Dell Powerconnect W-ClearPass Virtual Appliances Configuration manual
Contents
1. Click the disk icon to save the attribute Click Next to move to the Summary tab Click on Save to move back to the Enforcement policy Click on Add new Enforcement Profile From the dropdown menu under Template choose Agent Enforcement Dell Networking W Series ClearPass Configuration Guide 29 Enter a descriptive name in the Name field example Agent Unhealthy Enter a description in the Description field Click Next to move to the Attributes tab Delete the two auto populated attributes Click on Click to add From the dropdown menu under Attribute Name choose Bounce Client From the dropdown menu under Attribute Value check the checkbox Click the disk icon to save the attribute Click on Click to add From the dropdown menu under Attribute Name choose Message From the dropdown menu under Attribute Value type a message to indicate client is unhealthy Click the disk icon to save the attribute Click Next to move to the Summary tab Click on Save to move back to the Enforcement policy From the dropdown menu under Default Profile choose the healthy profile that was just created This example uses Agent Agent Healthy Profile Click on Next to move to the Rules tab Click on Add Rule Click on Click to add From the dropdown menu under Type choose Tips From the dropdown menu under Name choose Role From the dropdown menu under Operator choose EQUALS From the dropdown menu under Value choose Employ2. Default Profile choose Deny Access Profile Click on Next to move to the Rules tab Ensure Select first match is selected for Rules Evaluation Algorithm Click on Add Rule under Conditions Click on Click to add From the dropdown menu under Type choose Tips From the dropdown menu under Name choose Role From the dropdown menu under Operator choose EQUALS From the dropdown menu under Value choose Employee Click the disk icon to save the condition Dell Networking W Series ClearPass Configuration Guide 18 From the dropdown menu for Profile Names Select to Add choose RADIUS Allow Access Profile a Click on Save Click on Next to move to the Summary tab Figure 10 MAC Authentication ClearPass Configuring Enforcement Configuration Services Add Services GAMM Service Authentication Roles Summary Use Cached Results E Use cached Roles and Posture attributes from previous sessions Enforcement Policy MAC auth Enforcement example E Add new Enforcement Policy Enforcement Policy Details Description Example enforcement Default Profile Deny Access Profile Rules Evaluation Algorithm Pret applicable Conditions Enforcement Profiles 1 Tips Role EQUALS Employee Allow Access Profile lt Back to Start Here Click on Save to move to the Reorder Services page ClearPass evaluates the Services created from the top of the list to the bottom There are many default services tha
3. switch port upon an OnGuard failure action If the administrator requires SNMP traps for monitoring of the networks enable SNMP and configure the community strings per the Dell Networking 7000 Series Switch User s Configuration Guide Dell Networking ClearPass Configuration Dell Networking W Series ClearPass Configuration Guide 23 The following configuration steps start from a ClearPass appliance that has been setup according to the basic configuration outlined in the Dell Networking W ClearPass Policy Manager 6 0 Quick Start Guide It s assumed that all Subscription IDs and licensing has been enabled for the product This example builds upon the previous MAC Authentication example The configuration of the RADIUS server and their shared secrets are not repeated in this section The steps to setup the RADIUS server on both the switch and ClearPass are the same Please reference the steps in the previous example to enable the switch to be an authenticator by adding an external RADIUS server ClearPass The OnGuard service within ClearPass uses a web authentication which can support either a username password or certificate based login This allows for the OnGuard service to use the same method to sign into the ClearPass appliance as the authentication method used to access the network In this simplified example the method used for both authentication and OnGuard is a username and password Examples of databases supported include Active Dir
4. test PC can support 802 1x on its LAN interface For Windows 7 administrators can start the Wired Auto Config service by opening and locating it within services msc on the Standard tab Ensure the Local Area Connection Authentication settings are properly configured For this example Microsoft Protected Dell Networking W Series ClearPass Configuration Guide 35 EAP PEAP is used uncheck Validate server certificate use method Secured password EAP MSCHAP v2 and uncheck Automatically use my Windows logon name and password When connecting to the network Windows will ask for a username and password Enter the credentials that are located in the Local User database created within ClearPass for this example Once connected to the network the OnGuard application will also ask for a username and password These credentials are the same credentials located in the Local User database Within the Dell Networking 7024P GUI administrators can see the status of all authentications and can see if a port is currently authorized For the Port Access Log navigate to Switching gt Dot1x Authentication gt Monitoring Mode gt Port Access Control History Log ClearPass has an extensive Access Tracker which logs all the steps corresponding to Authentication Authorization and Enforcement It is very useful in identifying which service it s identifying to categorize the request and what issues it has during the authentication The Access Tracker can b
5. 48P admin rw Summary Edit wanayer sFlow 8 n o S E Switching Port Based Authentication Interface Settings Edit HN e C Network Security Port Security MAC Based ACL MAC Based ACE IPv4 Based ACL Interface git 0 47 iw IPv4 Based ACE Interface Parameters User Name 5c260a856f2f IPv6 Based ACE Admin Interface Control Auto ACL Binding Current Interface Control Authorized dien S Authentication Type MAC Only e Time Range Time Range Recurrence s Dynamic VLAN Assignment Disable Dot1x Authentications Guest VLAN Enable Port Based Authentication Glob Port Based Authentication Inter Dynamic Policy ACL Assignment Disable Le Monitoring Use Periodic Reauthentication Enable Le Host Authentication Reauthentication Period 300 4294967295 600 Sec Port Authentication Users Ports Reauthenticate Now Jumbo Frames Authentication Server Timeout 1 65535 30 Sec Green Ethernet Configuration Resending EAP Identity Request 1 65535 30 Sec Protected Ports Port Profile Quiet Period 0 65535 60 Sec Port Configuration LAG Configuration Storm Control Max EAP Requests 1 10 2 Port Mirroring Addre ables GARP Supplicant Timeout 1 65535 30 Sec Cancel RT Dell Networking W Series ClearPass Configuration Guide 38 Dell Networking W ClearPass MAC Authentication Configuration The configuration for W ClearPass does not change from the example shown in the main body
