802.1X Wireless—Identity Only Service

Legal Disclaimer: The resource assets in this website may include abbreviated and/or legacy terminology for HPE Aruba Networking products. See www.arubanetworks.com for current and complete HPE Aruba Networking product lines and names.

802.1X Wireless—Identity Only Service

Configuration for this type of service is the same as the Aruba 802.1X Wireless Service, except that Posture and Audit policies are not configurable when you use this template. For more information, see Aruba 802.1X Wireless Service.

The following figure displays the Configuration > Services > Add 802.1X Wireless—Identity Only Service dialog:

Figure 1 802.1X Wireless—Identity Only Service Dialog

Service Configuration

The Service tab provides basic configuration parameters for the service. The Service Rules section defines a set of criteria that supplicants must match to trigger the service. Some service templates have one or more rules predefined. You can click on a service rule to modify any of its options.

To configure a 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. Wireless -Identity Only service:

1. Navigate to Configuration > Services, then click the Add link. The Add Services dialog opens.

2. From the Type drop-down, select Aruba 802.1X Wireless - Identity Only.

3. Specify the Service tab parameters as described in the following table:

Add Aruba 802.1X Wireless -Identity Only Service > Service Tab Parameters
Parameter	Action/Description
Type	Select Aruba 802.1X Wireless -Identity Only .
Name	Enter the name of this service.
Description	Policy Manager autofills the Description field with "802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. Wireless Access Service - Identity Only." You can change the description if you wish.
Monitor Mode	Select this check box to monitor network access activity without enforcement.
More Options	Check these boxes to access the additional configuration tabs: Authorization: See Authorization Configuration Profile Endpoints: See Profile Endpoints Configuration Accounting Proxy: See Accounting Proxy Configuration
Service Rule
Matches	Select the match condition for this service: Matches ANY Matches ALL of the following conditions
Type	Select Click to add to select the service rule type.
Name	Select the name of the service rule from the drop-down list.
Operator	Select an appropriate operator from the list of operators for the data type of the attribute.
Value	Enter the value or select the value from the drop-down list. The value list depends on the Type and Operator selected.

4. Click a service rule to modify its options.

5. Click Next to view the Authentication tab.

Authentication Configuration

The Authentication tab contains options for configuring authentication methods and authentication sources. Specify the Authentication tab parameters as described in the following table:

Add Aruba 802.1X Wireless -Identity Only Service > Authentication Parameters
Parameter	Action/Description
Authentication Methods	The authentication methods available for this service depend on the 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. supplicants and the type of authentication methods you choose to deploy. Policy Manager propopulates this field with the following common authentication methods for this service type. EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. PEAP Protected Extensible Authentication Protocol. PEAP is a type of EAP communication that addresses security issues associated with clear text EAP transmissions by creating a secure channel encrypted and protected by TLS. EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. FAST EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. TLS Transport Layer Security. TLS is a cryptographic protocol that provides communication security over the Internet. TLS encrypts the segments of network connections above the Transport Layer by using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity. with CN Common Name. CN is the primary name used to identify a certificate. Check EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. TTLS Click the Select to Add field to add an additional authentication method. To remove an authentication method, select it then click Remove. The EAP-MD5 authentication type is not supported if you use Policy Manager in FIPS mode. The order of authentication is significant, when a client tries to perform an 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. authentication. Policy Manager proposes the first authentication method configured. However, the client can accept the authentication method proposed by Policy Manager and continue authentication or send a Negative-Acknowledgment (NAK Negative Acknowledgement. NAK is a response indicating that a transmitted message was received with errors or it was corrupted, or that the receiving end is not ready to accept transmissions.) and propose a different authentication method. If the newly proposed authentication method is also configured, then the authentication proceeds, otherwise authentication fails. If most of the clients in the network use a specific authentication method, that authentication method should be configured first in the list. This would reduce the number of RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. packets exchanged. For more information, see Adding and Modifying Authentication Methods .
Authentication Sources	Specify the authentication sources using the Select to Add field. This can be one or more instances of the following list of authentication sources provided by default: Admin User Repository Denylist Repository Endpoints Repository Guest Device Repository Guest User Repository Insight Repository Local User Repository Zone Cache Repository Onboard Devices Repository Social Login Repository Time Source NOTE: When you attempt to specify more than 23 Services authentication sources, the following error message is displayed: No. of Authentication Sources cannot exceed 23. For more information, see Adding and Configuring Authentication Sources.
Strip Username Rules	Select the check box to preprocess the username (that is, remove prefixes and suffixes) before authenticating and authorizing against the authentication source.
Service Certificate	Optionally, select the Service Certificate. For more information, refer to Service and Client Certificates.

Authorization Configuration

Use the Authorization tab to select the authorization sources for this service. The Authorization tab is not displayed by default. To access this tab, select the More Options > Authorizationcheck box. Policy Manager fetches role-mapping attributes from the authorization sources associated with the service, regardless of which authentication source was used to authenticate the user.

