In this presentation, we will cover authenticating guest users with ClearPass with Time Source authentication source and MAC- caching. Check out the webinar recording where this presentation was used: http://community.arubanetworks.com/t5/Security/Technical-Webinar-Recording-Slides-ClearPass-Guest-with-Mac/td-p/283101 Register for the upcoming webinars: https://community.arubanetworks.com/t5/Training-Certification-Career/EMEA-Airheads-Webinars-Jul-Dec-2017/td-p/271908

1. CLEARPASS – GUEST WITH MAC CACHING
USING TIMESOURCE
Technical Climb Webinar
10:00 GMT | 11:00 CET | 13:00 GST
Dec 29th, 2016
Presenter: Barath Srinivasan
Customer Engineering Architect | HPE-Aruba
barath.srinivasan@hpe.com

2. 2
Welcome to the Technical Climb Webinar
Listen to this webinar using the computer
audio broadcasting or dial in by phone.
The dial in number can be found in the audio
panel, click additional numbers to view local
dial in numbers.
If you experience any difficulties accessing
the webinar contact us
using the questions panel.

3. 3
Housekeeping
This webinar will be recorded
All lines will be muted during the
webinar
How can you ask questions?
Use the question panel on your screen
The recorded presentation will be posted on Arubapedia for
Partners (https://arubapedia.arubanetworks.com/afp/)

4. CLEARPASS – GUEST MAC CACHING
OVERVIEW

5. 5
Guest MAC Caching overview
• This is an alternative MAC Cacheing service available in the Clearpass device
• Although the MAC Caching service created by the service templates works fine, some find it difficult to
comprehend and do not want to depend on Insight as authorization source
• The MAC Caching service discussed in this Technical climb webinar does not use Insight as authorization source.
Instead, it makes use of an Endpoint attribute containing the MAC expiry date. This attribute is checked against
the authentication date. If the authentication date is before the Expiry date then access is granted, otherwise
denied (or redirected to a captive portal).

6. 6
Guest MAC Caching overview
Lets assume two types of users for which MAC Caching is enabled:
• Guests: Users defined in, and authenticated against the Guest User Database and have the role [Guest].
The MAC Expiry will be set to the Guest Account Expiry
• Employees: defined in, and authenticated against an external database, like Active Directory and have
the role [Employee]. The MAC expiry will be set to a fixed interval, for example 6 Months.
• The overview which we will be looking at for the reminder of the webinar, we’ll deconstruct the workflow in
the reverse order and we’ll discuss the step-by-step configuration order at the end of the webinar for the
ease of understanding.

7. AUTHENTICATION POLICY & ROLE
MAPPING POLICY

8. 8
MAC Authentication Policy
IMPORTANT POINTS TO NOTE:
This service makes use of an Endpoint attribute holding the MAC Cache expiry date.
Because this solution uses Endpoint attributes, care should be taken when using this solution with other systems
updating Endpoint attributes. An API call to update an Endpoint attribute may not take into account existing Endpoint
attributes. For example, MDM systems updating Endpoint objects.
MAC Authentication Policy
The Policy will only allow authentications which have the role [MAC Caching]
If MAC Caching is applied, different enforcement profiles are used depending on the role. In the example shown in
next slide, an employee will have the aruba user-role ‘MAC-Staff’ applied and guest will have the aruba-user-role
‘MAC-Guest’ applied. This can be entirely customized according to the customer’s policy, equipment and
requirements.

9. 9
MAC Authentication Policy
The default profile is [Deny Access [Profile] in the above example. Alternatively, the default profile can be set to an
Enforcement profile which enforces a captive portal. For Aruba controllers this can be achieved by returning an
aruba-user-role=‘guest-logon’ for example.

10. 10
Role Mapping Policy
The role mapping policy uses a couple of new attributes to determine if the role [MAC Caching] is assigned.

11. 11
Endpoint Attribute
%{Endpoint:MAC-Auth Expiry} is a new attribute defined in the Endpoint.
Go to Administration > Directories > Attributes and add an Endpoint attribute such as below:
This attribute is updated by a Post Authentication Enforcement Policy in the Policy of the Web Login Service

12. 12
Post Authentication Enforcement Profiles
For Guests, the MAC Expiry will be set to the same value as the Guest Account Expiry:

13. 13
Post Authentication Enforcement Profiles
Note that ‘ExpireTime’ needs to be added to the [Guest User Repository]. We’ll discuss this further in upcoming slides –
For Employees, authenticating against another auth source, the account expiry is not available. Therefore the MAC
Expiry will be set to a fixed interval determined by the customer’s security policy. In this example, the customer has
decided that MAC addresses for employees are allowed to be cached for 6 months after the Web Login.
In the example below, MAC expiry is set to a fixed interval after the Web Login authentication time.

14. AUTHENTICATION/AUTHORIZATION
SOURCES

15. 15
Authentication/Authorization Sources
• %{Authorization:[Time Source]:Today} is a new attribute defined in the Authentication Source [Time
Source]

16. 16
Attribute Definition
The attribute ‘Today’ is defined as:
The SQL: select localtimestamp(0) as today;

17. 17
Attribute Definition
The attribute ‘Six Months From Now’ is defined as:
The SQL: select localtimestamp(0) + interval ‘6 months’ as sixmonths;

18. 18
Additional Filter configuration examples
You can define other intervals as you wish by changing the interval in the SQL Query. For Example if you want to set
the MAC auth expiry to 7 days, the SQL query will be like:
Select localtimestamp(0) + interval ‘7 days’ as sevendays;
Next map the ‘sevendays’ to the alias “Seven Days From Now” for example.
As discussed earlier, the Guest User Account Expiry time needs to be made available from the [Guest User
Repository]:
Add the highlighted string (expire_time::timestamp) to the existing Authentication query and map this to Alias
ExpireTime.

19. 19
Additional Filter configuration examples

20. 20
Putting it all together
• Add the Endpoint attribute MAC-Auth Expiry
• Add the ExpireTime attribute to the authentication source [Guest User Repository]
• Add the attributes today and a fixed interval attribute to the Authentication source [Time Source]
• In the existing Web Login Service, add the post authentication enforcement to update the Endpoint attribute MAC-
Auth Expiry
• In the existing Web Login Service, add [Time Source] as an authorization source. You can remove [Insight] as
authorization source
• Create the MAC Authentication Policy

21. 21
Time Source
Ensure the Authentication
source [Time Source] is
added as an authorization
source.

22. THANK YOU!