to validate a host MAC against a white and a black list

to force the client to re-authenticate upon roaming to a new controller

to authenticate users or devices before granting them access to a network

to transmit messages to the NAD/NAS to modify a user’s session status

to apply firewall policies based on authentication credentials

A Kerberos request is sent from the Network Access Device to ClearPass which initiates a RADUIS request to the AD server.

A RADIUS request is sent from the Network Access Device to the AD server which communicates with ClearPass.

An LDAP request is sent from the Network Access Device to the AD server which communicates with ClearPass.

An LDAP request is sent from the Network Access Device to ClearPass which initiates a RADIUS request to the AD server.

A RADIUS request is sent from the Network Access Device to the ClearPass which communicates with the AD server.

the GSS is wrong

the wrong FQDN of the AD was entered while joining

the wrong domain name was selected while joining the AD

there is a clock difference between ClearPass and AD servers

there is an IP communication issue

Each rule is checked and once a match is found, the Enforcement profile assigned to that rule is applied and the rule matching stops.

All rules are checked and if there is no match, no Enforcement profile is applied.

Each rule is checked and once a match is found, the Enforcement profile assigned to that rule is applied. along with the default Enforcement profile.

All rules are checked for any matching rules and their respective Enforcement profiles are applied.

to translate and combine AD attributes into ClearPass roles

to send roles from ClearPass to the AD user to update a user’s group membership

to enable attributes as roles directly without needing role mapping rules

to send Aruba firewall roles back to the Aruba Network Access Device

to send details of a user’s connection to the AD user to store in its database