6. Click on Next to move to the Mapping Roles tab Click on Add Rule Click on Click to add within the Conditions window From the dropdown menu under Type choose Authentication From the dropdown menu under Name choose Source From the dropdown menu under Operator choose EQUALS From the dropdown menu under Value choose static list Mac auth Click on the disk icon to save the condition From the dropdown menu within the Actions window choose Employee the Employee role is a default value used to simplify this example Admins should define and use specific roles for their deployment Click on Next to move to the Enforcement tab Dell Networking W Series ClearPass Configuration Guide 17 Figure 9 MAC Authentication ClearPass Configuring Roles Configuration Services Add Services Ww Rigi S Service Authentication Enforcement Summary Role Mapping Policy mac auth test role DI Add new Role Mapping Policy Role Mapping Policy Details Description Default Role Rules Evaluation Algorithm first applicable Guest Conditions Role 1 Authentication Source EQUALS static list Mac auth Employee lt Back to start Here Under the Enforcement tab input and change the following Click on Add new Enforcement Policy Enter a descriptive name in the Name field Enter a description in the Description field Ensure RADIUS is selected for the Enforcement Type From the dropdown menu under
7. IETF Name Calling Station Id Operator BELONGS TO GROUP Value AllowedMacAddresses descriptive name from example on the disk icon next to the condition to save Click on Next at the bottom right to move to the Authentication tab Figure 7 MAC Authentication ClearPass Configuring a Network Policy Service Configuration Services Add Services ty oer Type Name Description Monitor Mode More Options Authentication Roles Enforcement Summary MAC Authentication z MAC Auth Service Example MAC based Authentication Service example E Enable to monitor network access without enforcement Authorization Audit End hosts Profile Endpoints Service Rule Matches ANY or ALL of the following conditions Type Name Operator Value 1 Radius 1ETF Calling Station Id BELONGS_TO_GROUP AllowedMacAddresses ki 2 Click to add Back to start Here Dell Networking W Series ClearPass Configuration Guide 15 Under the Authentication tab input and change the following Highlight MAC AUTH and remove it from the Authentication Methods list From the dropdown menu Select to Add choose EAP MD5 Highlight Endpoints Repository Local SQL DB and remove it from the Authentication Sources list Click on Add new Authentication Source Enter a descriptive name in the Name field for this example static list Mac auth is used Enter a descript
8. LE 36 Appendix been Eeer E 37 Dell Networking 55xx Series Gwitches cece neater eee 37 Dell Networking 55xx Series Firmware 37 MAC Authentication Configuration for 55xx Series Switch 37 Dell Networking W ClearPass MAC Authentication Conftiouration eee ee eee need 39 OnGuard posture enforcement with Dell Networking 55xx SWItCh cee eee eect eee ee ee eee 39 Dell Networking W ClearPass MAC Authentication Conftiouration eee ee tenet e ed 39 Dell Networking W Series ClearPass Configuration Guide 4 Figures Figure 1 Figure 2 Figure 3 Figure 4 Figure 5 Figure 6 Figure 7 Figure 8 Figure 9 Figure 10 Figure 11 Figure 12 Figure 13 Figure 14 Figure 15 Figure 16 Figure 17 Figure 18 Figure 19 Figure 20 Figure 21 Figure 22 Figure 23 Figure 24 Figure 25 Figure 26 Basic el le ee VE 7 MAC Authentication Configuration Flowchart cccccecc eee eee eee een ne eee 9 MAC Authentication 7024P Switch RADIUS Server Confiouration eee eee 11 MAC Authentication 7024P Switch Authentication Configuration ccceccee neces 12 MAC Authentication ClearPass Adding Network Autbenticator eset eree 13 MAC Authentication ClearPass Create Static Host List errenneren 14 MAC Authentication ClearPass Configuring a Network Policy Service eee eee 15 MAC Authentication ClearPass Configuring Authentication Method and Source 16 MAC Authentication ClearPass Configuring
9. MAC Authentication and OnGuard Posture Enforcement using Dell W Series ClearPass and Dell Networking Switches Dell Networking W Series ClearPass Configuration Guide Colin King Network Solutions Engineering Team This document is for informational purposes only and may contain typographical errors and technical inaccuracies The content is provided as is without express or implied warranties of any kind 2013 Dell Inc All rights reserved Dell and its affiliates cannot be responsible for errors or omissions in typography or photography Dell the Dell logo PowerConnect Forcel0 and PowerEdge are trademarks of Dell Inc Intel Pentium Xeon Core and Celeron are registered trademarks of Intel Corporation in the U S and other countries Microsoft Windows Windows Server Internet Explorer MS DOS Windows Vista and Active Directory are either trademarks or registered trademarks of Microsoft Corporation in the United States and or other countries Other trademarks and trade names may be used in this document to refer to either the entities claiming the marks and names or their products Dell disclaims proprietary interest in the marks and names of others August 2013 Rev 1 0 Dell Networking W Series ClearPass Configuration Guide Dell Networking W Series ClearPass Configuration Guide Contents ne E 6 Hd e Le E 6 Network Kee ee EEN 7 Applicable Hardware and Software Versions eee eee ee eee ee
10. Roles cece cee eect ee eee teeters 18 MAC Authentication ClearPass Configuring Enforcement cc cece eee eee eee ee ees 19 OnGuard Configuration Flowchart eege eege deele kg geed dns ee dee EEN ER OnGuard 7024P Switch Authentication Configuration cecceceee cece ee teeta 23 OnGuard ClearPass Adding Local User 25 OnGuard ClearPass Web Based Authentication Service 26 OnGuard ClearPass Authentication Source 26 OnGuard ClearPass Roles 0 0 0 nent nies 27 OnGuard ClearPass Adding New Posture Policy 28 OnGuard ClearPass Posture Policy Main Tab 29 OnGuard ClearPass Enforcement Policy 31 Wired 802 1x ClearPass Service Conftouration eect eee eee teeta aaa 32 Wired 802 1x ClearPass Authentication Tvpnes eect eee e eee e eee e nent neni ens 33 Wired 802 1 ClearPass ROl S sue sas aAa Ka ANAA NAAA TAE AEETI EANET 34 Wired 802 1x ClearPass Enforcement sssesssserssrrrssrirserrrsrrirrerirrererrerirrirerrrren 35 Appendix A 5524P Dot1x Global Settings ssssssissssrsserrsserrrsrrrnserrrsrrrrsrrrnrrrerren 38 Appendix A 5524P Dot1x Interface Settings MAC Only sssscsserseerreerrirerireerrrrerin rer 38 Appendix A 5524P Dot1x Interface Settings 802 1x only 39 Dell Networking W Series ClearPass Configuration Guide 5 Executive Summary The Dell Networking W Series ClearPass platform is a powerful access control appliance for use with wired or wireless network
