Study guide
9.3 ClearPass Policy Management and RADIUS Change of Authorization
HPE Aruba Networking Certified Associate - Campus Access HPE6-A85
Track your progress as you read
Finished sections get a check mark.
1 Introduction: HPE6-A85 Exam Overview
HPE6-A85 Exam Facts and Current Blueprint
2 Chapter 1: Network Stack Fundamentals
1.1 OSI Reference Model and Encapsulation 1.2 TCP/IP Protocol Suite and IP Headers 1.3 Layer 2 Operation, ARP, and 802.1Q Tagging
3 Chapter 2: Physical Connectivity and Host Addressing
2.1 Ethernet Media and Transceiver Standards 2.2 Power over Ethernet (PoE, PoE+, PoE++) Standards and Budgeting 2.3 LLDP, LLDP-MED, and Voice VLAN Configuration 2.4 Host IP Addressing and DHCP Relay Operations
4 Chapter 3: Network Resiliency and Virtualization
3.1 Virtual Switching Framework (VSF) Architecture and Topologies 3.2 VSF Split Detection, Failover, and Auto-Stacking 3.3 Virtual Switching Extension (VSX) Architecture and Operations 3.4 High-Availability Gateways: VRRP and VSX Active-Gateway
5 Chapter 4: AOS-CX Architecture and Switch Operation
4.1 AOS-CX Hardware Portfolio and State Database Architecture 4.2 Network Analytics Engine (NAE) and Automated Telemetry 4.3 AOS-CX Interface Configuration and Port Control 4.4 Link Aggregation (LAG) and LACP Configuration
6 Chapter 5: Layer 2 Protocols and Spanning Tree
5.1 AOS-CX VLAN Configuration and Native VLAN Handling 5.2 Spanning Tree Protocols: STP, RSTP, and MSTP 5.3 Spanning Tree Protections and Loop Prevention 5.4 MAC Address Table Learning, Aging, and Forwarding
7 Chapter 6: Wireless Fundamentals, Standards, and RF
6.1 IEEE 802.11 Standards and Wi-Fi Generations 6.2 RF Fundamentals, Signal Propagation, and Channel Design 6.3 Aruba Access Point Hardware Portfolio and Suffix Conventions 6.4 WLAN Topologies, BSSID/ESSID, and Roaming Standards
8 Chapter 7: Aruba Wireless Architecture and Management
7.1 AOS 10 Architecture and Aruba Central Integration 7.2 Wireless Forwarding Modes: Bridge vs Tunnel Mode 7.3 Automated RF and Client Optimization: AirMatch and ClientMatch 7.4 Secure Wireless Access: WPA3, SAE, and MPSK Implementation
9 Chapter 8: IP Routing Fundamentals and OSPF
8.1 IP Routing Principles and Packet Forwarding 8.2 OSPFv2 Protocol Mechanics and Adjacency Formation 8.3 OSPF Designated Routers and Multi-Area Deployments 8.4 ECMP, Static Routing, and VRF Isolation
10 Chapter 9: Campus Network Security and Segmentation
9.1 DHCP Snooping and Dynamic ARP Inspection 9.2 Port Security and MAC Address Limiting 9.3 ClearPass Policy Management and RADIUS Change of Authorization 9.4 Dynamic Segmentation, User-Based Tunneling, and Policy Enforcement
11 Chapter 10: Authentication, Authorization, and Accounting
10.1 The AAA Framework and Architecture 10.2 802.1X Authentication and EAP Methods 10.3 MAC Authentication and Captive Portal Onboarding 10.4 Administrative Access Control: RADIUS vs TACACS+
12 Chapter 11: Network Management and Telemetry
11.1 Aruba Central Cloud Architecture and Group Configuration 11.2 Zero-Touch Provisioning (ZTP) and Aruba Activate 11.3 AI Insights and Aruba User Experience Insight (UXI) 11.4 Network Telemetry, Streaming APIs, and SNMP/Syslog
13 Chapter 12: Troubleshooting the Solution
12.1 Structured Troubleshooting Methodologies and Scope Isolation 12.2 AOS-CX Layer 2 and Interface Diagnostic Commands 12.3 Layer 3, IP Services, and End-to-End Diagnostics 12.4 Physical-Layer Troubleshooting 12.5 Troubleshooting Wireless Clients and Network Access
14 Chapter 13: Optimizing Performance: QoS, Baselines, and Comparisons
13.1 Quality of Service (QoS) Classification and Marking 13.2 Queuing Algorithms and Congestion Management 13.3 Traffic Policing, Shaping, and Broadcast Rate Limiting 13.4 Establishing a Performance Baseline 13.5 Comparing Results to the Baseline
15 Chapter 14: Plan the Solution
14.1 Analyzing the Current Environment 14.2 Interpreting an Architect's High-Level Design 14.3 Creating a Low-Level Design 14.4 Preparing for Implementation
16 Chapter 15: Validate and Operate the Solution
15.1 Validating the Solution 15.2 Performing Firmware Updates 15.3 Making Basic Ongoing Configuration Changes 15.4 Maintaining Network Documentation
9.3 ClearPass Policy Management and RADIUS Change of Authorization
Key Takeaways Explain This Topic AI
Aruba ClearPass Policy Manager (CPPM) provides centralized, role-based network access control (NAC), evaluating context such as user identity, device profile, posture health, time, and location.
