Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Example: Configuring Device Profiling with EX Series Switches and Aruba ClearPass Policy Manager

This configuration example illustrates how to use the features of EX Series switches and Aruba ClearPass Policy Manager to perform device profiling as part of the endpoint authentication process.

In this example, an organization has four types of endpoints in its wired infrastructure for which it has defined access policies:

  • Access points—Endpoints profiled as access points are allowed access to the network and are dynamically assigned to the AP_VLAN VLAN.

  • IP phones—Endpoints profiled as IP phones are allowed access to the network. The IPPhone_VLAN is dynamically assigned as the VoIP VLAN.

  • Corporate laptops—Endpoints that have an 802.1X supplicant are authenticated by the user credentials. After the user is successfully authenticated, the laptop is granted access to the network and placed in the Windows_VLAN VLAN.

  • Noncorporate laptops—Endpoints that do not have an 802.1X supplicant and that are profiled as Windows devices are denied access to the network.

This topic covers:

Requirements

This example uses the following hardware and software components for the policy infrastructure:

  • An EX4300 switch running Junos OS Release 15.1R3 or later

  • An Aruba ClearPass Policy Manager platform running 6.3.3.63748 or later

Overview and Topology

To implement the endpoint access policies, the policy infrastructure is configured as follows:

  • All access interfaces on the switch are initially configured to be in VLAN 100, which serves as a remediation VLAN. If an endpoint is not successfully authenticated or is not successfully profiled as one of the supported endpoints, it remains in the remediation VLAN.

  • Endpoints that have an 802.1X supplicant are authenticated by using 802.1X PEAP authentication. For more information on 802.1X PEAP authentication, see Configuring 802.1X PEAP and MAC RADIUS Authentication with EX Series Switches and Aruba ClearPass Policy Manager.

  • Endpoints that do not have an 802.1X supplicant are authenticated using MAC RADIUS authentication and are profiled to determine what type of device they are. These endpoints undergo a two-step authentication process:

    1. The first step occurs after an endpoint first connects to the switch but before it has been profiled by Aruba ClearPass Profile. After it connects, the endpoint is authenticated using MAC RADIUS authentication. Aruba ClearPass applies an enforcement policy that instructs the switch to grant the endpoint access to the Internet but prevents it from accessing the internal network.

    2. The second step occurs after an endpoint has been successfully profiled. After being authenticated in the first step, the endpoint contacts a DHCP server to request an IP address. The switch relays the DHCP messages sent by the endpoint to the DHCP server to Aruba ClearPass as well, which allows ClearPass to profile the endpoint. After it has profiled the endpoint and added the endpoint to its endpoint repository, ClearPass sends a RADIUS Change of Authorization (CoA) message to the switch, telling it to terminate the session. The switch then attempts reauthentication on behalf of the endpoint. Because the endpoint now exists in the endpoint repository, Aruba ClearPass is able to apply an enforcement policy appropriate to the device type when it authenticates the endpoint. For example, if the endpoint is an access point, ClearPass applies the enforcement policy that dynamically assigns the access point to the AP_VLAN VLAN.

Figure 1 shows the topology used in this example.

Figure 1: Topology Used in This ExampleNetwork diagram showing an Aruba ClearPass server, EX Series Switch, Access Point, and two laptops connected within an internal cloud network.

Configuration

This section provides step-by-step instructions for:

Configuring the EX4300 Switch

CLI Quick Configuration

To quickly configure this example, copy the following commands, paste them in a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.

Step-by-Step Procedure

The general steps to configure the EX4300 switch are:

  • Configure the connection to the Aruba ClearPass Policy Manager.

  • Create the access profile used by the 802.1X protocol. The access profile tells the 802.1X protocol which authentication server and authentication methods to use and the order of the authentication methods.

  • Configure the 802.1X protocol.

  • Configure the VLANs.

  • Configure Ethernet switching on the access ports.

  • Configure integrated routing and bridging (IRB) interfaces and assign them to the VLANs.

  • Configure DHCP relay to send DHCP packets to Aruba ClearPass so that it can perform device profiling.

  • Create the firewall policy that blocks access to the internal network.

To configure the EX4300 switch:

  1. Provide the RADIUS server connection information.

  2. Configure the access profile.

  3. Configure 802.1X to use CP-Test-Profile and enable the protocol on each access interface. In addition, configure the interfaces to support MAC RADIUS authentication and to allow more than one supplicant, each of which must be individually authenticated.

    By default, the switch will first attempt 802.1X authentication. If it receives no EAP packets from the endpoint, indicating that the endpoint does not have an 802.1X supplicant, it then tries MAC RADIUS authentication.