11. ave to move to the Reorder Services page ClearPass evaluates the Services created from the top of the list to the bottom There are many default services that come configured with the base install These default services will not interfere with this example The Mac authorization service that was just created can be left at the bottom of the service order list Click on Save to complete the Web Auth configuration Configuring a Wired 802 1x Policy The next service to be configured is the standard 802 1x service This service will authenticate the device by request from the 7024P switch Once the device passes authentication with the 7024P switch it will automatically step to the OnGuard health check service that was just configured above Navigate to Configuration gt Start Here Click on 802 1x Wired Enter a descriptive name in the Name field Enter a description in the Description field Remove the 2 service rule with the name Service Type Dell Networking W Series ClearPass Configuration Guide 31 Click on Click to add From the dropdown menu under Type choose Radius IETF From the dropdown menu under Name choose User Name From the dropdown menu under Operator choose EXISTS Click the disk icon to save the rule Figure 20 Wired 802 1x ClearPass Service Configuration Configuration Services Edit Wired Authentication with OnGuard and 7024P Services Wired Authentication with OnGuard and 7024P Summary Authent
12. dd Network Configure W ClearPass Device 7024P as RADIUS server Build Static Host List MAC addresses Enable 802 1x Create MAC Authentication Service Configure MAC Authentication l with MAB on ports Define Authentication Method save Configuration Configure Roles for devices Configure Enforcement Policies Reorder and Save Service Dell Networking 7024P Configuration The following configuration steps start from a switch that has been configured to be an access switch with no network security settings in place Basic settings outlined in the Quick Start Guide have been completed Dell Networking W Series ClearPass Configuration Guide Add a RADIUS Server Navigate to System gt Management Security gt RADIUS gt RADIUS Server Configuration Click on Add Input IP address of the ClearPass appliance into RADIUS Server Host Address Change RADIUS Server Name to an appropriate name Click Apply Click on Detail Choose the IP address from the RADIUS Server Host Address drop down list Click on the checkbox located in the Secret field Enter a secret key to be used with the ClearPass appliance Choose Enable from the dropdown list in the Primary Server field Click on Apply Save your configuration to the running configuration disk icon at the upper right of the GUI Dell Networking W Series ClearPass Configuration Guide 10 Figure 3 MAC Authentication 7024P Switch RADIUS Server Configu
13. e located by navigating to Monitoring gt Live Monitoring gt Access Tracker There is also an OnGuard Activity list located in Monitoring gt Live Monitoring gt OnGuard Activity to monitor all OnGuard clients OnGuard Configuration Conclusion Many of the settings in the above example are simplified for the purpose of providing a basic configuration an administrator can build upon The default Web based authentication service within ClearPass will successfully prevent unhealthy clients from accessing the network The example above will result in a client that is restricted from all network access until the health issue is fixed Administrators can further design their network access capabilities to include a remediation VLAN or Quarantine network This will allow the PC to have minimal access to network resources and enable an IT administrator remote access to remediate the system Further configuration or a new service to detect the quarantined state and place it in the remediation VLAN would be required The client may also be required to physically reconnect the device after waiting for 2 3 minutes before retrying the authentication to allow any cached failure state to be cleared out Additional information on configuring VLANs with Dell switches can be found in their respective User s Configuration Guide The Dell Networking 7024P used in the above example has the following chapters with useful VLAN information Configuring Port and Syst
14. e base and can be substituted for the 7024P used in this example Dell Networking switches 8132 8164 8132F 8164F 7024 7048 7024P 7048P 7024F 7048R 7048R RA 8024 8024F M6220 M6348 M8024 M8024 k NOTE Dell Networking Switches not included in the list above could have behaviors that would require some modification to the methods used in the example configurations below however the methodology and mechanisms are similar and can therefore be applied with minor changes See Appendix A for information on how to use Dell 55xx switches MAC Authentication with W ClearPass and Dell Networking 7024P Switch The use of MAC Authentication is mainly used for devices such as printers cameras and IP phones that do not support 802 1x authentication and require the use of MAC Authentication The configuration example in this guide will only detail the basic setup of both the W ClearPass Policy Manager and the Dell Networking 7024P switch Network administrators may also want to configure specific VLANs to restrict traffic to the type needed for the device being placed on the 7024P switch port The assignment of VLANs based on successful authentication is not covered in this document Dell Networking W Series ClearPass Configuration Guide 8 Figure 2 MAC Authentication Configuration Flowchart eege Dell Networking Dell Networking 7024P Switch W ClearPass A
15. e to specify a comma separated list of rules to strip username prefixes or suffixes Click on Next to move to the Roles tab Click on Add new Role Mapping Policy Enter a descriptive name in the Name field Enter a description in the Description field Click on Next to move to the Mapping Rules tab Click on Add Rule Click on Click to add From the dropdown menu under Type choose Authorization Local User Repository From the dropdown menu under Name choose Role Name From the dropdown menu under Operator choose EXISTS Click the disk icon to save the rule From the dropdown menu under Role Name choose Employee Click on Save Click on Next to move to the Summary tab Click on Save to move back to the service configuration Dell Networking W Series ClearPass Configuration Guide 33 Figure 22 Wired 802 1x ClearPass Roles Configuration Services Edit Wired Authentication with OnGuard and 7024P Services Wired Authentication with OnGuard and 7024P Summary Service Authentication Enforcement Role Mapping Policy Wired Auth 7024P Modify Add new Role Mapping Policy Role Mapping Policy Details Description Default Role Guest Rules Evaluation Algorithm first applicable d Authorization Local User Repository Role_Name EXISTS Employee Conditions Role Click on Next to move to the Enforcement tab Check the checkbox for Use Cached Results Click on Add new Enforcement Pol
