aruba培訓(xùn)clearpass基本安裝配置

ARUBASELAB培訓(xùn)教程

Class02

ClearPass基本配置當(dāng)今的網(wǎng)絡(luò)認(rèn)證/授權(quán)需求支持更多的終端、用戶和協(xié)議越來越多的智能終端開始連接網(wǎng)絡(luò)，不僅僅是Windows終端802.1X具有更好的安全性，但是要求認(rèn)證服務(wù)器具有更高的性能用戶帳號信息保存在各種數(shù)據(jù)庫中（AD,LDAP,SQL數(shù)據(jù)庫，Token）越來越多的訪客上網(wǎng)服務(wù)，要求提供靈活便捷的訪客帳號管理機(jī)制日益發(fā)展的Cloud應(yīng)用要求具備對單點(diǎn)登錄（SSO）能力的支持支持更加復(fù)雜的基于情境的授權(quán)通常認(rèn)證過程只能提供“是”或者“否”兩種結(jié)果支持更多的場景識別并提供更加精細(xì)的網(wǎng)絡(luò)授權(quán)能夠?qū)崿F(xiàn)分層次的多重網(wǎng)絡(luò)授權(quán)規(guī)則和授權(quán)條件有效利用第三方終端管理系統(tǒng)存儲(chǔ)的情境信息傳統(tǒng)Radius認(rèn)證系統(tǒng)的挑戰(zhàn)

可視性和故障分析能力不足無法對連接到網(wǎng)絡(luò)中的終端進(jìn)行自動(dòng)識別和信息收集缺乏情境感知能力，如終端類型、完整性、資產(chǎn)類別等沒有直觀易用的故障診斷工具以及認(rèn)證/授權(quán)日志擴(kuò)展性和可靠性不足缺乏足夠的EAP加解密處理能力不支持active-active集群技術(shù)和中心化管理缺乏豐富的功能僅提供有限的AAA,TACACS+不提供真正關(guān)注于情境的授權(quán)缺少便捷的訪客賬戶管理功能ARUBAClearPass策略服務(wù)器1234ClearPass認(rèn)證服務(wù)模塊傳輸網(wǎng)Profile:提供業(yè)界產(chǎn)品覆蓋最廣、準(zhǔn)確率最高的設(shè)備分析系統(tǒng),可以動(dòng)態(tài)監(jiān)視新連接，并自動(dòng)分析新偵測到的設(shè)備On-Board:提供無感知的802.1x認(rèn)證參數(shù)配置，使IT人員可以輕松創(chuàng)建、管理802.1X終端設(shè)備On-Guard:在終端入網(wǎng)前根據(jù)預(yù)置的安全入網(wǎng)條件進(jìn)行檢查，包括：防毒軟件、防火墻、軟件版本補(bǔ)丁等Guest:提供企業(yè)自定義個(gè)性化portal、訪客自注冊系統(tǒng)、按需廣告推送,外置Raidus功能ClearPass服務(wù)器安裝ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟注意：此時(shí)如果直接給虛擬機(jī)加電會(huì)導(dǎo)致如下錯(cuò)誤，原因在于ClearPass需要添加第二塊硬盤才能正常啟動(dòng)此處添加的硬盤大小需要符合ClearPass虛擬機(jī)資源配置要求ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟輸入管理員默認(rèn)帳號和密碼：appadmin/eTIPS123ClearPass服務(wù)器的安裝步驟配置IP地址參數(shù)和NTP服務(wù)器（可以使用）ClearPass服務(wù)器的安裝步驟確認(rèn)IP地址參數(shù)和系統(tǒng)時(shí)間參數(shù)ClearPass服務(wù)器的安裝步驟ClearPass服務(wù)器的安裝步驟ClearPass配置邏輯ClearPass認(rèn)證服務(wù)模型認(rèn)證定義認(rèn)證方法、認(rèn)證源和認(rèn)證策略AD,LDAP,SQL,令牌服務(wù)器,內(nèi)置數(shù)據(jù)庫授權(quán)定義可用的授權(quán)源利用不同授權(quán)源的多重屬性定義授權(quán)策略角色映射定義服務(wù)器內(nèi)部角色利用用戶和終端屬性定制角色映射規(guī)則健康檢查收集終端健康信息定義健康檢查的內(nèi)容策略決策基于角色、健康狀態(tài)、情境條件進(jìn)行決策多種策略–Role,VLAN,ACL下發(fā)，CoA等ClearPass配置邏輯ClearPass配置界面ClearPass配置菜單EAPornon-EAPmethodforclientauthentication.PolicyManagersupportsfourbroadclassesofauthenticationmethods:EAP,tunneled:PEAP,EAP-FAST,orEAP-TTLS.EAP,non-tunneled:EAP-TLSorEAP-MD5.Non-EAP,non-tunneled:CHAP,MS-CHAP,PAP,orMAC_AUTH.MAC_AUTHmustbeusedexclusivelyinaMAC-basedAuthenticationService.WhentheMAC_AUTHmethodisselected,PolicyManager:(1)makesinternalcheckstoverifythattherequestisindeedaMACAuthenticationrequest(andnotaspoofedrequest)and(2)makessurethattheMACaddressofthedeviceispresentintheauthenticationsource.ClearPass配置菜單AnAuthenticationSourceistheidentityrepositoryagainstwhichPolicyManagerverifiesidentity.ItsupportstheseAuthenticationSourcetypes:

MicrosoftActiveDirectory

anyLDAPcompliantdirectory

RSAorotherRADIUS-basedtokenservers

SQLdatabase,includingthelocaluserstore.

StaticHostLists,inthecaseofMAC-basedAuthenticationofmanageddevices.ClearPass配置菜單AnAuthorizationSourcecollectsattributesforuseinRoleMappingRules.Youspecifytheattributesyouwanttocollectwhenyouconfiguretheauthenticationsource.PolicyManagersupportsthefollowingauthorizationsourcetypes:

MicrosoftActiveDirectory

anyLDAPcompliantdirectory

RSAorotherRADIUS-basedtokenservers

SQLdatabase,includingthelocaluserstore.ClearPass配置菜單AnAuthenticationSourceistheidentityrepositoryagainstwhichPolicyManagerverifiesidentity.ItsupportstheseAuthenticationSourcetypes:

MicrosoftActiveDirectory

anyLDAPcompliantdirectory

RSAorotherRADIUS-basedtokenservers

SQLdatabase,includingthelocaluserstore.

StaticHostLists,inthecaseofMAC-basedAuthenticationofmanageddevices.ClearPass配置菜單PolicyManagerevaluatesRequestsagainstRoleMappingPolicyrulestomatchClientstoRole(s).AllrulesareevaluatedandPolicyManagermayreturnmorethanoneRole.Ifnorulesmatch,therequesttakestheconfiguredDefaultRole.ClearPass配置菜單AnInternalPosturePolicytestsRequestsagainstinternalPosturerulestoassesshealth.Postureruleconditionscancontainattributespresentinvendor-specificposturedictionaries.ClearPass配置菜單PolicyManagertestsPostureTokens,Roles(andsystemtime)againstEnforcementPolicyrulestoreturnoneormorematchingEnforcementProfiles(thatdefinescopeofaccessfortheclien