  4. Configure the VLANs used in this example.

    Note that for dynamic VLAN assignment to work, the VLAN must exist on the switch before authentication is attempted. If the VLAN doesn’t exist, authentication fails.

  5. Configure the access ports.

    Each access port is configured to be in VLAN v100, the remediation VLAN. This VLAN will be used bythe endpoint if Aruba ClearPass does not send dynamic VLAN information when it authenticates the endpoint.

  6. Configure IRB interfaces and assign them to the VLANs.

  7. Configure DHCP relay to forward DHCP request packets to Aruba ClearPass.

    Note:

    In this configuration example, Layer 3 interfaces for the endpoint VLANs are configured on the access switch in order to demonstrate the DHCP relay configuration. In a typical enterprise deployment, however, the Layer 3 interfaces for the endpoint VLANs are configured on an aggregation or core layer switch. In such a deployment, DHCP relay on the aggregation or core switch should be configured to forward the DHCP requests from the endpoints to Aruba ClearPass.

  8. Configure a firewall filter, Internet_Only_Access, to be used for devices that have been authenticated by MAC RADIUS authentication but have not yet been profiled.

    This filter blocks an endpoint from accessing the internal network (192.168.0.0/16).

Results

From configuration mode, confirm your configuration by entering the following show commands.

If you are done configuring the device, enter commit from configuration mode.

Configuring Aruba ClearPass Policy Manager

Step-by-Step Procedure

The general steps for configuring Aruba ClearPass are:

  • Enable device profiling.

  • Modify the Juniper Networks RADIUS dictionary file so that it includes some additional Juniper Networks RADIUS attributes used in this configuration example.

  • Add the EX4300 as a network device.

  • Ensure that the server certificate used for 802.1X PEAP authentication has been installed.

  • Add the local user used in this example for 802.1X authentication.

  • Create the following enforcement profiles:

    • Employee_Windows_Profile that places endpoints in VLAN 150.

    • IPPhone_Profile that defines VLAN 120 as the VoIP VLAN.

    • AccessPoint_Profile that places endpoints in VLAN 130.

    • Internet_Access_Only_Profile that specifies the firewall filter Internet_Only_Access be used for devices that have not yet been profiled.

  • Create two enforcement policies:

    • A policy that is invoked when MAC RADIUS authentication is used.

    • A policy that is invoked when 802.1X authentication is used.

  • Define the MAC RADIUS authentication service and the 802.1X authentication service.

  • Ensure that the MAC RADIUS authentication service is evaluated before the 802.1X authentication service.

To configure Aruba ClearPass:

  1. Enable device profiling.

    Step-by-Step Procedure

    1. Under Administration > Server Manager > Server Configuration, click the name of the Aruba ClearPass server.

    2. In the System tab, click Enable this server for endpoint classification.

      Server configuration page for Juniper device cp-campus.englab.juniper.net 10.105.5.153 with settings for hostname, policy manager zone, and performance monitoring.

  2. Update the Juniper Networks RADIUS dictionary file.

    A Juniper Network RADIUS dictionary file comes preinstalled on Aruba ClearPass. Junos OS version 15.1R3 for EX Series switches adds support for three new Juniper Networks VSAs, which need to be added to the dictionary file.

    Step-by-Step Procedure

    1. In Aruba ClearPass, navigate to Administration > Dictionaries > RADIUS.

    2. In the RADIUS Dictionaries window, use the Filter field to search for Juniper under Vendor Name.

    3. Click the Juniper dictionary name, and then click Export and save the RadiusDictionary.xml file to your desktop.

      Aruba ClearPass Policy Manager interface showing RADIUS Dictionaries section with Juniper vendor attributes and navigation menu.

    4. Copy the following three attributes, paste them into RadiusDictionary.xml, and save the file.

      The dictionary file should look like this when you complete the paste:

      XML file snippet showing RADIUS configuration for Juniper devices with elements for XML declaration, root element, header info, vendor configuration, and RADIUS attributes.

    5. Import RadiusDictionary.xml into Aruba ClearPass by clicking Import button with green arrow above yellow base.in the RADIUS Dictionaries window and browsing to the file.

      RADIUS dictionary import interface with file selection, secret entry field, and Import and Cancel buttons.

    6. After you have imported the file, the Juniper dictionary file should look like this:

      RADIUS Dictionaries interface displaying Juniper 2636 attributes list with names, IDs, types, and directions. Options to Disable, Export, or Close.