16. ectory LDAP and generic SQL For this example the local user database within ClearPass will be used Enter a user into the Local Users database Navigate to Configuration gt Identity gt Local Users Click on Add User Enter a User ID Name Password and Verify Password Keep the Enable User box checked From the dropdown menu under Role choose Employee Click Add Dell Networking W Series ClearPass Configuration Guide 24 Figure 13 OnGuard ClearPass Adding Local User Add Local User K User ID Test User Name Test User Password SERA Verify Password Eeer Enable User V Check to enable local user Role Employee sl Attribute Value T 1 Click to add Add Cancel Configuring an OnGuard Network Policy Navigate to Configuration gt Start Here Choose Web Based Authentication Enter a descriptive name in the Name field Enter a description in the Description field Click on the Posture Compliance check box under More Options Dell Networking W Series ClearPass Configuration Guide 25 Figure 14 OnGuard ClearPass Web Based Authentication Service Configuration Services Edit OnGuard with 7024P Services OnGuard with 7024P Summary Authentication Roles Posture Enforcement Name OnGuard with 7024P Description Wired OnGuard Health Check with Dell Switch Type Web based Authentication Status Enabled Monitor Mode E Enable to monitor network access without en
17. ee Click the disk icon to save the condition Click on Click to add From the dropdown menu under Type choose Tips From the dropdown menu under Name choose Posture From the dropdown menu under Operator choose EQUALS From the dropdown menu under Value choose QUARANTINE 20 Click the disk icon to save the condition From the dropdown menu under Enforcement Profiles Profile Names choose the unhealthy profile that was just created This example uses Agent Agent Unhealthy Dell Networking W Series ClearPass Configuration Guide 30 a Click the disk icon to save the condition Click on Save Click on Next to move to the Summary tab Click on Save to save the Enforcement policy and move back to the Service configuration Figure 19 OnGuard ClearPass Enforcement Policy Configuration Services Edit OnGuard with 7024P Services OnGuard with 7024P Summary Service Authentication Roles Posture Use Cached Results Use cached Roles and Posture attributes from previous sessions Enforcement Policy Wired enforcement with OnGuard and 7024P Add new Enforcement Policy Enforcement Policy Details Description wired enforcement policey for OnGuard Default Profile Agent Healthy Pofile Rules Evaluation Algorithm first applicable Conditions Enforcement Profiles Tips Role EQUALS Employee 1 AND Tips Posture EQUALS QUARANTINE 20 Agent Undieatthy Clink on Next to move to the Summary tab Click on S
18. eee tees eneeeeteeees 8 Dell W Series ClearPass 0 0 0 0 cece eee bisai etter eee 8 Dell Networking SWItCHES ccccc cece ce eee ents eee eee eee sees ee eee esas eeeae eae eateaeeeeeereeeeenesnesateneeas 8 MAC Authentication with W ClearPass and Dell Networking 7024P Zwitch 8 Dell Networking 7024P Configuration cece eee 9 Add aiRADIWS e EE 10 Enable Authentication and configure the port 11 Dell Networking ClearPass Configuration eee eee eee eee eat EEEEEEEEEEEEE EEEE EEEE EE 13 Adding NetWork AUtheMmblGator sisi cass seca ANNER al Vata wide Weta uate AA ENNER ENER vi ae 13 Tat Ca EC HEES a ONEA 14 Configuring a Network PONCY geed ege ged vests ner nnn DEE BEI ENEE TOER deeediass deals wasdiaaelands 15 Testing MAC Authentication WEE 19 MAC Authentication Concl SiO Mees sisson A dE ee KE d Ze e bulacan EN de ENNEN de eeh dE ge ee deet 20 OnGuard posture enforcement with Dell Networking 7024P Switch eee 21 Dell Networking 7024P Configuratio A0 nena el d RE aii a KREE aE a atau Aal 21 Enable Authentication and configure the port 22 SNMP Conte IO get Ed EE dE ER Dell Networking ClearPass Confiouration sicci nissrisrierrirni eeror terroir O EENE VESPNEEEEE 23 Enter a user into the Local Users database cc ceecc eee eee eee nett eterna eee 24 Configuring an OnGuard Network Policy 25 Configuring a Wired 802 1X Policy 31 Testing OnGuard Posture Conftouration cece eines 35 OnG ard COMPU e gteliregcleLeE
19. em Security and Configuring VLANs ClearPass provides VLAN attributes to the switch via the Enforcement Policy within the service Additional information on enforcement can be found in the Dell Networking W ClearPass Policy Manager User Guide The Enforcement chapter in the user guide contains the applicable VLAN information Dell Networking W Series ClearPass Configuration Guide 36 Appendix A Dell Networking 55xx Series Switches Dell Networking 55xx Series switches have different features and use a different firmware base than the switches detailed above Due to the feature and behavior differences the configuration of the Dell Networking 55xx switch will be different Dell Networking 55xx Series Firmware The following firmware version is used in the configuration information below System firmware version 4 1 0 10 The Hardware applicable to the firmware above is Dell Networking 5524 5548 5524P 5548P MAC Authentication Configuration for 55xx Series Switch The 55xx series switch uses the same EAP MD5 authentication method to facilitate the MAC authentication with MAB The main difference is a requirement to enable a Guest VLAN for MAC based authentication methods Details on the requirements for the types of authentication can be found in the Dell Networking 5500 Series System User Guide Similar to the examples in the main document the configuration steps below are limited to a basic setup to show the behavior and methodolo
20. entication example The configuration of the RADIUS server and their shared secrets are not repeated in this section The steps to setup the RADIUS server on both the switch and ClearPass are the same Please reference the steps in the previous example to enable the switch to be an authenticator by adding an external RADIUS server ClearPass Dell Networking W Series ClearPass Configuration Guide 21 Figure 11 OnGuard Configuration Flowchart Dell Networking W ClearPass Add Network Configure W ClearPass Device 7024P as RADIUS server Build Local User Database Dell Networking 7024P Switch Enable 802 1x Create Web Based Create 802 1x Authentication Wired Service Authentication Service Configure 802 1x Authentication on ports S Define Ke Authentication Method Save Configuration Create Posture Configure Roles Policy for users Configure Configure Enforcement Enforcement Policies Policies Reorder and Save Service Enable Authentication and configure the port Dell Networking W Series ClearPass Configuration Guide 22 Navigate to Switching gt Network Security gt Dot1x Authentication gt Authentication Under Global Parameters choose Enable from the dropdown list in the Administrative Mode field NOTE The enable authentication step above was completed in the previous MAC Authe
21. forcement More Options E Authorization V Posture Compliance Service Rule Matches ANY or ALL of the following conditions Type Name Operator Value 1 Host CheckType MATCHES_ANY Authentication ki 2 Click to add Click Next to move to the Authentication tab From the dropdown menu under Authentication Sources choose Local User Repository Local SQL DB Figure 15 OnGuard ClearPass Authentication Source Configuration Services Edit OnGuard with 7024P Services OnGuard with 7024P Summary Service Authentication Roles Posture Enforcement Authentication Sources Local User Repository Local SQL DB S es Add new Authentication Source Move Down Remove View Details Modify Select to Add DI Strip Username Rules El Enable to specify a comma separated list of rules to strip username prefixes or suffixes Click Next to move to the Roles tab Click on Add new Role Mapping Policy Enter a descriptive name in the Policy Name field Enter a description in the Description field Leave the Default Role as Guest Click Next to move to the Mapping Rules tab o Click on Add Rule o From the dropdown menu under Type choose Authorization Local User Repository o From the dropdown menu under Name choose Role_ Name Dell Networking W Series ClearPass Configuration Guide 26 o From the dropdown menu under Operator choose EXISTS o Click the disk icon to save the condition o From the dr
