HPE Aruba Networking ClearPass Policy Manager - Update custom attributes on MAC addresses

HPE Aruba Networking ClearPass Policy Manager - Update custom attributes on MAC addresses sets a custom attribute value on the endpoint that matches each asset's MAC address in HPE Aruba Networking ClearPass Policy Manager. Optionally, it also creates or updates a role mapping policy that maps the attribute value to a ClearPass role. Use it to tag endpoints so that they receive a specific role, for example for network segmentation, for:

• Assets returned by the selected query or assets selected on the relevant asset page.

Required Fields

These fields must be configured to run the Enforcement Action.

• Use stored credentials from the HPE Aruba Networking ClearPass Policy Manager adapter - Select this option to use credentials from an existing ClearPass adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

    📘

    Note

    To use this option, you must successfully configure an Aruba ClearPass adapter connection.

• NAC Custom Attribute Name - Enter the name of the Endpoint custom attribute in ClearPass (default: axonius_ew_seg_id). Axonius creates the attribute if it does not exist.

• Attribute Value to Assign - Enter the segment value to write to the custom attribute of every selected endpoint.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

These fields are optional.

• Aruba Role Name - Enter the name of a ClearPass role. When set, Axonius creates or updates a role mapping policy that assigns this role to endpoints whose custom attribute equals the Attribute Value to Assign.
• Role Mapping Policy Name - Enter the name of the role mapping policy. If empty, Axonius uses Axonius EW Segment - <role name>.
• Role Mapping Default Role Name - Enter the default role of the role mapping policy (default: [Other]).

Connection Settings

APIs

Axonius uses the Aruba ClearPass REST API:

• POST /api/oauth - Authenticates with the client credentials grant.
• POST /api/attribute - Creates the Endpoint custom attribute. Axonius treats an attribute that already exists as success.
• GET /api/role-mapping/name/{name} - Checks whether the role mapping policy exists. Used only when Aruba Role Name is set.
• POST /api/role-mapping - Creates the role mapping policy if it does not exist. Used only when Aruba Role Name is set.
• PUT /api/role-mapping/{role_mapping_id} - Updates the role mapping policy if it exists. Used only when Aruba Role Name is set.
• PATCH /api/endpoint/mac-address/{mac_address} - Sets the custom attribute on the endpoint.

Required Ports

Axonius must be able to communicate via the following ports:

• TCP port 443 (HTTPS), or the port specified in the ClearPass domain you configure.

Required Permissions

The following permissions and requirements are needed:

• A ClearPass API client with the Client Credentials grant type, and the Axonius IP address in the ClearPass API access list. For details, see Aruba ClearPass.
• An operator profile for the API client that includes API Services access and permission to modify endpoints and their attributes. [To Verify] When you set Aruba Role Name, the profile must also allow creating and updating role mappings. The read-only permissions used to fetch data are not enough for this action.

To learn more about Enforcement Actions, see Enforcement Actions.

Version Matrix

This Enforcement Action was tested only with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed and it is not functioning as expected.

---