  3. Add the EX4300 switch as a network device.

    Step-by-Step Procedure

    1. Under Configuration > Network > Devices, click Add.

      Network Devices interface with breadcrumb navigation Configuration - Network - Devices. Add button highlighted; options include Import and Export All.

    2. On the Device tab, enter the hostname and IP address of the switch and the RADIUS shared secret that you configured on the switch. Set the Vendor Name field to Juniper.

      User interface for adding a network device with fields for Name, IP or Subnet Address, and Shared Secrets. Tabs for SNMP and CLI Settings. Add and Cancel buttons.

  4. Ensure that a server certificate for 802.1X PEAP authentication exists.

    Under Administration > Certificates > Server Certificate, verify that Aruba ClearPass has a valid server certificate installed. If it does not, add a valid server certificate. The Aruba ClearPass documentation and your Certificate Authority can provide more details on how to obtain certificates and import them into ClearPass.

    Server certificate management interface for cp-campus.englab.juniper.net; RADIUS Server Certificate; Issued Sep 21, 2015; Expires Mar 19, 2016; Status Valid; Options for certificate management tasks.

  5. Add a test user to the local user repository.

    This user will be used to verify 802.1X authentication.

    Step-by-Step Procedure

    1. Under Configuration > Identity > Local Users, click Add.

    2. In the Add Local User window, enter the user ID (usertest1), username (Test User), and password. Then select Employee as the user role. Under Attributes, select the Department attribute and type Finance under Value.

      User interface for adding a local user in a system configuration tool. Fields for User ID usertest1, Name Test User, hidden Password and Verify Password. Enable User checkbox checked. Role dropdown selected Employee. Attributes include Department set to Finance. Add and Cancel buttons at the bottom.

  6. Configure an enforcement profile for employee Windows laptops or desktops that authenticate using 802.1X.

    This profile places the endpoints in VLAN 150.

    Step-by-Step Procedure

    1. Under Configuration > Enforcement > Profiles, click Add.

    2. On the Profile tab, set Template to RADIUS Based Enforcement and type the profile name, Employee_Windows_Profile, in the Name field.

      Configuration interface for adding a RADIUS-based enforcement profile with fields for Template, Name, Type, Action set to Accept, and Device Group List.

    3. On the Attributes tab, configure the attributes as shown.

      Configuration interface for adding enforcement profiles under Attributes tab showing RADIUS settings: Tunnel-Private-Group-Id 150, Tunnel-Type VLAN 13, Tunnel-Medium-Type IEEE-802 6. Option to add more attributes.

  7. Configure an access point enforcement profile, which places access points in VLAN 130.

    Use the same basic procedure to create this profile as you used in the previous step. After you complete the profile, the information on the Summary tab will appear as shown.

    Configuration screen for enforcement profile AccessPoint_Profile in a RADIUS network management system showing profile and attribute details.

  8. Configure an IP phone enforcement profile.

    This profile instructs Aruba ClearPass to return VLAN 120 as the VLAN that should be used as the VoIP VLAN. The Juniper Networks RADIUS dictionary defines a special RADIUS attribute to use for this purpose. Select RADIUS-Juniper for the attribute type and Juniper-VoIP-Vlan as the attribute name.

    After you complete the profile, the information on the Summary tab will appear as shown.

    Configuration screen for enforcement profile IPPhone_Profile in a network management system. Profile type RADIUS, action Accept, no device group. Attributes Juniper-VoIP-Vlan, VLAN ID 120 for VoIP devices.

  9. Configure an Internet access only enforcement profile.

    This enforcement profile tells Aruba ClearPass to return the name of the firewall filter Internet_Only_Access, which is the firewall filter you configured on the switch that blocks access to the internal network. After you complete this profile, the information on the Summary tab will appear as shown.

    Configuration screen for enforcement profile Internet_Access_Only_Profile; RADIUS type; action Accept; Filter-Id Internet_Only_Access.

  10. Configure the MAC RADIUS authentication enforcement policy.

    For endpoints being authenticated by MAC RADIUS authentication, this policy tells Aruba ClearPass to apply enforcement policies according to the device profile. The AccessPoint_Profile is applied to endpoints profiled as access points, and the IPPhone_Profile is applied to endpoints profiled as VoIP phones. The predefined enforcement policy Deny Access Profile is applied to endpoints profiled as Windows devices. This enforces the organization access policy that only laptops with an 802.1X supplicant are allowed access to the network. For all other endpoints, including endpoints that have not yet been profiled, the Internet_Access_Only profile will be applied.