22. guration w Supplicant Timeout 1 65535 30 Sec LAG Configuration Storm Control Max EAP Requests 1 10 2 Port Mirroring Address Tables GARP Cancel REED Dell Networking W ClearPass MAC Authentication Configuration The configuration for W ClearPass does not change from the example shown in the main body of this document The same service and its setup can be used for both the 802 1x Wired and Web Auth services Dell Networking W Series ClearPass Configuration Guide 39
23. gy of the configuration Administrators should configure their access policies and user roles as outlined in their own network security policy This appendix is not a step by step guide Screenshots in the figures are summary screens of final configurations used in the validation Switching gt Network Security gt Dot1x Authentications gt Port Based Authentication Global Dell Networking W Series ClearPass Configuration Guide 37 Figure 24 Appendix A 5524P Dot1x Global Settings Port Based Authentication Global PowerConnect 5548P admin riw iei Port Based Authentication Global Heo BR Network Security Port Security MAC Based ACL MAC Based ACE IPv4 Based ACL Global Parameters IPv4 Based ACE Port Based Authentication State Enable w IPv6 Based ACL Authentication Method RADIUS EN IPv6 Based ACE ACL Binding Guest VLAN Enable Le ACL Bin L Proprietary Protocol Filtering VLAN List 1 Le Time Range Monitoring Mode Disable Time Range Recurren Dot1x Authentication Port Based Authentication Glob Accept Supplicant when Dynamic Policy ACL Assignment Has No Resources Enable Le Port Based Authentication Interf Monitoring VLAN Cancel WI Switching gt Network Security gt Dot1x Authentications gt Port Based Authentication Interface Settings Edit Figure 25 Appendix A 5524P Dot1x Interface Settings MAC Only oystem Port Based Authentication Interface Settings PowerConnect 55
24. ication Roles Enforcement Name Wired Authentication with OnGuard and 7024P Description 802 1X Wired Access Service Type 802 1X Wired Status Enabled Monitor Mode El Enable to monitor network access without enforcement More Options authorization Posture Compliance Audit End hosts E Profile Endpoints Service Rule Matches ANY or ALL of the following conditions Type Name Operator Value 2 Radius IETF NAS Port Type EQUALS Ethernet 15 GI 2 Radius 1ETF User Name EXISTS w 3 Click to add Click on Next to move to the Authentication tab Under the Authentication Methods EAP FAST EAP TLS and EAP TTLS can be removed Under Authentication Sources from the dropdown menu Select to Add choose Local User Repository Local SQL DB Dell Networking W Series ClearPass Configuration Guide 32 Figure 21 Wired 802 1x ClearPass Authentication Types Configuration Services Edit Wired Authentication with OnGuard and 7024P Services Wired Authentication with OnGuard and 7024P Summary Service Authentication Roles Enforcement Authentication Methods EAP PEAP a Move Up Add new Authentication Method EAP MSCHAPv2 Move Down Remove View Details Modify Select to Add x Authentication Sources Local User Repository Local SOL D I a Move Up Add new Authentication Source Move Down Remove View Details Modify Select to Add Strip Username Rules Enabl
25. icy Enter a descriptive name in the Name field Enter a description in the Description field From the dropdown menu under Default Profile choose Deny Access Profile Click on Next to move to the Rules tab Click on Add Rule Click on Click to add From the dropdown menu under Type choose Tips From the dropdown menu under Name choose Posture From the dropdown menu under Operator choose EQUALS From the dropdown menu under Value choose QUARANTINE 20 Click the disk icon to save the condition From the dropdown menu under Profile Names Select to Add choose RADIUS Deny Access Profile Click on Save Click on Add Rule Click on Click to add From the dropdown menu under Type choose Tips From the dropdown menu under Name choose Role From the dropdown menu under Operator choose EQUALS From the dropdown menu under Value choose Employee Click the disk icon to save the condition Dell Networking W Series ClearPass Configuration Guide 34 From the dropdown menu under Profile Names Select to Add choose RADIUS Allow Access Profile a Click on Save Click on Next to move to the Summary tab Figure 23 Wired 802 1x ClearPass Enforcement Configuration Services Edit Wired Authentication with OnGuard and 7024P Services Wired Authentication with OnGuard and 7024P Summary Service Authentication Roles Use Cached Results NM Use cached Roles and Posture attributes from previous sess
26. ing W ClearPass is highly optimized for use with wireless access using the W Series controllers and APs as the network access devices In addition to wireless network access control W ClearPass can service authentication requests from Dell Networking wired switches The combination of W ClearPass W Series Controllers and Dell Networking switches provides a complete solution for network access control Administrators with devices that do not support 802 1x printers cameras IP phones will learn the authentication method used with Dell switches for MAC authentication and how to configure the corresponding W ClearPass services Administrators can also learn how to use the OnGuard client within W ClearPass to ensure all PCs connected directly to Dell switches are screened for health compliance Introduction This configuration guide details the steps required to configure both MAC Authentication and OnGuard posture enforcement using Dell Networking switches The W ClearPass Policy Manager will be the centerpiece for all RADIUS credentials and network access authentication decisions for devices accessing the network through the Dell Networking switch Dell Networking W Series ClearPass Configuration Guide 6 Network Topology Figure 1 Basic Topology Dell Networking W ClearPass PowerConnect 7024P Switch PC Printer The figure above shows the setup used for this document The printer is used for the MAC Authen
27. ion in the Description field From the dropdown menu Type choose Static Host List Click on Next to move to the Static Hosts Lists tab From the dropdown menu choose the static host list previously created for this example AllowedMacAddresses was previously created Click Next and then Save to move back to the Authentication tab From the dropdown menu in Authentication Sources Select to Add choose static list Mac auth Static Host List this is the source that was just created Click on Next at the bottom right to move to the Roles tab Figure 8 MAC Authentication ClearPass Configuring Authentication Method and Source Configuration Services Add Services 7 Ql mR S Service Authentication Roles Enforcement Summary Authentication Methods EAP MD5 Se Add new Authentication Method Move Up Move Down Remove Modify Select to Add X Authentication Sources static list Mac auth Static Host List a Add new Authentication Source Move Up Move Down Remove View Details Modify Select to Add x Strip Username Rules E Enable to specify a comma separated list of rules to strip username prefixes or suffixes Dell Networking W Series ClearPass Configuration Guide 16 Under the Roles tab input and change the following NOTE Click on Add new Role Mapping Policy Enter a descriptive name in the Policy Name field Enter a description Leave the Default Role as Guest
