Adding and Modifying Endpoints

Viewing the List of Authentication Endpoints

Policy Manager lists all authenticated endpoints. An endpoint device is an Internet-capable hardware device on a TCP/IPTransmission Control Protocol/ Internet Protocol. TCP/IP is the basic communication language or protocol of the Internet. network (for example, laptops, smart phones, and tablets).

To access this page, navigate to Configuration > Identity > Endpoints.

Figure 1  Endpoints Page

Table 1: Endpoint Page Parameters

Parameter

Action/Description

Filter

You can choose to select ALL matches or ANY matches.

Then you can specify from one to three device filters to refine the endpoint information you wish to view.

Policy Manager allows searching for a MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address in any of the known formats:

112233AABBCC

11:22:33:aa:bb:cc

11-22-33-AA-BB-CC

1111-2222-3333

1111.2222.3333

MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Address

Displays the MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address of the endpoint.

Hostname

Specifies the host name of the endpoint.

Device Category

Indicates the category of the profiled device. For example, Access Points, Computer, Smart Device, VoIPVoice over IP. VoIP allows transmission of voice and multimedia content over an IP network. phone, and so on.

Device OS Family

Specifies the operating system that the device runs on. For example, when the category is Computer, Policy Manager shows a Device OS Family of Windows, Linux, or macOS.

Status

Displays the status of the endpoint:

Unknown

Known client

Unknown client

Disabled client

Profiled

Indicates whether the device has been added to the Policy Manager Profile.

Filtering for Specific Devices Using Device Insight Tags

Policy Manager allows you to use Device Insight tags to filter for specific device types, as illustrated in the following example:

Figure 2  Filtering for Devices Using Device Insight Tags

The current list of devices you can use Device Insight tags to filter for are as follows:

Apple Mac

Apple smart device, Smart Device

Gaming, Nintendo Gaming

Gaming, Sony Gaming

Kindle, Smart Device

Smart Device

Blackberry, Blackberry smart device, Smart Device

Manually Adding an Endpoint

To manually add an endpoint:

1. From the Configuration > Identity > Endpoints page, click the Add link.

The Add Endpoint page opens.

Figure 3  Add Endpoint Page

2. Specify the Add Endpoint page parameters as described in the following table, then click Save:

Table 2: Add Endpoint Page Parameters

Parameter

Action/Description

MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Address

Specify the MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address of the endpoint.

Description

Enter a description that provides additional information about the endpoint (recommended).

Status

Specify the client status as:

Known client

Unknown client

Disabled client

You can use the Known client and Unknown client status in role-mapping rules by specifying the Authentication:MacAuth attribute.

You can use the Disabled client status to block access to a specific endpoint. This status is automatically set when an endpoint is blocked from theEndpoint Profiler.

Attributes

Add custom attributes for this endpoint.

Select the Click to add... row to add custom attributes.

You can enter any name in the attribute field. All attributes are of String datatype.

The Value field can also be populated with any string.

Each time you enter a new custom attribute, it is available for selection in the Attribute drop-down list for all endpoints. All attributes entered for an endpoint are available in the role-mapping Rules Editor.

Support for Empty Values for Optional Endpoint Attributes

Policy Manager supports empty values for optional endpoint attributes when they are added through the user interface, an XMLExtensible Markup Language. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. import, or the APIApplication Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software.:

When empty optional attributes are added to an endpoint through the user interface at Configuration > Identity > Endpoints, all attribute data types are supported except Boolean, Day, List, and TimeOfDay.

When empty optional attributes are added through an XMLExtensible Markup Language. XML is a markup language that defines a set of rules for encoding documents in a format that is both human-readable and machine-readable. import or through the APIApplication Programming Interface. Refers to a set of functions, procedures, protocols, and tools that enable users to build application software., all data types are supported.

Empty attributes are not valid if the Is Mandatory attribute is set to true.

The EXISTS operator will not work in rule conditions for an attribute of the integer data type if the attribute has empty values. It does, however, work for all other data types.

If the value of an optional endpoint attribute is set to -For-Delete- in the import file, the attribute is marked for delete.

Modifying an Endpoint

Modifying an Endpoint

Configuring the Attributes for the Selected Endpoint

Endpoint Device Fingerprint Details Page

To modify an endpoint:

1. From the Configuration > Identity > Endpoints page, click the endpoint of interest from the list of endpoints.

The Edit Endpoint page opens.

