Lee,
ClearPass, at its core is FreeRADIUS based, with a database (I forget if MySQL
or PostgreSQL) added.
In the Aruba system, the firewall functions are part of the wireless
controller. ClearPass RADIUS chooses the firewall role enforced by the wireless
controller ( AP) before the user even gets network access. I think Cisco keeps
the firewall external to the wireless controller because they sell external
firewall hardware.
For very small installations or demonstration, the controller can act as a DHCP
server (up to 512 clients, IIRC).
Bruce Osborne
Network Engineer – Wireless Team
IT Network Services
(434) 592-4229
LIBERTY UNIVERSITY
Training Champions for Christ since 1971
-Original Message-
From: Lee H Badman [mailto:lhbad...@syr.edu]
Sent: Saturday, June 28, 2014 8:14 AM
Subject: Re: Aruba Clearpass Bolted Up To Cisco WLAN For Guest Access
Good info, thanks Mike. I'd not need RADIUS in my scenario, and I'm guessing
Clearpass can't act like DHCP server or NAT box? Just comparing to how we use
BlueSocket.
Lee
On Jun 27, 2014, at 5:32 PM, Mike Ricci mri...@marymountcalifornia.edu
wrote:
Hi Lee,
We use Clearpass with the Aruba APs but are in the process of setting up
another site that has Aerohive AP's to integrate captive portal
authentication with Clearpass.
So, not Cisco, but I can tell you how it bolts onto another third party
wireless:
* We've made clearpass the radius server on the Aerohive controller.
* Clearpass actually serves the captive portal which is stored on it's
disk, mates to directory services, and sends back to the Aerohive controller
an ID once the user has auth'd.
* The Aerohive controller takes the ID and assigns a subnet based on that
ID.
Here's the setup for this - I'm sure this is very similar to what you
would do with the Cisco controller, specifying an outside radius
server:
http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/Tutori
al-Aerohive-Integration-with-Clearpass-corp-and-guest-mhc/td-p/149134
From there we have to control the firewall rules on the Aerohive
controller/AP side, based on the subnet or vlan that the device is dropped
into. Basically Clearpass does authentication for us, but does not control
any type of bandwidth limitations, firewall, etc. This is controlled through
the AP Controller, which would be the Cisco controller in your case.
Haven't turned up our guest wireless on Clearpass with the Aerohives, just a
basic captive portal so far, but our Clearpass Guest with Aruba AP's has the
following features all controlled from Clearpass (I assume it would be the
same with any wireless system):
* It allows you to give user(s) the right to sponsor a guest via a web
page.
* Guests can also self-register themselves, receiving a login via text
message or email
* You can manually input MAC addresses into Clearpass for devices like
Apple TV's.
Clearpass is a bit of a beast to setup, but very customizable; that's the
trade off. It runs as a VM, so if you wanted to test it out and had a
resource who had some time to learn, you could probably do a PoC to make sure
it mates up to Cisco.
Not sure if this is useful, but I can update you when I turn up our Guest
network on the Aerohive AP's in a few weeks.
Mike Ricci
Marymount California University
310.303.7263
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU on behalf of Lee H Badman
lhbad...@syr.edu
Sent: Friday, June 27, 2014 12:49 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Aruba Clearpass Bolted Up To Cisco WLAN
For Guest Access
Gotcha- thanks for clarification.
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU] On Behalf Of John Kaftan
Sent: Friday, June 27, 2014 2:36 PM
To: WIRELESS-LAN@LISTSERV.EDUCAUSE.EDU
Subject: Re: [WIRELESS-LAN] Aruba Clearpass Bolted Up To Cisco WLAN
For Guest Access
NAC is part of the Netsight Suite. You would have to go with NAC to get the
functionality you need. NAC licensing is expensive and it wouldn't be the
way to go just for the functionality you seek. If you wanted to embrace NAC
then I would say look at them as it is quite good plus has the functionality
you need.
John
On Fri, Jun 27, 2014 at 1:33 PM, Lee H Badman
lhbad...@syr.edumailto:lhbad...@syr.edu wrote:
Thanks, John. We’re steering away from NAC but will take a look at Netsight.
-Lee
From: The EDUCAUSE Wireless Issues Constituent Group Listserv
[mailto:WIRELESS-LAN@LISTSERV.EDUCAUSE.EDUmailto:WIRELESS-LAN@LISTSER
V.EDUCAUSE.EDU] On Behalf Of John Kaftan
Sent: Friday, June 27, 2014 1:28 PM
To:
WIRELESS-LAN@LISTSERV.EDUCAUSE.EDUmailto:WIRELESS-LAN@LISTSERV.EDUCAU
SE.EDU
Subject: Re: [WIRELESS-LAN] Aruba Clearpass Bolted Up To Cisco WLAN
For Guest Access