28. ions Enforcement Policy Allow Access Policy for MAC Auth OnGuard Add new Enforcement Policy Description Sample policy to allow network access Default Profile Deny Access Profile Rules Evaluation Algorithm _ first applicable Conditions Enforcement Profiles 1 Tips Posture EQUALS QUARANTINE 20 Deny Access Profile 2 Tips Role EQUALS Employee Allow Access Profile Click on Save to move back to the service configuration Click on Next to move to the Summary tab Click on Save to move to the Reorder Services page On the Reorder Services page ensure this wired 802 1x service is placed before the OnGuard Web Auth service configured in the previous section Click on Save to complete the configuration Testing OnGuard Posture Configuration The OnGuard persistent client application is downloaded directly from the ClearPass application The easiest method to access the exe or msi is to locate the download link within the management GUI ClearPass administrators can navigate to the following location Administration gt Agents and Software Updates gt OnGuard Settings Ensure the Wired checkbox under Agent Customization Managed Interfaces is checked From the dropdown menu under Mode choose Authenticate with health checks Download the application transfer it to the test PC and install prior to trying to access the network Once OnGuard is installed ensure the OnGuard process is started Also ensure that the
29. ks 2 ClearPass Windows Universal System Health Validator HEALTHY 1 QUARANTINE Dell Networking W Series ClearPass Configuration Guide 28 Figure 18 OnGuard ClearPass Posture Policy Main Tab Configuration Services Edit OnGuard with 7024P Services OnGuard with 7024P Summary Service Authentication Roles Enforcement Posture Policies Posture Policies Only OnGuard agent type posture policies are applicable for this service Wired OnGuard with 7024P Add new Posture Policy Remove View Details Modify Select to Add E Default Posture Token UNKNOWN 100 Remediate End Hosts F Enable auto remediation of non compliant end hosts Remediation URL Posture Servers Posture Servers ps Add new Posture Server Remove View Details Modify Select to Add X Click Next to move to the Enforcement tab Click on Add new Enforcement Policy Enter a descriptive name in the Name field Enter a description in the Description field Choose WEBAUTH as the Enforcement Type Click on Add new Enforcement Profile From the dropdown menu under Template choose Agent Enforcement Enter a descriptive name in the Name field example Agent Healthy Profile Enter a description in the Description field Click Next to move to the Attributes tab Two attributes are auto populated From the dropdown menu under Attribute Value Message type a welcome message to be displayed
30. ng configuration steps start from a ClearPass appliance that has been setup according to the basic configuration outlined in the Dell Networking W ClearPass Policy Manager 6 0 Quick Start Guide It s assumed that all Subscription IDs and licensing has been enabled for the product Adding Network Authenticator Navigate to Configuration gt Network gt Devices Click on Add Device in the upper right hand corner Under the Device tab input the following Enter a descriptive name in the Name field Enter the IP address of the 7024P switch in the IP or Subnet Address field Enter the same secret used previously in the RADIUS Shared Secret field Enter the same secret again in the Verify field Choose IETF from the dropdown list in the Vendor Name field Click Save Figure 5 MAC Authentication ClearPass Adding Network Authenticator Edit Device Details e SNMP Read Settings SNMP Write Settings CLI Settings Name 7024P rack173 IP or Subnet Address 172 25 173 75 e g 192 168 1 10 or 192 168 1 1 24 Description L 4 RADIUS Shared Secret DEE Verify ssessseseseeeee TACACS Shared Secret Verify Vendor Name IETF Enable RADIUS CoA d RADIUS CoA Port 2799 Attribute Value T 1 Kick to add Dell Networking W Series ClearPass Configuration Guide 13 Create a Static Host List The Static Host List will be the repository for the MAC Addresses allowed onto the network All devices
31. ntication example Identify the port to be used for wired authentication with OnGuard Under Interface Parameters choose the port number from the dropdown list in the Interface field The default setting when enabling 802 1x on the switch in the Admin Interface Control field is Automode Confirm that Automode is set All other fields can remain default Repeat the above for any other ports requiring this setting Figure 12 OnGuard 7024P Switch Authentication Configuration Support About Log Out OPENMANAGE SWITCH ADMINISTRATOR Authentication Detail Show All Authentication Detail HN e CG E System General Time Synchronization Global Parameters Administrative Mode Enable x Dynamic VLAN creation mode Disable x Interface Parameters a Back to top m Interface Unit 1 Port Gi1 0 23 Le Guest VLAN Disable e Unauthenticated VLAN Disable el Admin Interface Control Automode v MAB Current Interface Control NIA Periodic Re Authentication Enable Le Guest VLAN Period 90 1 to 300 seconds Re Authentication Period 500 300 to 4294967295 seconds Re Authenticate Now Authentication Server Timeout 30 1 to 65535 seconds Authenticatio Resending EAP identity Request 30 1 to 65535 seconds SNMP Configuration By default SNMPv2 is enabled on the switch and the ClearPass appliance No changes to the default settings are required to enable the SNMP bounce of the
32. of this document The same service and its setup can be used for the MAC Authentication with MAB OnGuard posture enforcement with Dell Networking 55xx Switch The Dell Networking 55xx Series Switch behaves in a very similar manner for 802 1x PEAP EAP MSCHAPv2 authentication The standard settings are shown in the following figure Figure 26 Appendix A 5524P Dot1x Interface Settings 802 1x only Port Based Authentication Interface Settings Summary Edit ae sFlow E Switching Port Based Authentication Interface Settings Edit h LI Q Interface Parameters Interface gi1 0 47 Le S User Name PCW Eng IPv6 Based ACL IPV6 Based ACE Admin Interface Control Auto EN ACL Binding Current Interface Control Authorized Proprietary Protocol Filtering Authentication Type 802 1x Only Le Time Range Time Range Recurrence Dynamic VLAN Assignment Disable Dot1x Authentications Guest VLAN Disable Cl Port Based Authentication Global Port Based Authentication Interface Settings Dynamic Policy ACL Assignment Disable Le Monitoring Users Periodic Reauthentication Enable w ee Reauthentication Period 300 4294967295 600 Sec uthenticatic iod 300 5 Sec Port Authentication Users rs Reauthenticate Now Jumbo Frames Authentication Server Timeout 1 655235 20 Sec Green Ethernet Configuration Protected Ports Resending EAP Identity Request 1 65535 30 Sec Port Profile Quiet Period 0 65535 60 Sec Port Confi
