In this longer video, we explain Aruba User Roles, which are enforced on the infrastructure (Aruba Instant in this case) and can prevent certain users or devices from reaching specific services. In this example, we prevent contractors from reaching our internal Intranet website.
ClearPass also has a concept of Roles. These roles are there to separate your business logic, like people in a specific Active Directory group will be applied with a Tag, or label, so in your enforcement, you can return the right Enforcement profiles. You can imagine that the enforcement for Wireless could be different than for Wired, and definitely for different brands of network equipment. The ClearPass Roles and the Role Mapping in ClearPass can be reused across different services, and the enforcement is really simple to read (if this ClearPass role, then that enforcement profile). If your deployment grows, you will learn to appreciate role mapping. But for smaller deployments, it will give you additional information as all selected roles are shown in the Access Tracker and that helps to troubleshoot or understand why a specific enforcement is selected.
Workshop video overview, schedule, and discussion can be found on the Airheads Community: community.arub...
⏰Timestamps:
00:00 Intro
00:20 Aruba User Roles vs. ClearPass Roles
01:23 Configure Aruba User Roles on Instant
03:10 Create Enforcement Profiles
06:06 Create Enforcement Policy
08:09 Apply policy and test from client
09:32 Why use ClearPass Roles?
10:27 Create ClearPass Roles
10:58 Create CPPM Role Mapping
14:14 Change Enforcement to use CPPM Roles
16:10 Test from client
18:47 Groups EQUALS vs memberOf CONTAINS
19:47 Summary and Wrap up