Modifying an Endpoint

Figure 4  Edit Endpoint Page

The Edit Endpoint page parameters are described in the following table:

Table 3: Edit Endpoint Page Parameters

Parameter

Action/Description

MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Address

Displays the MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address of the endpoint.

Description

Enter a description that provides additional information about the endpoint (recommended).

Status

Indicates the status of the selected endpoint as one of the following:

Known client

You can use the Known client and Unknown client status in role-mapping rules by applying the Authentication:MacAuth attribute.

Unknown client

Disabled client

You can use the Disabled client status to block access to a specific endpoint. This status is automatically set when an endpoint is blocked from the Endpoint Profiler.

MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Vendor

Displays the MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. OUIOrganizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI. (Organizationally Unique Identifier) information for all endpoints even when no other profiling information is available for an endpoint.

Added by

Displays the name of the admin user ID that added the endpoint.

Online Status

Displays the online status of the endpoint:

Online

Offline

Not Available

Connection Type

Indicates the connection type; for example, Wireless.

If the connection type is not known, the connection type is displayed as Unknown.

Switch IP

Indicates the switch IP address.

Switch Port

Indicates the port on the switch.

IP Address

Displays the IP address that is associated with the endpoint.

Static IP

Indicates whether the IP address of the endpoint is a static IP address (True or False).

Hostname

Displays the host name or the IP address of the endpoint.

Device Category

From the drop-down list, select the device category that the endpoint belongs to.

Device OS Family

Specify the operating system that the endpoint runs on.

Device Name

Select the name of the device from the drop-down list.

Device Insight Tags

Displays the Device Insight tags created on this server.

Device Insight tags are used to group similar devices together (for more information, seeAbout Device Insight ).

Added At

Displays the date and time at which the endpoint was added.

Last Profiled At

Displays the date and time at which the endpoint was added to the Policy Manager Profile.

Profiler Conflict Details

NOTE: The Profiler Conflict Details section is shown when Policy Manager detects a different Device OS Family and/or Device Category than what was previously specified.

Other Category

Indicates the new Device Category that was detected but does not match.

Other Family

Indicates the new Device OS Family that was detected but does not match.

Other Name

Indicates the new MAC Vendor that was detected but does not match.

Resolve Conflict

Select one of the following conflict resolution options:

Ignore this fingerprint: Ignore the new Device Category and/or the Device OS Family and retain the current Category and/or Family.

Use this fingerprint: Use the new Category and/or Family and reject the previously profiled Category and/or Family specified for this device.

Resolve later: Postpone the decision and let the device be in conflict.

Configuring the Attributes for the Selected Endpoint

To configure the endpoint attributes for the selected endpoint:

1. From the Edit Endpoint page, select the Attributes tab.

The Edit Endpoint Attributes tab displays the set of endpoint attributes currently configured on the Policy Manager server.

Figure 5  Endpoint Attributes Currently Configured

2. To add attributes for the selected endpoint, scroll to the bottom of the list, then select Click to add...

A new row is created with a drop-down list in the Attribute column.

3. To add an attribute to the endpoint, select one or more attributes from the drop-down list, then click Save.

JAMF Endpoint Context Server "Group Name" Attribute

For JAMF endpoint context servers, the Group Name endpoint attribute allows a device’s contextual data to be used during session authorization to determine the device’s access.

The Group Name endpoint attribute is dynamically retrieved from the JAMF Endpoint Context Server and made available in the Endpoint attributes list. The information is mapped to comma-separated values of the Group Name attribute.

Figure 6  JAMF Endpoint Context Server "Group Name" Attribute

Airwatch "Group ID" and "Group Name" Endpoint Attributes

The LocationGroupName and LocationGroupID attributes are fetched from an Airwatch server. These attributes are mapped to the corresponding Group Name and Group ID endpoint attributes.

Figure 7  Airwatch "Group ID" and "Group Name" Endpoint Attributes

Airwatch "Compliance" Attribute

The Compliance attribute is fetched from an Airwatch server and made available in the Endpoint attributes list. The values for the Compliance attribute are:

NotAvailable

NonCompliant

Compliant

Viewing the Endpoint Device Fingerprint Details

The information displayed in the Edit Endpoint > Device Fingerprints page varies depending on what type of device is selected and whether an NmapNetwork Mapper. Nmap is an open-source utility for network discovery and security auditing. Nmap uses IP packets to determine such things as the hosts available on a network and their services, operating systems and versions, types of packet filters/firewalls, and so on.-based network discovery scan has been run (see Configuring SNMP, SSH, and WMI Credentials).