33. oke access to the network after any failed periodic health check Dell Networking W Series products support RADIUS CoA in addition to Radius VSA Vendor Specific Attributes which can be used in conjunction with ClearPass for all available features when connected wirelessly This example will perform a basic health check to see if the PC has its firewall enabled or turned off If the firewall is not enabled on the PC it will remove access to the network To read more on heath related conditions that OnGuard can interrogate on devices see the latest Dell Networking W ClearPass Policy Manager User Guide Dell Networking 7024P Configuration OnGuard uses HTTPS to send posture information to the ClearPass appliance For OnGuard to use HTTPS it must have access to the network If a customer requires 802 1x authentication on the wired switch a separate 802 1x authentication must be used prior to the OnGuard posture check In this example an 802 1x PEAP EAP MSCHAPv2 authentication is completed first A separate WebAuth service must be setup with posture checks to use the OnGuard agent To ensure a non compliant device is not admitted back to the network it s recommended that 802 1x be enabled on the access port to the Dell Networking 7024P switch If the port is left in Authorized mode and the heath issue is not corrected the device will be bounced from the network during each periodic heath check This example builds upon the previous MAC Auth
34. on Periodic Re Authentication Enable Le DHCP Snooping DHCP Se Guest VLAN Period 90 1 to 300 seconds ae Ei IP Source Guard Re Authentication Period 500 300 to 4294967295 seconds Link Dependency Routing Re Authenticate Now Statistics RMON Quality of Service Authentication Server Timeout 30 1 to 65535 seconds IPv4 Multicast IPv6 Multicast Resending EAP identity Request 30 1 to 65535 seconds Quiet Period 60 0 to 65535 seconds Supplicant Timeout 30 1 to 65535 seconds There are likely other ports on the switch that do not require Authentication For those ports at this time it is recommended to force the port interface into Authorized mode Under Interface Parameters choose the port number from the dropdown list in the Interface field Choose Authorized from the dropdown list in the Admin Interface Control field All other fields can remain default Repeat the above for all ports requiring access without Authentication NOTE Administrators can edit multiple ports at one time by using the Show All configuration page under Authentication Click Apply Save your configuration to the running configuration This completes the steps required for Mac Authentication on the Dell Networking 7024P For additional information and CLI examples please refer to the Dell Networking 7000 Series Switch User s Configuration Guide Dell Networking W Series ClearPass Configuration Guide 12 Dell Networking ClearPass Configuration The followi
35. opdown menu under Actions Role Name choose Employee Click Next to move to the Summary tab Click Save to save the new Role Mapping Policy and to move back to the Service configuration Figure 16 OnGuard ClearPass Roles Configuration Services Edit OnGuard with 7024P Services OnGuard with 7024P Summary Service Authentication Posture Enforcement Role Mapping Policy Wired Auth 7024P Modify Add new Role Mapping Policy Role Mapping Policy Details Description Default Role Guest Rules Evaluation Algorithm first applicable Conditions Role 1 Authorization Local User Repository Role_Name EXISTS Employee Click Next to move to the Posture tab Click Add new Posture Policy Enter a descriptive name in the Policy Name field Enter a description in the Description field Leave the Posture Agent as OnGuard Agent Choose the appropriate Host Operating System this example uses Windows Click Next to move to the Posture Plugins tab o Check the checkbox for ClearPass Windows Universal System Health Validator o Click on Configure o Choose the appropriate version of OS this example uses Windows 7 o Check the checkbox Enable checks for Windows 7 may not be required for other OS brands o Choose the Firewall selection from the list under the OS o Check the checkbox A firewall application is on o Uncheck both the Auto Remediation and Uncheck to allow any prod
36. ration CB 172 25 173 75 dell_ C Imported From IE Google OPENMANAGE SWITCH ADMINISTRATOR ect 7024P Home a System GOEEEEEE General Time Synchronization Logs IP Addressing Diagnostics Green Ethernet Management Security Access Profile Authentication Lists Select Authentication Password Management Login Sessions Last Password Set Result Local User Database Line Password Enable Password TACACS Settings Authorization Network RADIUS Serial Port Telnet Server Denial of Service internal Authentication Server Users Co RADIUS RADIUS Global Configuration RADIUS Server Configuration ccounting Server Config unting Server Statisti 7 erver Statistics Secure HTTP Secure Shell SNMP File Management Stack Management RADIUS Server Configuration Detait Add Show Ai RADIUS Server Configuration Detail RADIUS Server Host Address Port Secret Radius Dead Time Max Number of Retransmits Timeout Duration Priority Source IP Usage Primary Server Message Authenticator Secret Configured Status RADIUS Server Name 172 25 173 153 1812 0 0 0 0 all Enable apaga D Enable Yes Active CPrack173 d Support About Log Out 1 to 65535 d Apply 0 to 128 characters 0 to 2000 minutes 1 to 10 1 to 30 seconds m 0 to 65535 1 to 32 alphanumeric characters Apply Enable Authentication and configure the port Navigate to Swi
37. t come configured with the base install These default services will not interfere with this example The Mac authorization service that was just created can be left at the bottom of the service order list Click on Save to complete the configuration Testing MAC Authentication Connect any device not configured to use 802 1x example printer to the switch port configured for MAC Authentication MAB Ensure the MAC address of the device is in the static host list that is configured in the above example Dell Networking W Series ClearPass Configuration Guide 19 Within the Dell Networking 7024P GUI administrators can see the status of all authentications and can see if a port is currently authorized For the Port Access Log navigate to Switching gt Dot1x Authentication gt Monitoring Mode gt Port Access Control History Log ClearPass has an extensive Access Tracker which logs all the steps corresponding to Authentication Authorization and Enforcement It is very useful in identifying which service it s identifying to categorize the request and what issues it has during the authentication The Access Tracker can be located by navigating to Monitoring gt Live Monitoring gt Access Tracker MAC Authentication Conclusion Many of the settings in the above example are simplified for the purpose of providing a basic configuration an administrator can build upon The settings shown are not intended to fully protect the network in all en
