Administrator Guide

16 | Use Cases Dell Networking W-ClearPass Policy Manager |Getting Started Guide
Policy Manager ships with fourteen preconfigured services. In this use case, you select a service that supports
802.1X wireless requests. Follow the steps below to configure this basic 802.1X service that uses [EAP FAST],
one of the pre-configured Policy Manager authentication methods, and Active Directory Authentication
Source (AD), an external authentication source within your existing enterprise.
Policy Manager fetches attributes used for role mapping from the authorization sources (that are associated with the
authentication source). In this example, the authentication and authorization source are one and the same.
Policy Manager tests client identity against role-mapping rules, appending any match (multiple roles
acceptable) to the request for use by the enforcement policy. In the event of role-mapping failure, Policy
Manager assigns a default role. This use case create the role mapping policy RMP_DEPARTMENT that
distinguishes clients by department and the corresponding roles ROLE_ENGINEERING and ROLE_FINANCE, to
which it maps.
Policy Manager can be configured for a third-party posture server, to evaluate client health based on vendor-
specific credentials, typically credentials that cannot be evaluated internally by Policy Manager (that is, not in
the form of internal posture policies). Currently, Policy Manager supports the following posture server
interface: Microsoft NPS (RADIUS).
For purposes of posture evaluation, you can configure a posture policy (internal to Policy Manager), a posture server
(external), or an audit server (internal or external). Each of the first three use cases demonstrates one of these
options; here, the posture server.
Configuring a Service
1. Navigate to Configuration > Services.
2. Click the icon to add a service. The Configuration > Services > Add window opens.
3. If it is not already selected, click the Service tab and define basic service information.
a. Enter a name for the service in the Name field.
b. Click the Type drop-down list and select 802.1X Wireless.
c. (Optional) click the Monitor Mode checkbox to allow handshakes to occur (for monitoring purposes), but
without enforcement.
d. Click Next to display the Authentication tab.
4. Configure authentication.
a. In the Authentication Methods field, select [EAP Fast].
b. In the Authentication Sources field, click the Select to Add drop-down list and select the following
sources.
n [Local User Repository] [Local SQL DB]
n [Guest User Repository] [Local SQL DB]
n [Guest Device Repository] [Local SQL DB]
n [Endpoints Repository] [Local SQL DB]
n [Onboard Devices Repository] [Local SQL DB]
n [Admin User Repository] [Local SQL DB]
n [Active Directory]
c. (Optional) Select Strip Username Rules to pre-process the user name (to remove prefixes and
suffixes) before sending it to the authentication source.