    Step-by-Step Procedure

    1. Under Configuration > Enforcement > Policies, click Add.

    2. On the Enforcement tab, type the name of the policy (Juniper-MAC-Auth-Policy) and set Default Profile to Internet_Access_Only.

      Configuration interface for adding an enforcement policy. Policy name set to Juniper-MAC-Auth-Policy. Enforcement type is RADIUS. Default profile is Internet_Access_Only_Profile.

    3. On the Rules tab, click Add Rule and add the rules shown.

      You must add the rules sequentially by clicking Save before you create the next rule.

      Configuration interface for setting up Enforcement Policies in a network management system related to RADIUS. Shows rules evaluation algorithm options, a list of rules with conditions and actions, and buttons to add or reorder rules.

  11. Configure the 802.1X enforcement policy.

    This policy tells Aruba ClearPass to use the Employee_Windows_Profile enforcement profile if a user is successfully authenticated as a member of the finance department.

    Step-by-Step Procedure

    1. Under Configuration > Enforcement > Policies, click Add.

    2. On the Enforcement tab, type the name of the policy (Juniper_Dot1X_Policy) and set Default Profile to [Allow Access Profile]. (This is a predefined profile.)

      Configuration interface for adding an enforcement policy in a network management system. Fields include Policy Name Juniper_Dot1X_Policy, empty Description, selected Enforcement Type RADIUS, and Default Profile Allow Access Profile.

    3. On the Rules tab, click Add Rule and add the rule shown.

      Configuration interface for setting enforcement policies in a network tool. Rules are defined by conditions and actions, e.g., users in Finance trigger RADIUS authentication.

  12. Configure the MAC RADIUS authentication service.

    The configuration for this service results in MAC RADIUS authentication being performed when the RADIUS User-Name attribute and the Client-MAC-Address attribute received have the same value.

    Step-by-Step Procedure

    1. Under Configuration > Services, click Add.

    2. On the Services tab, fill out the fields as shown. Be sure to select the Profile Endpoints option.

      Configuration interface for MAC Authentication service setup. Service type: MAC Authentication. Name: Juniper_MAC_Auth_Service. Description: MAC-based Authentication Service. Monitor Mode unchecked. Options: Profile Endpoints checked. Service Rule: Type is Radius:IETF, Connection is Client-Mac-Address equals Radius:IETF:User-Name.

    3. On the Authentication tab:

      • Delete [MAC AUTH] from the Authentication Methods list and add [EAP MD5] to the list.

      • Select [Endpoints Repository] [Local SQL DB] in the Authentication Sources list.

      Configuration interface screenshot showing Authentication tab with sections for Authentication Methods and Sources. Selected method is EAP MD5. Selected sources are Endpoints Repository and Local SQL DB. Unchecked option to enable username prefix or suffix stripping.

    4. On the Enforcement tab, select Juniper-MAC-Auth-Policy.

      Configuration interface for network management, focused on Enforcement tab with Enforcement Policy dropdown showing options like AirGroup Enforcement Policy and Juniper-MAC-Auth-Policy. Includes fields for Description, Default Profile, and Rules Evaluation Algorithm set to evaluate-all. Conditions section has rule for Day-of-Week with Allow Access Profile.

    5. On the Profiler tab:

      • Add Computer, VoIP Phone, Access Points to the Endpoint Classification list.

      • Select [Juniper Terminate Session] from the RADIUS CoA Action list.

      This configuration causes endpoints to go through reauthentication after they are profiled and added to the endpoint repository. Before an endpoint is profiled, the Internet_Access_Only_Profile enforcement profile is in effect for the authenticated user session. (This profile is the default profile for the MAC authentication policy configured in Step 10.) After Aruba ClearPass successfully classifies a device, it sends a RADIUS CoA to the switch, which causes the switch to terminate the session. The switch then attempts to reauthenticate the endpoint. Because the endpoint’s device profile is now in the endpoint repository, the appropriate device enforcement profile will be applied when the endpoint is authenticated.

      Configuration interface for adding services on Profiler tab. Selected classification is Access Points. RADIUS CoA Action is Juniper Terminate Session. Options to Remove, View Details, and Modify are available.

  13. Configure the 802.1X authentication service.

    Step-by-Step Procedure

    1. Under Configuration > Services, click Add.

    2. On the Service tab, fill out the fields as shown.

      Configuration interface for 802.1X Wired Access Service in network management system. Service named Juniper_Dot1X_Service with options for monitor mode, authorization, and profile endpoints. Service rule matches all conditions based on Radius IETF NAS-Port-Type equals Ethernet 15.