Device profiling dynamically identifies headless IoT endpoints through passive and active collectors (DHCP fingerprints, HTTP user agents, MAC OUIs), enabling tailored authorization without 802.1X supplicants.
ClearPass OnGuard performs endpoint posture assessment, checking antivirus definitions, OS patches, and disk encryption before admitting devices into corporate network segments.
RADIUS operates over UDP ports 1812 (Authentication/Authorization) and 1813 (Accounting), returning authorization parameters such as dynamic VLAN assignments and Aruba-User-Role Vendor-Specific Attributes (VSAs).
RADIUS Change of Authorization (CoA, RFC 5176) on UDP port 3799 enables ClearPass to initiate session modifications in real time, executing Disconnect Messages (DM) or CoA-Requests to elevate user roles after posture checks pass.
Last updated: October 2026
ClearPass Policy Management and RADIUS Change of Authorization
Quick Summary: Modern enterprise networks require identity-based access control rather than static port-based configurations. Aruba ClearPass Policy Manager (CPPM) delivers comprehensive Network Access Control (NAC) through dynamic role-based policies, automated device profiling, and endpoint posture evaluation. Using the RADIUS protocol (RFC 2865), ClearPass authenticates endpoints and dictates access privileges via dynamic VLANs and Aruba User Roles. Through RADIUS Change of Authorization (CoA, RFC 5176) on UDP port 3799, ClearPass dynamically modifies active client sessions in real time, enforcing posture remediation and rapid threat containment without requiring physical disconnection.
The Evolution of Enterprise Network Access Control
Traditional enterprise security relied heavily on static port configurations: assigning specific physical switch jacks to departmental VLANs. This legacy approach presents fatal design flaws in contemporary campus environments:
Operational Inflexibility: When employees move desks, network engineers must manually reconfigure switch ports.
The Proliferation of IoT: Modern campus facilities feature thousands of "headless" devices—IP surveillance cameras, smart LED lighting, smart TVs, medical telemetry sensors, and HVAC controllers—that lack interactive displays and cannot install client software.
Bring Your Own Device (BYOD): Employees and contractors connect personal smartphones, tablets, and unmanaged laptops that introduce untrusted software into the enterprise environment.
Role-Based Access Control (RBAC)
Aruba architecture replaces static port assignments with Role-Based Access Control (RBAC) . Rather than basing trust on where a cable is plugged in, the network determines access rights based on who the user is, what device is connecting, when the connection occurs, and how healthy the endpoint is. Access policies are encapsulated into User Roles managed centrally by ClearPass Policy Manager.
The AAA Security Framework
ClearPass operates as the central engine for the AAA Framework : +---------------------------------------------------------------------------------------------------------+
- | THE AAA SECURITY FRAMEWORK |
- | |
- | [ 1. AUTHENTICATION ] ---------> "Who are you?" |
- | Validates credentials, 802.1X certificates, or MAC addresses. |
- | |
- | [ 2. AUTHORIZATION ] -----------> "What are you allowed to do?" |
- | Evaluates context; pushes dynamic VLANs, ACLs, and User Roles. |
- | |
- | [ 3. ACCOUNTING ] --------------> "What did you do?" |
- | Logs session start/stop, duration, byte counts, and audit trails. |
- +---------------------------------------------------------------------------------------------------------+
- Device Profiling and Posture Assessment
ClearPass achieves contextual intelligence through two fundamental technologies: ClearPass Profiler and ClearPass OnGuard .
