| Appliances |
ClearPass is available as hardware or as a virtual appliance. Virtual appliances are supported on VMware vSphere Hypervisor (ESXi), Microsoft Hyper-V, CentOS KVM, Amazon EC2 & Microsoft Azure.
- VMware ESXi up to 7.0
- Microsoft Hyper-V 2016/2019 R2/2019 and Windows 2016 R2 Enterprise
- KVM on CentOS 7.7 and Ubuntu 18.04 LTS
- Amazon AWS (EC2)
- KVM on CentOS 7.7. Ubuntu 18.04, and Ubuntu 20.04
- Amazon AWS (EC2)
- Microsoft Azure
|
| Platform |
- Deployment templates for any network type, identity store and endpoint
- 802.1X, MAC authentication and captive portal support
- ClearPass OnConnect for SNMP-based enforcement on wired switches
- Advanced reporting, analytics and troubleshooting tools
- Interactive policy simulation and monitor mode utilities
- Multiple device registration portals – Guest, Aruba AirGroup, BYOD, and un-managed devices
- Admin/operator access security via CAC and TLS certificates
|
| Framework and protocol support |
- RADIUS, RADIUS Dynamic Authorization, TACACS+, web authentication, SAML v2.0
- RadSec (TLS encoded RADIUS)
- 802.1X-2010, 802.1X-2020
- TEAP (Tunneled EAP)
- EAP-FAST (EAP-MSCHAPv2, EAP-GTC, EAP-TLS)
- PEAP (EAP-MSCHAPv2, EAP-GTC, EAP-TLS, EAP-PEAPPublic, EAP-PWD)
- TTLS (EAP-MSCHAPv2, EAP-GTC, EAP- TLS, EAP-MD5, PAP, CHAP)
- EAP-TLS
- PAP, CHAP, MSCHAPv1, MSCHAPv2, EAP-MD5
- OAuth2
- WPA3
- Windows machine authentication
- SMB v2/v3
- Online Certificate Status Protocol (OCSP)
- SNMP generic MIB, SNMP private MIB
- Common Event Format (CEF), Log Event Extended Format (LEEF), and RFC5424
|
| Supported identity stores |
- Microsoft Active Directory
- RADIUS
- Any LDAP compliant directory
- MySQL, Microsoft SQL, PostGRES and Oracle 11g ODBC-compliant SQL server
- Token servers
- Built-in SQL store, static hosts list
- Kerberos
- Microsoft Azure Active Directory
- Google G Suite
|
| RFC standards |
2246, 2248, 2407, 2408, 2409, 2548, 2759, 2865, 2866, 2869, 2882, 3079, 3579, 3580, 3748, 3779, 4017, 4137, 4301, 4302, 4303, 4308, 4346, 4514, 4518, 4809, 4849, 4851, 4945, 5176, 5216, 5246, 5280, 5281, 5282, 5424, 5755, 5759, 6614, 6818, 6960, 7030, 7170, 7296, 7321, 7468, 7748, 7815, 8031, 8032, 8247, 8446, 8709, 8894, 8908 |
| Internet drafts |
Protected EAP Versions 0 and 1, Microsoft CHAP extensions, dynamic provisioning using EAP-FAST. |
| Profiling methods |
- Active: Nmap, WMI, SSH, SNMP
- Passive: MAC OUI, DHCP, TCP, Netflow v5/v10, IPFIX, sFLOW, ‘SPAN’ Port, HTTP User-Agent, IF-MAP
- ClearPass Device Insight
- Integrated & 3rd Party: Onboard, OnGuard, ArubaOS, EMM/MDM, Cisco device sensor
|
| IPv6 Support |
- RADIUS and RadSec
- TACACS+
- Clustering (intra-node communication)
- Web and CLI based management
- IPv6 addressed authentication & authorization servers
- IPv6 accounting proxy
- IPv6 addressed endpoint context servers
- Syslog, DNS, NTP, IPsec IPv6 targets
- IPv6 Virtual IP for high availability
- HTTP Proxy
- Ingress Event Engine Syslog sources
- Onboard, OnGuard
|
| Certifications |
- FIPS 140-2 – Certificate #2577
- Common Criteria NDcPP + Authentication Server (ClearPass)
- USGv6 approved
|