To obtain the list of processes running on the Windows endpoint:

1. Navigate to Administration > Server Manager > Server Configuration.

The Server Configuration page opens.

2. Click the Cluster-Wide Parameters link.

The Cluster-Wide Parameters page opens.

3. As shown in Figure 8, ensure that the Cluster-Wide parameters Enable Endpoint Port Scans Using Nmap and Enable Endpoint Scan Using WMI are set to True, then click Save (for details on these parameters, see Profiler Parameters).

Figure 8  Cluster-Wide Parameters > Profiler Tab

4. Navigate to the Configuration > Identity > Endpoints page.

5. Click the endpoint of interest from the list of endpoints.

As shown in Figure 9, the Endpoint Fingerprints Details page shows the open ports and services running for the selected Windows endpoint:

Figure 9  Endpoint Device Fingerprint Details Page

6. Additionally, to obtain the list of active and inactive Windows services on the Windows endpoint, Policy Manager Insight must be enabled on the Policy Manager server (for more information, refer to Table 1 : Server Configuration > System Page Parameters in System Page).

Figure 10 shows the Endpoint Fingerprint Details Active Services information:

Figure 10  Endpoint Fingerprint Details with Active and Inactive Services Listed

In addition to the Active Services shown in Figure 10, the Device Fingerprints > Endpoint Fingerprint Details screen includes the following information:

Host Open Ports

Host Services

Inactive Services

MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. Vendor

Open Ports

Processes

WMIWindows Management Instrumentation. WMI consists of a set of extensions to the Windows Driver Model that provides an operating system interface through which instrumented components provide information and notification. OS Name

Viewing Endpoint Authentication Details

To view the authentication details of an endpoint:

1. From the Configuration > Identity > Endpoints page, select an endpoint by the clicking the corresponding check box.

The Authentication Records button is now enabled.

2. Click the Authentication Records button.

The Endpoint Authentication Details page opens.

Figure 11  Endpoint Authentication Details

Performing Bulk Updates of Endpoint Attributes

You can perform bulk updates of endpoint attributes, either for a single endpoint or for multiple endpoints simultaneously.

To perform bulk updates of endpoint attributes:

1. From the Configuration > Identity > Endpoints page, select one or more endpoints by the clicking the corresponding check boxes.

The Bulk Update button is now enabled.

 

In network discovery, when endpoints do not have a MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. address, Policy Manager creates MACMedia Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. addresses for them that include the prefix xa.

2. Click the Bulk Update button.

The Bulk Update Attributes dialog opens.

Figure 12  Configuring Bulk Update Attributes

3. To select an attribute you want to update, select Click to add, select the attribute from the Attribute list, and then specify its Value.

4. Repeat the selection process for all the attributes you want to update, then click Update.

The multiple attributes that were configured will be updated on all the selected endpoints at once.

Performing Bulk Deletions of Endpoint Attributes

Policy Manager supports bulk deletion of endpoint attributes.

To use this feature:

1. Navigate to Configuration > Identity > Endpoints.

The Endpoints page opens.

Figure 13  Endpoints Page and Bulk Delete Button

2. Select the check box(es) of one or more endpoints in the list from which you wish to delete multiple attributes.

3. Click the Bulk Delete button.

The Bulk Delete Attributes dialog is displayed.

Figure 14  Endpoints: Bulk Delete Attributes Dialog

4. To select the endpoint attributes to be deleted, select the Click to add link.

Figure 15  Selecting Endpoint Attributes for Bulk Deletion

5. From the Attribute drop-down, select the attributes (one attribute per line) that you wish to delete from the specified endpoints, then click Delete.

Triggering Actions to Be Performed on Endpoints

You can trigger endpoint actions for a single endpoint or for multiple endpoints simultaneously. To trigger actions that are to be performed on selected endpoints:

1. From the Configuration > Identity > Endpoints page, select one or more endpoints from the Endpoints page by clicking the corresponding check boxes. The Trigger Server Action button is now enabled.

