HPE7-A02 Endpoint Classification

Endpoint Classification Detailed Explanation

1. Passive Identification

Passive identification methods allow Aruba devices and ClearPass to classify devices without directly interacting with them. These techniques rely on observing traffic already being sent by the endpoint.

DHCP Fingerprinting

• What is it?
  When a device connects to the network and requests an IP address using DHCP, it sends certain fields called “Options.”

  • Option 55: Lists what DHCP parameters the device is asking for.

  • Option 60 (Vendor Class Identifier): Often contains the device manufacturer or operating system info.

• How it's used:
  By analyzing these options, Aruba ClearPass can guess the OS of the device — such as Windows 10, macOS, Android, etc.

• Why it's useful:
  Without any manual input, the network gets an idea of what kind of device is trying to connect.

MAC OUI Analysis

• What is a MAC OUI?
  The first 24 bits (first 6 characters) of a device's MAC address identify the manufacturer — called the Organizationally Unique Identifier (OUI).

• Example:

  • 00:1A:79 = Apple

  • 3C:5A:B4 = Hewlett Packard

• Use case:
  Helps ClearPass determine if a device is likely a laptop, printer, phone, etc., based on the vendor.

TCP/IP Stack Fingerprinting

• How it works:
  Every operating system (OS) implements the TCP/IP stack a bit differently. Details like:

  • Time To Live (TTL)

  • Window size

  • TCP options (e.g., SACK, Timestamps)
    can help fingerprint the OS.

• Passive TCP fingerprinting:
  Aruba switches or ClearPass Device Insight sensors can observe traffic and infer the OS without active probing.

2. Active Classification

In active classification, the network initiates interaction with the endpoint to get more precise information.

NMAP or OnGuard Scanning

• NMAP is a network scanner that can:

  • Discover open ports

  • Detect running services

  • Perform banner grabbing — reading service versions like “Apache 2.4.58” or “Windows SMB 3.0”

• ClearPass OnGuard can be used to perform agent-based scans, checking the device’s behavior and service exposure.

• Why use it?
  Helps classify unknown or unmanaged devices more accurately (e.g., IoT, BYOD).

SNMP Queries

• For managed devices like switches, printers, or cameras, SNMP can return:

  • sysDescr — describes the device (e.g., “HP LaserJet 4200”)

  • sysObjectID — a unique ID for the device model/firmware

• ClearPass can poll these devices using SNMP to learn exactly what they are.

ClearPass OnGuard — Posture Checking

• OnGuard is a ClearPass module that installs an agent (persistent or dissolvable) on endpoint devices.

• It performs security posture checks such as:

  • Antivirus status

  • Operating system patch level

  • Disk encryption (e.g., BitLocker)

  • Firewall status (enabled/disabled)

• Posture results are sent back to ClearPass for policy enforcement.

3. Role & Policy Assignment

Once a device is identified and its trustworthiness is assessed, Aruba applies network access policies through dynamic roles.

ClearPass Device Insight (CPDI)

• CPDI is a cloud-hosted AI/ML engine.

• It collects passive and active data to classify devices by type:

  • Examples: Camera, Printer, Medical Equipment, Windows PC, IoT Gateway

• Learns from global behavior patterns and applies contextual classification.

Risk Score (0–100)

• Every device gets a risk score based on:

  • Device type and behavior

  • OnGuard posture results

  • Known vulnerabilities or suspicious traits

• Score ranges:

  • 0–49: Low risk (fully trusted)

  • 50–79: Medium risk (limited access)

  • 80–100: High risk (quarantine, alert)

• High-risk devices are often assigned:

  • An isolated VLAN

  • Strict ACLs (block access to sensitive systems)

  • Lower QoS priority

Dynamic Role Mapping

• ClearPass maps the endpoint to a user role using one or more conditions:

  • Device posture

  • Group membership (from Active Directory)

  • MAC address

  • Risk score

  • Location or time of day

• Each role defines:

  • VLAN assignment

  • ACLs (what the device can access)

  • Bandwidth or QoS limits

  • Enforcement duration (e.g., limited-time access)

Downloadable Enforcement Profiles

• These are policy bundles sent from ClearPass to switches, controllers, or gateways.

• Automatically apply the correct role-based policy — no need to manually configure every switch.

Endpoint Classification (Additional Content)

1. Profiler Service & Auto-Updating Fingerprint Database

What is ClearPass Profiler?

ClearPass Profiler is a built-in service that passively identifies endpoints by observing:

• DHCP options

• MAC OUI

• TCP/IP fingerprinting

• SNMP responses

• HTTP headers (for web-based devices)

AI/ML Advantage: Cloud-Sourced Fingerprint Updates

ClearPass can automatically pull updated fingerprint definitions from Aruba’s cloud intelligence platform, enabling it to recognize:

• New IoT device types

• Uncommon embedded systems

• Updated OS or firmware variants

How it works:

• Fingerprint library updates are periodically synced.

• No manual signature tuning is needed.

• Enables accurate classification even for zero-touch devices.

Benefit:

This ensures device recognition remains accurate over time, strengthening identity-based policy enforcement without requiring human reconfiguration.

2. Posture-Based Policy Enforcement: Real-Life Strategy Example

ClearPass OnGuard evaluates endpoint posture using dissolvable or persistent agents. Based on the result, it assigns the appropriate role and access scope.

Typical Posture Checks:

• Antivirus installed and running

• Disk encryption (e.g., BitLocker)

• Firewall enabled

• OS patch level up-to-date

Real-Life Enforcement Example:

Posture Result	Assigned Role	Action Taken
Healthy	corp-user	Access to full enterprise VLAN + ACLs
Warning	restricted-user	Access to remediation portal only
Failed	quarantine	Placed into VLAN 999, no LAN access

Enforcement Profile: "Quarantine Profile"
→ VLAN: 999
→ ACL: deny_all
→ CoA: reauth

This approach ensures that only compliant, trusted devices can reach corporate services, while non-compliant ones are automatically isolated.

3. Change of Authorization (CoA) – Dynamic Role Update Mechanism

What is CoA?

Change of Authorization (CoA) is a RADIUS protocol extension that allows ClearPass to change an endpoint’s access permissions mid-session, without disconnecting or requiring manual intervention.

How It Works:

1. Device connects and authenticates (via 802.1X or MAB)

2. ClearPass assigns an initial role (e.g., unknown)

3. After additional evaluation (e.g., OnGuard result, device behavior):

   • ClearPass sends a CoA request to the switch or gateway

   • Device session is re-evaluated and new role/VLAN/ACL is applied

Aruba Use Cases:

• Upgrade from guest to employee after login via captive portal

• Downgrade from corp-user to restricted if risk score increases

• Automatically bounce the port for devices violating security posture

Policy Action:
IF Risk Score > 80 THEN
→ Role = "High-Risk"
→ Send CoA to reauthenticate + isolate

CLI Validation (AOS-CX):

show port-access clients detail

• Displays CoA trigger events, current and previous roles, session status.

Summary

Topic	Purpose
Profiler Service Updates	Keeps fingerprint matching accurate and up to date via cloud syncing
Posture-Based Role Assignment	Enforces VLAN/ACL/QoS policies based on antivirus/firewall/patch status
Change of Authorization (CoA)	Enables real-time dynamic role/VLAN updates based on policy/risk shifts