Select 802.1X Wireless.

Enter the name of this service.

Policy Manager autofills the Description field with "802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. Wireless Access Service." You can change the description if you wish.

Select this check box to monitor network access activity without enforcement.

Check these boxes to access the additional configuration tabs:

Authorization: See Authorization Configuration

Posture Compliance: See Posture Configuration

Audit End-hosts: See Audit Configuration

Profile Endpoints: See Profiler Configuration

Accounting Proxy: See Accounting Proxy Configuration

Service Rule

Select the match condition for this service:

Matches ANY

Matches ALL of the following conditions

Select Click to add to select the service rule type.

Select the name of the service rule from the drop-down list.

Select an appropriate operator from the list of operators for the data type of the attribute.

The authentication methods available for this service depend on the 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. supplicants and the type of authentication methods you choose to deploy. Policy Manager propopulates this field with the following common authentication methods for this service type.

EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication.  PEAP Protected Extensible Authentication Protocol. PEAP is a type of EAP communication that addresses security issues associated with clear text EAP transmissions by creating a secure channel encrypted and protected by TLS.

EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication.  FAST

EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication.  TLS Transport Layer Security. TLS is a cryptographic protocol that provides communication security over the Internet. TLS encrypts the segments of network connections above the Transport Layer by using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity. with CN Common Name. CN is the primary name used to identify a certificate. Check

EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication.  TTLS

EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication.  MSCHAPv2

Click the Select to Add field to add an additional authentication method. To remove an authentication method, select it then click Remove.

The EAP-MD5 authentication type is not supported if you use ClearPass Policy Manager in FIPS mode.

The order of authentication is significant, when a client tries to perform an 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication. Policy Manager proposes the first authentication method configured. However, the client can accept the authentication method proposed by Policy Manager and continue authentication or send a Negative-Acknowledgment (NAK Negative Acknowledgement. NAK is a response indicating that a transmitted message was received with errors or it was corrupted, or that the receiving end is not ready to accept transmissions.) and propose a different authentication method. If the newly proposed authentication method is also configured, then the authentication proceeds, otherwise authentication fails.

If most of the clients in the network use a specific authentication method, that authentication method should be configured first in the list. This would reduce the number of RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  packets exchanged.

For more information, see Adding and Modifying Authentication Methods .

Specify the authentication sources using the Select to Add field.

This can be one or more instances of the following list of authentication sources provided by default:

Admin User Repository

Denylist Repository

Endpoints Repository

Guest Device Repository

Guest User Repository

Insight Repository

Local User Repository

Zone Cache Repository

Onboard Devices Repository

Social Login Repository

Time Source

NOTE: When you attempt to specify more than 23 Services authentication sources, the following error message is displayed: No. of Authentication Sources cannot exceed 23.

For more information, see Adding and Configuring Authentication Sources.

Select the check box to preprocess the username (that is, remove prefixes and suffixes) before authenticating and authorizing against the authentication source.

Displays the authorization sources from which role mapping attributes are fetched for each authentication source.

Displays the source of attributes.

Select a role mapping policy from the drop-down list.

Policy Manager ships a number of preconfigured roles.

NOTE: A service can be configured without a role-mapping policy, but only one role-mapping policy can be configured for each service.

Role Mapping Policy Details

Provide additional information about the selected role-mapping policy.

Specify the role to which Policy Manager defaults when the role-mapping policy does not produce a match.

Posture Policies

Select the posture policy from the Select to Add drop-down list.

If you do not have any preconfigured posture policies, click Add New Posture Policy to create a new posture policy.

NOTE: Only NAP Network Access Protection. The NAP feature in the Windows Server allows network administrators to define specific levels of network access based on identity, groups, and policy compliance. The NAP Agent is a service that collects and manages health information for NAP client computers. If a client is not compliant, NAP provides a mechanism to automatically bring the client back into compliance and then dynamically increase its level of network access. agent-type posture policies are applicable for this service.

Select the default posture token from the drop-down list.

To perform remediation action, when a client is quarantined, select the Enable auto-remediation of non-compliant end-hosts check box.

Select this check box to use cached roles and posture attributes from previous sessions.

Select the preconfigured enforcement policy from the drop-down list. This is mandatory.

If you do not have any preconfigured enforcement policies, click Add New Enforcement Policy to create a new enforcement policy.

Enforcement Policy Details

Displays additional information about the selected enforcement policy.

Displays a default profile applied by Policy Manager.

Select the audit server from the following options:

Nessus Server: Interfaces with Policy Manager primarily to perform vulnerability scanning.

Nmap Audit: Performs specific Nmap Network Mapper. Nmap is an open-source utility for network discovery and security auditing. Nmap uses IP packets to determine such things as the hosts available on a network and their services, operating systems and versions, types of packet filters/firewalls, and so on. audit functions.

To view the Policy Manager Entity Details dialog with the summary of audit server details, click the View Details button.

To view the Summary tab with audit server details, click the Modify button.

Select an audit trigger condition:

Always: Always perform an audit.

When posture is not available: Perform audit only when posture credentials are not available in the request.

For MAC Media Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Authentication Request: If you select this option, Policy Manager presents the following three additional settings:

For known end-hosts only: Select this option when you want to reject unknown end-hosts and to audit known clients. Known end-hosts are defined as clients that are found in the authentication source(s) associated with this service.

For unknown end-hosts only: Select this option when the known end-hosts are assumed to be healthy, but you want to establish the identity of unknown end-hosts and assign roles. Unknown end-hosts are end-hosts that are not found in any of the authentication sources associated with this service.

For all end-hosts: For both known and unknown end-hosts.

Select one or more endpoint classification items from the drop-down list.

Specify the proxy targets to which the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  server should be forwarded and the attributes to be added in the accounting.

Select the accounting proxy target from the Select to Add drop-down list.

Click this link to add a new accounting proxy target.

RADIUS attributes to be added for Accounting Proxy

Select the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  attribute type from the drop-down list:

Radius:IETF

Radius:Cisco

Radius:Hewlett-Packard-Enterprise

Radius:Alcatel-Lucent-Enterprise

Radius:Microsoft

Radius:Avenda

Radius:Aruba

Select the name of the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  attribute from the drop-down list.