Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Endpoints

Follow these steps to register endpoints, assign attributes and labels, and use them in auth policy rules for controlled network access.

Network Access Control (NAC) Endpoints page provides you with a database of all endpoints identified by their MAC addresses. Here, you can assign each endpoint with various attributes, such as Name, VLAN, Role, Client Label, Sites, and Description. After creating an endpoint, you can reference its Client Label directly in the match criteria of auth policy rules for MAB-based authentication. By utilizing client labels in auth policy rules, you can dynamically assign policy actions such as VLAN assignments, roles, and more.

In the following example, an endpoint is registered, assigned a client label and name, and the label is used in the auth policy match criteria to override the username returned in the RADIUS Access-Accept.

Register Endpoints

Use the following steps to set up endpoints for NAC:

  1. From the left menu of the HPE Mist management portal, select Organization > Access > Endpoints. Click Add Endpoint.

    You can also import endpoints by uploading a CSV file. See Import Endpoints.

  2. In the Add Endpoint page, enter the following details and click Save:

    • Name (Optional)—Name of the endpoint. You can use this value to override the User-Name attribute in RADIUS Access Accept during authentication on a per-endpoint basis for better visibility.

    • MAC Address (Required)—The unique MAC address of the endpoint.

    • Role (Optional)—A role that can be associated with the endpoint. Specify a value only if it is necessary to override role assignment during authentication on a per-endpoint basis.

    • VLAN (Optional)—VLAN ID between 1 to 4094 or VLAN name that can be assigned to an endpoint. Specify a value only if it is necessary to override VLAN assignment during authentication on a per-endpoint basis.

    • Client Labels (Optional)—One or more labels (tags) applied to the endpoint. These labels can be used in the match criteria of auth policy rules.

    • Description (Optional)—Additional information that helps identify or provide context for the endpoint.

    • Sites (Optional)—Endpoints can be associated with one or more sites. Endpoints that are not assigned to any site remain accessible from all sites.

    Add Endpoint form with fields for device configuration including Name Amazon Echo Dot, MAC Address 3ab0704a7ad6, Role, VLAN, Client Labels MAB-Devices and IoT, Sites DWR-LAB-01, and Description LAB Testing Device. Save and Cancel buttons below.

Import Endpoints

To import endpoints:

  1. Click Import Endpoints on the upper-right corner of the NAC Endpoint page.
    User interface for managing NAC endpoints with a pop-up titled Import Endpoints for uploading CSV files. Background shows an endpoint table with details like Name, MAC Address, Status, and Inactivity Days. Buttons for Import Endpoints and Add Endpoint are visible.

  2. Upload the CSV file to the portal using the Drag and Drop or Click to Upload CSV File option. You can click Download Sample CSV to download a sample CSV file with correct headers and format.

  3. Click Import.

    Import Endpoints pop-up showing successful upload of MIST-AA-LAB-Endpoints.csv with instructions for CSV format and options to download sample, select file, import, or cancel. Background shows device list with details like name, MAC address, and inactivity days.

Configure Auth Policy Labels

In the previous step, you have registered an endpoint. Now, you can use Client Label in the match criteria of the auth policy rules.

  1. From the left menu of the HPE Mist management portal, select Organization > Access > Auth Policy Labels.

  2. On the Auth Policy Labels page, click Add Label and enter the details.

    • Label Name—Enter the label name.
    • Label Type—Select the type as Client Label.
    • Label Values—Enter the labels that you assigned when adding a new NAC endpoint.

    • Click Create.

    Configuration interface for creating Auth Policy Labels with fields for label name, type, values, and matching options. User-defined labels include MAB-Devices and IoT.

  3. Create a Label with the Label Value Returned User Name and enable Allow Endpoint User-Name Override to override the User-Name returned in the RADIUS Access-Accept with the Endpoint Name.

    Configuration interface for setting up Auth Policy Labels with fields for Label Name, Label Type set to AAA Attribute, and options for Returned User Name set to Automatic. Includes example values, a checked Allow Endpoint User-Name Override checkbox, and Create and Cancel buttons for saving or discarding the setup.

Configure Auth Policy Rules

Navigate to Organization>Access>Auth Policies. Click Add Rule and assign the Client Label in the match criteria of the auth policy rule. In the assigned policies section, add the Returned User Name labels. Also add VLAN, Role labels as needed.

User interface for managing authentication policies in a network environment, titled Auth Policies, showing rules table with columns for rule number, name, match criteria, access status, assigned policies, rule activity, and hit count. Includes buttons to add rules, create labels, and view NAC events.

Client Connection and Verification

Navigate to Monitor>Service Levels>Events>Wi-Fi Client to review client connectivity and confirm assigned attributes in the NAC Events.

Network monitoring dashboard showing client device Amazon Echo Dot with events like DHCP Success and Gateway ARP Success. Displays network activity graph with spikes in data rate, client details like MAC address, VLAN 30, and authentication type MAB.

You can also use the NAC Clients page to view the client connectivity status along with the assigned User-Name, VLAN and Role.

Network management interface showing NAC Clients section with details of a connected Amazon Echo Dot device: Wireless, MAB auth, active, matched to IOT-DEVICES policy.

Inactive NAC Endpoints Detection

You can enable inactive endpoints detection at the organization level to automatically identify and mark endpoints that have not been seen on the network for a specified period. This helps keep your endpoints database accurate and up to date.

To configure inactive NAC endpoints detection:

  1. From the left menu of the HPE Mist management portal, select Organization>Settings and scroll down to the Access Assurance section.

  2. Enable the Inactive Endpoints Detection option. Specify the number of days after which an endpoint is considered inactive based on when it was last seen on the network.

    You can configure a value between 30 and 180 days; the default is 90 days. If an endpoint stays inactive longer than the configured inactivity period, it is automatically assigned the inactive_endpoint client label.

    Configuration panel for Access Assurance with options to enforce HPE Mist Networking Auth in EU regions, select IPv4, IPv6, or Dual Stack for HPE Mist Networking Auth Connection Mode, set MDM and EDR CoA Action to Reauthenticate or Disconnect, and enable inactive endpoint detection with labeling after days of inactivity.

  3. Click Save to apply the changes.

    The Inactivity Days column on the NAC Endpoints page displays the number of days each endpoint has been inactive.

    Dashboard for managing NAC Endpoints with filters for inactive labels. Table displays endpoint names, MAC addresses, VLANs, labels, inactivity days, and options to import or add endpoints. Pagination shows 32 total endpoints.

Related Documentation