2. Click the Trigger Server Action button. The Trigger Server Action page opens.

Figure 16  Endpoints Trigger Server Action Page

3. Specify the Trigger Server Action page parameters as described in the following table, then click Start Action.

Table 4: Trigger Server Action Page Parameters

Parameter

Action/Description

Server Action

Select the server action from the drop-down list. The available server actions are as follows:

Check Point Login - AD User

Check Point Login - Guest User

Check Point Logout

Fortinet Login

Fortinet Logout

Handle AirGroupThe application that allows the end users to register their personal mobile devices on a local network and define a group of friends or associates who are allowed to share them. AirGroup is primarily designed for colleges and other institutions. AirGroup uses zero configuration networking to allow Apple mobile devices, such as the AirPrint wireless printer service and the AirPlay mirroring service, to communicate over a complex access network topology. Time Sharing

Infoblox Login

NmapNetwork Mapper. Nmap is an open-source utility for network discovery and security auditing. Nmap uses IP packets to determine such things as the hosts available on a network and their services, operating systems and versions, types of packet filters/firewalls, and so on. Scan

OnDemand Endpoint Scan

SNMPSimple Network Management Protocol. SNMP is a TCP/IP standard protocol for managing devices on IP networks. Devices that typically support SNMP include routers, switches, servers, workstations, printers, modem racks, and more. It is used mostly in network management systems to monitor network-attached devices for conditions that warrant administrative attention.  Scan

Store Attributes in multi-mastercache

Context Server

Enter a valid context server name. You can enter an IP address or a domain name.

Server Type

Indicates the server type specified when the server was configured (for example, Generic HTTP Context Server).

Action Description

Describes the action that will take place on the endpoint (for example, "Inform Check Point that user logged in.").

Once the action is complete, a popup window displays the results of the action. The following image shows the results of an NmapNetwork Mapper. Nmap is an open-source utility for network discovery and security auditing. Nmap uses IP packets to determine such things as the hosts available on a network and their services, operating systems and versions, types of packet filters/firewalls, and so on. scan.

Figure 17  Results of a Trigger Server Action (Nmap Scan)

Updating Device Fingerprints From a Hosted Portal

You can update device fingerprints for a single endpoint or for multiple endpoints simultaneously. If you configure custom fingerprints, the custom fingerprint always takes precedence over the dynamically pushed system fingerprint.

To update device fingerprints from a hosted portal:

1. From the Configuration > Identity > Endpoints page, select one or more endpoints by clicking the corresponding check boxes. Selecting an endpoint enables the Update Fingerprint button.

2. Click the Update Fingerprint button.

3. The Update Device Fingerprint page opens, displaying two update types, Override fingerprint and Add fingerprint rule.

Override Fingerprint Option

By default, the Update Type is set to Override fingerprint (see Figure 18).

Figure 18  Update Device Fingerprint Page: Override Fingerprint

 

When a new fingerprint override rule is defined, an entry is added to the Audit Viewer.

Specify the Update Device Fingerprint page parameters as described in the following table, then click Save:

Table 5: Update Device Fingerprint Parameters

Parameter

Action/Description

Update Type

Select one of the following update types:

Override fingerprint: Update the device profile details (device category, device OS family, and device name) for the selected endpoint.

Add fingerprint rule: Update the device profile with a new fingerprint rule. This information is displayed at the bottom of the Update Device Fingerprint page, as shown in Figure 19.

Specify Device Profile Details

Device Category

Select the category the profiled device belongs to.

Device OS Family

Select the operating system configured on the device.

Device Name

Enter the name of the device or select the name of the device from the drop-down list.

Add Fingerprint Rule Option

To add a fingerprint rule:

1. In the Update Device Fingerprint screen, set the Update Type field to Add Fingerprint Rule. The Device fingerprint selected from section appears, as shown in Figure 19.

Figure 19  Update Device Fingerprint Page: Add Fingerprint Rule

2. In the Specify device classification details section, select device details as described in Table 5.

3. In the Device fingerprint selected from section, Select the fingerprint rule you want to edit. You can edit the following components of each fingerprint rule:

Name: Click the drop-down menu and select the name of a device fingerprint type.

Operator: Select from the options Contains all, Contains and Not Contains to allow the specified values to be included in or excluded from the rule.

Value: Add values to or delete values from the selected rule.

4. Click Save.

 

When a new fingerprint rule is defined, an entry is added to the Audit Viewer.