearPass NAC and Posture Assessment for Campus Networks Configuring ClearPass OnGuard, Switching, and Wireless (v1.0) (September 2015), page 22 http://en.community.dell.com/cfs-file/__key/telligent-evolution-components-attachments/13-4629- 00-00-20-44-16-18/

ClearPass-NAC-and-Posture-Assessment-for-Campus- Networks.pdf?forcedownload=true

HTTP User-Agent

In some cases, DHCP fingerprints alone cannot fully classify a device. A common example is the Apple family of smart devices; DHCP fingerprints cannot distinguish between an Apple iPad and an iPhone. In these scenarios, User-Agent strings sent by browsers in the HTTP protocol are useful to further refine classification results.

User-Agent strings are collected from:

* ClearPass Guest

* ClearPass Onboard

* Aruba controller through IF-MAP interface

Note: Collectors are network elements that provide data to profile endpoints.

The following collectors send endpoint attributes to Profile:

* DHCP

DHCP snooping

Span ports

* ClearPass Onboard

* HTTP User-Agent

*MAC OUI – Acquired via various auth mechanisms such as 802.1X, MAC auth, etc.

* ActiveSync plugin

* CPPM OnGuard

*SNMP

* Subnet Scanner

* IF-MAP

* Cisco Device Sensor (Radius Accounting)

* MDM

Reference: Tech Note: ClearPass Profiling (2014), page 11

https://community.arubanetworks.com/aruba/attachments/aruba/ForoenEspanol/653/1/ClearPass%20Profiling%20TechNote.pdf