Aruba ClearPass

Aruba ClearPass
Name	Aruba ClearPass
Developer	Aruba Networks
Released	2012
Latest release	2024
Operating system	ClearPass OS (proprietary)
License	Commercial

Aruba ClearPass is a network access control and policy management platform developed by Aruba Networks for enterprise, campus, and carrier environments. It provides device visibility, authentication, authorization, and endpoint compliance by integrating with network infrastructure from vendors such as Cisco Systems, Juniper Networks, and HP Inc. ClearPass is used by organizations across sectors including Bank of America, Cisco Systems, University of California, and National Health Service to enforce access controls for wired, wireless, and VPN connections. The product competes with solutions from Forescout Technologies, Okta, and Palo Alto Networks in the network access control (NAC) and identity-defined networking markets.

Overview

ClearPass is positioned as a policy and access-control engine that centralizes authentication for multiple network services and enforcement points. It integrates with identity stores such as Microsoft Active Directory, LDAP, and Azure Active Directory, and with directory-enabled services like Okta Identity Cloud and Ping Identity. The platform supports standards-driven protocols including RADIUS, TACACS+, and 802.1X to facilitate interoperability with enterprise switching and wireless portfolios from Aruba Networks, Cisco Systems, Hewlett Packard Enterprise, and Extreme Networks.

Architecture and Components

The ClearPass architecture comprises modular services: the Policy Manager, Policy Server, and Policy Manager Analytics components. The Policy Manager provides configuration and policy authoring, interacting with databases like MySQL and directory services such as Microsoft Active Directory and OpenLDAP. The Policy Server handles real-time authentication and uses protocols including RADIUS and TACACS+ to communicate with enforcement points such as Aruba Mobility Controllers, Cisco Catalyst switch series, and virtual appliances in VMware ESXi and Microsoft Hyper-V environments. ClearPass Guest delivers captive portal capabilities integrated with payment and marketing systems like PayPal and Salesforce. ClearPass OnGuard performs endpoint posture assessment, interfacing with endpoint protection vendors such as Microsoft Defender and Symantec Corporation.

Deployment and Integration

ClearPass can be deployed as virtual machines on platforms including VMware ESXi, Microsoft Hyper-V, and KVM or as appliance hardware bundles offered by Aruba Networks. It supports high-availability and clustering topologies guided by best practices adopted by institutions such as Massachusetts Institute of Technology and Stanford University. Integration patterns include RADIUS proxying for multi-domain authentication, TACACS+ for device administration, and RESTful APIs for orchestration with solutions from ServiceNow, Splunk, and Ansible. Large-scale deployments often integrate with network management systems like SolarWinds and identity providers such as Okta to achieve single sign-on and centralized logging compatible with Splunk Enterprise and Elastic Stack.

Authentication, Authorization, and Policy Management

Authentication in ClearPass supports certificate-based methods using X.509 and EAP types like EAP-TLS and PEAP. Authorization policies are crafted using attributes from identity stores, endpoint profiling, and contextual signals from mobility controllers such as Aruba Mobility Controller and access points from vendors like Ubiquiti. Role-based access control (RBAC) maps user and device traits to roles used by enforcement systems including Cisco Identity Services Engine and F5 Networks load balancers. Policy Manager enables granular policy chains leveraging attributes from Microsoft Active Directory, LDAP, and external threat intelligence providers such as Cisco Talos.

Use Cases and Features

Common use cases include BYOD onboarding, guest access provisioning, contractor and vendor access, and IoT device onboarding for deployments in organizations such as General Electric, Pfizer, and Siemens. Key features include captive portal customization, device profiling, posture assessment, and policy-based VLAN assignment for switches from Cisco Systems and Aruba Networks. ClearPass Exchange, a marketplace-style integration catalog, connects to third-party services like Jamf, AirWatch, and Ivanti to extend capabilities for mobile device management, endpoint remediation, and multi-factor authentication with providers such as Duo Security and RSA Security.

Security and Compliance

ClearPass supports compliance workflows and reporting used in regulated industries including healthcare providers like Mayo Clinic and financial institutions such as JPMorgan Chase. The platform aids adherence to standards and regulations through logging, auditing, and endpoint posture assessment aligned with frameworks such as PCI DSS and ISO/IEC 27001. ClearPass integrates with security information and event management (SIEM) tools like Splunk, IBM QRadar, and ArcSight to centralize incident detection and response. Its device profiling and endpoint enforcement capabilities help mitigate risks posed by unmanaged IoT devices common in deployments for Siemens and Honeywell International.

Licensing and Editions

ClearPass is offered under commercial licensing with tiered editions that scale by feature set and concurrent session counts, typically marketed as ClearPass Policy Manager and ClearPass Guest bundles. Enterprise customers often purchase support and subscription services from Aruba Networks or through channel partners such as CDW and Ingram Micro. Licensing models accommodate on-premises, cloud-managed, and hybrid deployments, and enterprises integrate ClearPass licensing with broader Hewlett Packard Enterprise procurement and support agreements.

Category:Network access control