ClearPass Device Profiler
For devices that lack 802.1X supplicants (such as printers and badge readers), ClearPass performs device fingerprinting using passive and active telemetry collectors:
DHCP Snooping Helper: Inspects DHCP Option 55 (Parameter Request List) and Option 60 (Vendor Class Identifier) transmitted during address acquisition. A Zebra barcode printer requests completely different DHCP options than an Apple iPad or a Windows workstation.
HTTP User-Agent Strings: Parses web browser strings captured during captive portal redirection.
MAC OUI (Organizationally Unique Identifier): Analyzes the first 24 bits of the device MAC address to determine the hardware manufacturer (e.g., Axis Communications, HP Inc., Apple).
LLDP / CDP Discovery: Ingests Layer 2 neighbor discovery metadata forwarded by AOS-CX access switches, including device system descriptions, model numbers, and capabilities.
Active Network Probing: Executes targeted Nmap TCP/UDP port scans and SNMP queries to verify running operating systems and open network services.
Once profiled, ClearPass classifies the endpoint into a precise category (e.g., Device Category: Smart Device , OS: Apple iOS , Device Name: iPad ) and applies tailored authorization rules.
ClearPass OnGuard: Endpoint Posture Assessment
Authenticating user credentials is not enough; the connecting device itself must be secure. ClearPass OnGuard performs pre-admission and post-admission posture assessment using either a persistent background agent or a dissolvable web agent:
Health Verification: Inspects local endpoint security controls: verifying that the corporate antivirus engine is running, virus definition files are fewer than 3 days old, the local OS firewall is active, critical security patches are installed, and whole-disk encryption (BitLocker or FileVault) is active.
Posture Token Assignment: ClearPass evaluates the health data and assigns a posture token: HEALTHY , QUARANTINE , or INFECTED .
Phased Remediation Flow: If a laptop has outdated antivirus definitions, ClearPass places the device into a temporary Remediation Role . The user can only access the internal antivirus update server. Once definitions update and OnGuard re-evaluates the health state as healthy, ClearPass triggers a dynamic role change.
RADIUS Protocol Mechanics and Authorization Attributes
Communication between the AOS-CX access switch (acting as the Network Access Server, or NAS ) and ClearPass Policy Manager (acting as the RADIUS Server ) utilizes the standard Remote Authentication Dial-In User Service (RADIUS) protocol (RFC 2865 for Authentication/Authorization, RFC 2866 for Accounting).
Transport and Core Messages
Transport Protocol: RADIUS operates over UDP port 1812 for Authentication and Authorization, and UDP port 1813 for Accounting.
Standard Message Exchange:
Access-Request : The switch forwards client credentials or EAP identity to ClearPass.
Access-Challenge : ClearPass requests additional authentication handshakes (such as an EAP-TLS certificate exchange or multi-factor token).
Access-Accept : ClearPass verifies credentials and returns network authorization parameters.
Access-Reject : ClearPass denies network admission.
Key RADIUS Authorization Attributes
Inside the Access-Accept packet, ClearPass embeds specific attributes that instruct the AOS-CX switch on how to treat the client's traffic:
Attribute Type Attribute Name & Number Function and Description
IETF Standard Tunnel-Type (64) Set to value 13 (specifies VLAN encapsulation).
IETF Standard Tunnel-Medium-Type (65) Set to value 6 (specifies 802 networks / Ethernet).
IETF Standard Tunnel-Private-Group-Id (81) Specifies the dynamic VLAN ID (e.g., "20" ) or VLAN Name to which the switch port is assigned.
Aruba VSA Aruba-User-Role (Vendor ID 14823 , VSA 1 ) Specifies the name of a local or downloadable User Role on the AOS-CX switch, applying local ACLs, QoS, and policing.
IETF Standard Session-Timeout (27) Defines the maximum session duration in seconds before the client must re-authenticate.