    3. On the Authentication tab, set Authentication Sources to [Local User Repository][Local SQL DB].

      Configuration interface for network authentication system with Authentication tab open displaying options for EAP methods and Local User Repository.

    4. On the Enforcement tab, set Enforcement Policy to Juniper_Dot1X_Policy.

      Enforcement tab in network management interface with dropdown for policy selection, modify button, and conditions for day-based access control.

  14. Verify that the MAC RADIUS authentication service policy is evaluated before the 802.1X authentication service policy.

    Because Aruba ClearPass is configured to recognize MAC RADIUS authentication requests by the RADIUS User-Name attribute and the Client-MAC-Address attribute having the same value, it is more efficient to have the MAC RADIUS service policy evaluated first.

    In the Services main window, verify that Juniper-MAC-Auth-Policy appears before Juniper-MAC_Dot1X_Policy in the services list, as shown. If it does not, click Reorder and move Juniper-MAC-Auth-Policy above Juniper-MAC_Dot1X_Policy.

    Configuration interface showing network services with details on order, name, type, template, and status. Message: Juniper_Dot1X_Service added.

Verification

Confirm that the configuration is working properly.

Verifying 802.1X Authentication on the EX4300 Switch

Purpose

Verify that the test user, usertest1, is being authenticated and placed in the correct VLAN.

To perform this procedure, you must have a Windows device with an active 802.1X supplicant that passes the authentication information for usertest1. For information on how to configure a Windows 7 supplicant for 802.1X PEAP authentication, see Configuring 802.1X PEAP and MAC RADIUS Authentication with EX Series Switches and Aruba ClearPass Policy Manager.

Action

  1. Connect the Windows 7 laptop to ge-0/0/22 on the EX4300 switch.

  2. On the switch, type the following command:

  3. For more details, including the dynamic VLAN assignment, type:

    The output shows that usertest1 has been successfully authenticated and placed in Windows_VLAN VLAN.

Verifying the Access Point Authentication on the EX4300 Switch

Purpose

Verify that the access point has been successfully authenticated and placed in the correct VLAN.

Action

  1. Connect an access point to ge-0/0/6 on the EX4300 switch.

  2. On the switch, type the following command:

    The output shows that the access point has been authenticated and placed in the AP_VLAN VLAN.

Verifying the VoIP Phone and Non-corporate Laptop Authentication on the EX4300 Switch

Purpose

Verify that the VoIP phone has been successfully authenticated and that the non-corporate laptop has not been authenticated.

Action

  1. Connect a VoIP phone to ge-0/0/8 on the EX4300 switch, and connect a laptop that does not have an enabled 802.1X supplicant to the Ethernet port on the phone.

  2. To verify the authentication state of the devices, type the following command on the switch:

    The output shows that two supplicants are attached to the port, each identified by MAC address. The VoIP phone has been successfully authenticated and placed in IPPhone_VLAN. The laptop is in a connecting state, not authenticated state, indicating that it has failed to be authenticated.

  3. To verify that IPPhone_VLAN VLAN has been assigned as the VoIP VLAN, type the following command:

    IPPhone_VLAN is shown as a tagged VLAN, indicating that it is the VoIP VLAN.

Verifying the Status of Authentication Requests on Aruba ClearPass Policy Manager

Purpose

Verify that the endpoints are being correctly authenticated and that the correct RADIUS attributes are being exchanged between the switch and Aruba ClearPass.

Action

  1. Go to Monitoring > Live Monitoring > Access Tracker to display the status of the authentication requests.

    The Access Tracker monitors authentication requests as they occur and reports on their status.

    Access Tracker dashboard displaying user authentication requests with details like server IP, source, username, service, and login status. Filter set to show accepted requests. Auto Refresh enabled.

  2. To get more details on a particular authentication request, click on the request.

    Network access control system interface showing session request details: session ID R00001500-01-56abf7c8, date Jan 29 2016, MAC address 08-17-35-15-ec-53, username 08173515ec53, access IP 10.105.5.91, posture status UNKNOWN 100, service Juniper_MAC_Auth_Service, authentication EAP-MD5, role User Authenticated, IPPhone_Profile applied, device online.

  3. To verify the RADIUS attributes that Aruba ClearPass sent back to the switch for this request, click the Output tab.

    Network management interface showing a request with Output tab selected; IPPhone_Profile applied, unknown system and audit posture, VLAN ID 120 assigned for VoIP.

Meaning

The authentication request from the IP phone was successful and the correct information about the VoIP VLAN was returned to the switch.

Related Documentation