Aruba ClearPass Policy Manager – Secure, Scalable Network Access Control (NAC) Solution
Vendor-Neutral NAC for BYOD, IoT, and Guest Network Security
HPE Aruba ClearPass Policy Manager is a next-generation Network Access Control (NAC) solution built to deliver secure, identity-based, and context-aware access across multi-vendor wired, wireless, and VPN networks. Whether you manage BYOD, IoT devices, or guest users, ClearPass empowers your organization to enforce Zero Trust and SASE principles with unmatched visibility and control.
Enterprise-Grade Authentication, Authorization & Accounting (AAA)
Powered by RADIUS and TACACS+ protocols, Aruba ClearPass offers comprehensive AAA capabilities, ensuring scalable and secure access across distributed environments. Its policy engine dynamically applies access decisions based on:
User roles and groups
Device type and authentication method
Endpoint health posture via MDM/UEM
Location, time, and network type
This context-aware approach helps secure networks without compromising user experience.
ClearPass Modules for Unified Access Control
ClearPass Onboard – Simplifies secure provisioning for BYOD devices.
ClearPass OnGuard – Performs real-time endpoint posture assessments to ensure compliance.
ClearPass Guest – Enables seamless, branded guest Wi-Fi access with full control.
ClearPass OnConnect – Extends port-level security to devices lacking 802.1X support.
Integration & Scalability for Modern IT Environments
Aruba ClearPass integrates with over 150 third-party IT and security systems via RESTful APIs and syslog, enabling automated workflows and improved threat response.
Designed for scalability, it can handle tens of thousands of devices, making it ideal for both small businesses and large enterprises.
Why Choose Aruba ClearPass Policy Manager?
Zero Trust NAC with advanced policy enforcement
Role- and device-based access control across any vendor’s infrastructure
Support for BYOD, IoT, and guest access
Granular visibility into all connected devices
Powerful integrations with leading security platforms
Flexible deployment: on-premises or virtual appliance
Please explore NAC Products
HPE Aruba ClearPass Policy Manager Architecture
Overview
HPE Aruba ClearPass is a scalable, vendor-agnostic Network Access Control (NAC) solution ensuring secure, role-based access for wired, wireless, and VPN networks. Built on Zero Trust and SASE, it supports employees, guests, BYOD, and IoT devices.
Components
ClearPass Policy Manager: Core platform for authentication, authorization, profiling, and policy enforcement; available as hardware or virtual appliances.
ClearPass Cluster: Multi-node setup for high availability; requires Platform License per node.
ClearPass Insight: Analytics for authentication logs and compliance.
ClearPass Device Insight: Cloud-based tool for advanced device profiling.
Deployment
Options: Hardware (CPPM-HW-500, 5K, 25K), virtual (VMware ESXi, Hyper-V, AWS, Azure), or cloud-hosted (AWS Marketplace).
Scalability: Supports thousands of devices, scaling from single-node to clustered setups.
Operation: Out-of-band integration with no network traffic disruption.
Authentication
Protocols: 802.1X, MAB, Web Authentication, Captive Portal, TACACS+.
Methods: EAP (PEAP, EAP-TLS, EAP-TTLS, EAP-FAST), SAML 2.0 SSO (e.g., Okta).
Sources: Microsoft AD, LDAP, SQL databases, token servers.
Integrations: MDM/UEM (Intune, Jamf), IdPs (Okta, Azure AD).
Device Profiling
Methods: MAC OUI, DHCP, HTTP/HTTPS, SNMP, enhanced by ClearPass Device Insight or Aruba Central Client Insights with ML.
Capabilities: Identifies device type, OS, and behavior; dynamically adjusts policies.
Agentless: Passive/active techniques; optional OnGuard agents.
Policy Enforcement
Mechanisms: Role-based access, VLAN steering, ACLs, session termination.
Policies: Based on user role, device type, UEM attributes, health, location, time.
Enforcement Profiles: Triggers role assignment, VLAN changes, or quarantine.
Posture Assessment (ClearPass OnGuard)
Checks: Antivirus, OS patches, firewall, compliance.
Methods: Persistent/dissolvable agents (Windows, macOS, Linux) or agentless.
Actions: Auto-remediate or quarantine non-compliant devices.
Guest Access (ClearPass Guest)
BYOD Onboarding (ClearPass Onboard)
Features: Automates SSID, 802.1X, and certificate provisioning for multiple OS.
Self-Service: User-driven secure device configuration.
Non-802.1X Security (ClearPass OnConnect)
Integrations
Ecosystem: Connects with 150+ systems (Palo Alto, Splunk, Intune) via REST APIs, syslog.
Network Devices: Supports Cisco, Juniper, Fortinet switches, APs, controllers.
Visibility
Dashboards: Real-time monitoring via ClearPass Insight.
Reports: Customizable for authentication, compliance, trends.
Access Tracker: Logs session details for troubleshooting.
https://www.hpe.com/psnow/doc/a00064815enw