38. tching gt Network Security gt Dot1x Authentication gt Authentication Under Global Parameters choose Enable from the dropdown list in the Administrative Mode field Identify the port to be used for MAC Authentication Under Interface Parameters choose the port number from the dropdown list in the Interface field Choose Mac based from the dropdown list and check the MAB box in the Admin Interface Control field All other fields can remain default Repeat the above for any other ports requiring MAC Authentication Dell Networking W Series ClearPass Configuration Guide 11 Figure 4 MAC Authentication 7024P Switch Authentication Configuration Support About Log Out OPENMANAGE SWITCH ADMINISTRATOR Authentication nnect 7024P admin r w Detail Show All Authentication Detail HN e CG Global Parameters Authenticated Users Administrative Mode Enable Access Control Lists men Proprietary Protocol Filtd Dynamic VLAN creation mode Disable Dot1x Authentication Authentication Monitoring Mode Interface Parameters a Back to top Slots E Ports d Address Tables Interface Unit 1 w Port Gi1 0 24 Le GARP Spanning Tree Guest VLAN Disable Le yn AN D VLAN Unauthenticated VLAN Disable Link Aggregation Ge Multicast Support Admin Interface Control Mac based v MAB 7 MVR Configuration LDI urrent Interface Control LLDP c face C N A Dotiag Sg Dynamic ARP inspecti
39. tication example configuration while the PC is used for the OnGuard heath posture example configuration The Dell Networking 7024P is representative of a typical closet access switch The Dell Networking W ClearPass appliance is normally located in the Data Center The Dell 7024P switch is also capable of supplying PoE power to devices connected to its ports This PoE capability can simplify the deployment of devices like Phones Cameras and similar corporate devices that will benefit from the MAC Authentication methodology described in this document Dell Networking W Series ClearPass Configuration Guide Applicable Hardware and Software Versions The examples in this document are validated on the following HW and SW versions e Dell W Series ClearPass SW v6 0 2 e Dell Networking 7024P firmware v5 1 0 1 Dell W Series ClearPass Dell W Series ClearPass SW v6 0 2 Configuration for the ClearPass appliance is the same for the latest version released during the publishing of this document ClearPass v6 1 2 No changes to the MAC Authentication feature were implemented in this later version The OnGuard client application was upgraded to include a VPN client in ClearPass v6 1 2 The VPN feature and its configuration will not affect the behavior or configuration of the methodology described in this document Dell Networking Switches Dell Networking 7024P firmware v5 1 0 1 The following Dell Networking branded switches contain the same firmwar
40. uct checkboxes o Click Save Click Next to move to the Rules tab o Click Add Rule Dell Networking W Series ClearPass Configuration Guide 27 o From the dropdown menu under Select plugin Checks choose Fails one or more SHV checks o Check ClearPass Windows Universal System Health Validator checkbox o From the dropdown menu under Posture Token choose QUARANTINE 20 o Click on Save o Click Add Rule o From the dropdown menu under Select plugin Checks choose Passes all SHV checks o Check ClearPass Windows Universal System Health Validator checkbox o From the dropdown menu under Posture Token choose HEALTHY 0 o Click on Save Click on Next to move to the Summary tab Click on Save to save the Posture policy and move back to the Service configuration Figure 17 OnGuard ClearPass Adding New Posture Policy Configuration Posture Posture Policies Edit Wired OnGuard with 7024P Posture Policies Wired OnGuard with 7024P Policy Posture Plugins Rules Policy Policy Name Wired OnGuard with 7024P Description Posture Agent Web Agent Host Operating System WINDOWS Posture Plugins The list of selected plugins Plugin Name Plugin Configuration Status 1 ClearPass Windows Universal System Health Validator View Configured Rules Rules Evaluation Algorithm First applicable Conditions Posture Token Fails one or more SHV checks ClearPass Windows Universal System Health Validator Passes all SHV chec
41. using MAC Authentication will need to have their MAC addresses input into this list Navigate to Configuration gt Identity gt Static Host Lists Click on Add Static Host List at the upper right of the GUI Enter a descriptive name in the Name field Enter a description in the Description field Choose List in the Host Format field Choose MAC Address in the Host Type field Add as many addresses into the list as desired at this time Addresses can be added at any time Click on Save In this example AllowedMacAddresses is used as the Static Host List name Figure 6 MAC Authentication ClearPass Create Static Host List Edit Static Host List Name AllowedMacAddresses Description whitelist Host Format Subnet Regular Expression List Host Type IP Address MAC Address List 00 13 60 3a 2c 6b 5c 26 0a 85 6f 2f vr D Add Host Save Cancel Dell Networking W Series ClearPass Configuration Guide 14 Configuring a Network Policy Navigate to Configuration gt Start Here Choose MAC Authentication Under the Service tab input and change the following Enter a descriptive name in the Name field Enter a description in the Description field Unde right r Service Rules remove all default conditions by clicking on the trash icon to the of each condition Add anew condition by clicking on Click to add and choosing the following O O O O Click Type Radius
42. vironments The default MAC Authentication method within ClearPass will not successfully recognize the authentication request from the Dell Networking switch The unique ClearPass setting that is described above is the use of EAP MD5 as the Authentication method with a source of a Static Host List The use of this method along with strict enforcement policies on the switch will effectively secure and allow the proper traffic for devices that do not support 802 1x Dell Networking W Series ClearPass Configuration Guide 20 OnGuard posture enforcement with Dell Networking 7024P Switch OnGuard is a SW module within ClearPass used to determine the health of a device Network administrators may want to enforce devices being connected to the network to have certain health related conditions met before access is granted Typical conditions include the presence of an anti virus SW with updated virus definitions Other conditions could involve a check on the state of the firewall For the purposes of this document the posture of the device is directly referencing its health The persistent client for OnGuard has the ability to detect changes in the posture of a device and change its access status in the network Although the Dell Networking switch does not support RADIUS CoA it can still use OnGuard to check heath at the initial authentication request when connecting to the network Additionally the persistent OnGuard client can monitor a PC and rev
Download Pdf Manuals
Related Search