HPE Networking ClearPass (HPE6-A88)Demo

Aruba’s default captive-portal certificate uses securelogin.hpe.com as its common name. The captive-portal address must match the certificate’s common name; if the certificate common name differs, requests for securelogin.hpe.com will not align with the configured portal identity and interception/redirection can fail.

Active Directory is an enterprise identity repository that lets ClearPass validate user credentials and retrieve directory attributes for authorization and role mapping, providing rich user context such as group membership and other user properties.

A disabled guest account is not eligible to authenticate, so the registration receipt renders the Log In control inactive (grayed out) until the account is enabled or approved.

Combining MAC authentication with captive-portal authentication lets a guest complete the portal flow initially and associates the device MAC address with the guest access record. Subsequent connections can be recognized through MAC authentication for the valid access period, while the captive portal still provides controlled guest onboarding and account-expiration policies.

The Base DN limits the Active Directory subtree that ClearPass searches. If computer accounts reside in a different OU from the user-account OU, they fall outside that search base and cannot be located for machine authentication. ClearPass documentation directs administrators to select the appropriate directory node as the Base DN.

ClearPass must be configured with Microsoft Active Directory as an authentication source so it can connect to the directory and validate user credentials. This integration is the prerequisite for authenticating users against the company’s existing identity store.

An OCSP status of unknown means the responder cannot confirm the certificate’s status. Because certificate-based authentication requires successful certificate validation, ClearPass rejects the authentication.

IETF attributes are standardized RADIUS attributes, enabling a single enforcement profile to apply across compatible devices from multiple vendors. Vendor-specific attributes are tied to individual vendor namespaces and commonly require separate handling and profiles.

Pre-Auth Check controls how guest usernames and passwords are validated before authentication, and Aruba ClearPass Guest exposes this setting in the Login Form area of the Web Login Editor.

ClearPass enforcement policies use rules that match conditions such as roles to actions defined by enforcement profiles. Including the operator account’s role evaluation in the enforcement policy allows the appropriate custom Operator Profile to be selected for that role.

ClearPass registers a network access device by its source IP address, subnet, or supported IP address range. This identifies the authorized origin of authentication requests; a device MAC address or a VPN tunnel does not serve as the required NAD source definition.

Hostname validation is performed against the certificate’s Subject Alternative Name (SAN) extension. All intended server hostnames must be included there, including a hostname also present in the Common Name, because clients may not use the CN for hostname matching.

The 10.0.0.0/8 range includes every IPv4 address whose first octet is 10, from 10.0.0.0 through 10.255.255.255. Searching for the 10. prefix matches that full range; the other prefixes limit the search to smaller portions of it.

RadSec encapsulates RADIUS communication in TLS and uses TCP transport. TLS encrypts and authenticates the RADIUS exchange, while TCP provides reliable packet delivery; this is appropriate when the path between devices and the RADIUS server is unsecured.

DHCP data lets ClearPass profile and classify the endpoint after its initial restricted authentication. ClearPass can trigger a RADIUS CoA termination for the active session; the client then authenticates again, allowing policy evaluation to use the new profile and assign full access.

ClearPass OnGuard requires TCP port 6658 for OnGuard-to-ClearPass communication, including the agent’s keep-alive/heartbeat connectivity, and TCP port 443 for HTTPS agent communication.

Approval activates the guest account for authentication, so the Log In button becomes active.

Zero Trust requires continuous evaluation of device state and observable behavior, rather than relying on an earlier authorization decision. When activity is suspicious, reducing access to least privilege or quarantining the device contains possible compromise while investigation proceeds.

ClearPass device profiling can use contextual information from multiple sources, including DHCP fingerprints and other device-identity data. Combining multiple profiling collectors supplies more evidence for endpoint classification than relying only on HTTP or only on DHCP, producing the most accurate and reliable profile.

RADIUS Start/Stop Accounting records when client sessions begin and end, which supports active-client license tracking. Without periodic Interim Accounting updates, the system avoids the additional processing and network overhead those updates create.

Non-AAA enforcement can provide policy control without configuring clients for AAA authentication and with only minimal configuration on the physical switches. Features such as 802.1X authentication and role-based dynamic VLAN assignment depend on AAA-based enforcement.

For Agentless OnGuard, the ClearPass Policy Manager server must be joined to a domain. The Persistent Agent and Agentless OnGuard cannot run together on the same client, and SMB v2 must be enabled on Windows endpoints.

A Web-Based Health Check Only service requires Posture Compliance to be enabled before the Posture tab is available. That tab is where one or more OnGuard-agent posture policies are selected, allowing ClearPass to evaluate the agent’s System Health Validator report against the configured policy. Aruba ClearPass documentation

Clients validate a ClearPass server certificate by building its certificate chain to a trusted root CA. Because an internal CA is not ordinarily trusted by client devices by default, its root certificate must be installed in each client’s appropriate trusted-root certificate store. Aruba documentation states that root certificates are explicitly trusted by clients.