QuestionQ2
AnalyzeYou are designing an AOS-10 architecture and ClearPass solution for a manufacturing company with legacy equipment that supports only WPA2. You need to improve security for these devices.
This equipment will connect to an SSID named "Factory." If equipment passes authentication and is assigned the custom Device Category "Manufacturing," it must receive this AOS user role: "equipment." That role, along with a "profiling" role for unprofiled devices, is already configured on the AOS devices.
The users who configure PSKs on the equipment belong to the "FactoryAdmins" group in the company's Active Directory domain. CPPM has an authentication source for that domain named MyAD. As part of the solution, you have created these services on CPPM:
- Service 1:
- Type: Application
- Authentication source: MyAD
- Authorization source: None
- Enforcement policy:
- Rule 1 condition: Authorization:Endpoints Repository:Category EQUALS Manufacturing
- Rule 1 profile list: Enforcement profiles that permit application access and assign the Guest Operators role
- Default action: Deny access
- Service 2
- Type: Wireless with mPSK
- Authentication source: Guest Devices Repository
- Authorization source: None
- Enforcement policy:
- Rule 1 condition: Endpoint Device Insight Tag EQUALS Manufacturing
- Rule 1 profile list: Enforcement profile that assigns Aruba-User-Role = equipment and [Registered Device MPSK] profile
- Rule 2 condition: Endpoint:Device Insight Tag NOT_EXISTS
- Rule 2 profile list: Enforcement profile that assigns Aruba-User-Role = profiling and [Registered Device MPSK] profile
- Default action: Deny access
What is incorrect in this configuration?
- A Service 2 requires the Endpoints Repository as an authorization source and adjustments to the enforcement policy.
- B Service 1 uses the wrong service type.
- C Service 2 uses the wrong authentication source.
- D Service 2 is missing a necessary rule in the enforcement policy.
Community Discussion