For a given service, role-mapping attributes are fetched from the following authorization sources:

Authorization sources associated with the authentication source

Authorization sources associated with the service

Specify the Authorization parameters as described in the following table:

Table 1: Add Aruba 802.1X Wireless -Identity Only Service > Authorization Parameters

Parameter	Action/Description
Authentication Source	Displays the authorization sources from which role mapping attributes are fetched for each authentication source.
Attributes Fetched From	Displays the source of attributes.
Additional authorization sources from which to fetch role-mapping attributes	Specify the authorization sources using the Select to Add field. There can be one or more instances of the following list of authorization sources: Admin User Repository Denylist Repository Endpoints Repository Guest Device Repository Guest User Repository Insight Repository Local User Repository Zone Cache Repository Onboard Devices Repository Social Login Repository Time Source NOTE: When you attempt to specify more than 23 Services authorization sources, the following error message is displayed: No. of Authorization Sources cannot exceed 23

Parameter

Action/Description

Authentication Source

Displays the authorization sources from which role mapping attributes are fetched for each authentication source.

Attributes Fetched From

Displays the source of attributes.

Additional authorization sources from which to fetch role-mapping attributes

Specify the authorization sources using the Select to Add field.

There can be one or more instances of the following list of authorization sources:

Admin User Repository

Denylist Repository

Endpoints Repository

Guest Device Repository

Guest User Repository

Insight Repository

Local User Repository

Zone Cache Repository

Onboard Devices Repository

Social Login Repository

Time Source

NOTE: When you attempt to specify more than 23 Services authorization sources, the following error message is displayed:
No. of Authorization Sources cannot exceed 23

Roles Configuration

Use the Roles tab to associate a role-mapping policy with this service.

Specify the Roles parameters as described in the following table:

Add Aruba 802.1X Wireless -Identity Only Service > Roles Tab Parameters
Parameter	Action/Description
Role Mapping Policy	Select a role mapping policy from the drop-down list. Policy Manager ships a number of preconfigured roles. NOTE: A service can be configured without a role-mapping policy, but only one role-mapping policy can be configured for each service.
Role Mapping Policy Details
Description	Provide additional information about the selected role-mapping policy.
Default Role	Specify the role to which Policy Manager defaults when the role-mapping policy does not produce a match.
Rules Evaluation Algorithm	Shows the first matched rule.

For information on configuring role-mapping policies, see Configuring a Role and Role-Mapping Policy.

Enforcement Configuration

Use this tab to select an enforcement policy for a service by specifying the Enforcement parameters as described in the following table:

Aruba 802.1X Wireless -Identity Only Service > Enforcement Parameters
Parameter	Action/Description
Use Cached Results	Select this check box to use cached roles and posture attributes from previous sessions.
Enforcement Policy	Select the preconfigured enforcement policy from the drop-down list. This is mandatory. If you do not have any preconfigured enforcement policies, click Add New Enforcement Policy to create a new enforcement policy.
Enforcement Policy Details
Description	Displays additional information about the selected enforcement policy.
Default Profile	Displays a default profile applied by Policy ManagerPolicy Manager.
Rules Evaluation Algorithm	Shows the first matched rule.

For related information, see Configuring Enforcement Policies.

Profile Endpoints Configuration

The Profiler tab is not displayed by default. To access this tab, return to the Service tab and select More Options > Profile Endpoints.

Specify the Profile Endpoints parameters as described in the following table:

Add 802.1X Wireless - Identity Only Service > Profile Endpoints Parameters
Parameter	Action/Description
Endpoint Classification	Select one or more endpoint classification items from the drop-down list.
RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. CoA Change of Authorization. The RADIUS CoA is used in the AAA service framework to allow dynamic modification of the authenticated, authorized, and active subscriber sessions. Action	Select the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. CoA Change of Authorization. The RADIUS CoA is used in the AAA service framework to allow dynamic modification of the authenticated, authorized, and active subscriber sessions. action from the drop-down list. To view the Policy Manager Entity Details page with the summary of enforcement profile details, click the View Details button. To view the Summary tab with profile details, click the Modify button. To create a new RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. CoA Change of Authorization. The RADIUS CoA is used in the AAA service framework to allow dynamic modification of the authenticated, authorized, and active subscriber sessions. action, click the Add New RADIUS CoA Action link.

Accounting Proxy Configuration

The Accounting Proxy tab is not displayed by default. To access this tab, return to the Service tab and select More Options > Acconting Proxy. Use the Accounting Proxy tab to broadcast the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. accounting packets to all the proxy targets. You can configure the proxy targets to which RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server should be forwarded and the attributes to be added in the accounting. This enables the external security solutions to use the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. account event to detect when a user connects and disconnects to the server.

Specify the Accounting Proxy parameters as described in the following table:

Add Aruba 802.1X Wireless -Identity Only Service > Accounting Proxy Tab Parameters
Parameter	Action/Description
Accounting Proxy Targets	Specify the proxy targets to which the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. server should be forwarded and the attributes to be added in the accounting. Select the accounting proxy target from the Select to Add drop-down list.
Add New Accounting Proxy Target	Click this link to add a new accounting proxy target.
RADIUS attributes to be added for Accounting Proxy
Type	Select the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. attribute type from the drop-down list: Radius:IETF Radius:Cisco Radius:Hewlett-Packard-Enterprise Radius:Alcatel-Lucent-Enterprise Radius:Microsoft Radius:Avenda Radius:Aruba
Name	Select the name of the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. attribute from the drop-down list.
Value	Select the value from the Value drop-down list. The values displayed here depend on the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources. attribute Type selected.