RADIUS Change of Authorization (CoA - RFC 5176)
Traditional RADIUS is strictly client/NAS-initiated: the switch queries the server, the server responds, and the session remains frozen in that state until the client physically disconnects. RADIUS Change of Authorization (CoA) , standardized under RFC 5176 , revolutionizes this architecture by introducing server-initiated control. +---------------------------------------------------------------------------------------------------------+
- | RADIUS CHANGE OF AUTHORIZATION (RFC 5176) |
- | |
- | [ ClearPass Policy Manager ] ------------ UDP Port 3799 ------------> [ AOS-CX Access Switch ] |
- | |
- | 1. DISCONNECT-REQUEST (DM): |
- | Immediately tears down client session, resets port state, drops user from network. |
- | (Switch responds with Disconnect-ACK or Disconnect-NAK). |
- | |
- | 2. CoA-REQUEST: |
- | Modifies active session parameters in real time (e.g., shifts role from Quarantine to Corporate) |
- | WITHOUT disconnecting physical link or interrupting IP lease. |
- | (Switch responds with CoA-ACK or CoA-NAK). |
- +---------------------------------------------------------------------------------------------------------+
- CoA Message Types
RFC 5176 defines two critical server-initiated operational messages, transmitted over UDP port 3799 (or legacy UDP port 1700):
Disconnect-Request (Disconnect Message / DM):
Purpose: Forces the switch to terminate an active client session immediately.
Action: The switch clears the MAC forwarding table entry, tears down authentication state, and drops client traffic. If 802.1X is active, the client must restart the EAP exchange from the beginning.
Use Cases: Incident response isolation of a compromised device, administrative blacklisting, or handling guest session timeout.
Response: The switch returns a Disconnect-ACK upon successful termination, or Disconnect-NAK if the session could not be located.
CoA-Request:
Purpose: Dynamically alters the authorization attributes of an active session without dropping the client's connection .
Action: The client maintains its physical link, Layer 2 state, and Layer 3 IP address. The switch updates the client's assigned User Role, VLAN, or ACL filters in real time.
Use Cases: Posture remediation elevation (transitioning from Quarantine-Role to Corporate-Role once OnGuard validates antivirus updates), captive portal post-authentication (shifting from unauthenticated Guest-Logon to authenticated Guest-Internet ), or applying bandwidth throttling when a user exceeds daily quotas.
Response: The switch returns a CoA-ACK on success, or CoA-NAK if the requested attribute cannot be applied.
AOS-CX RADIUS and Dynamic Authorization Configuration
The following configuration establishes communication between an AOS-CX switch and ClearPass, enabling RADIUS authentication, accounting, and RFC 5176 Change of Authorization: switch# configure terminal
- ! Step 1: Configure the ClearPass RADIUS Server and Enable Dynamic Authorization (CoA)
- switch(config)# radius-server host 10.100.1.50 key plaintext ClearPassSecret2026
- switch(config)# radius dyn-authorization enable
- switch(config)# radius dyn-authorization client 10.100.1.50 secret-key plaintext ClearPassSecret2026
- ! Step 2: Create a RADIUS Server Group
- switch(config)# aaa group server radius CPPM-CLUSTER
- switch(config-sg-radius)# server 10.100.1.50
- switch(config-sg-radius)# exit
- ! Step 3: Configure 802.1X Authentication to use the ClearPass Group
- switch(config)# aaa authentication port-access dot1x authenticator radius server-group CPPM-CLUSTER
- switch(config)# aaa authentication port-access dot1x authenticator enable
- ! Step 4: Configure Port-Access Client Roles for Posture Flow
- switch(config)# port-access role Quarantine-Role
- switch(config-pa-role)# vlan access 99
- switch(config-pa-role)# exit
- switch(config)# port-access role Corporate-Role
- switch(config-pa-role)# vlan access 10
- switch(config-pa-role)# exit
- ! Step 5: Enable 802.1X Authenticator on Access Port
- switch(config)# interface 1/1/15
- switch(config-if)# no routing
- switch(config-if)# aaa authentication port-access dot1x authenticator enable
- switch(config-if)# exit
- Essential Verification Commands
Command Output and Operational Purpose
show radius-server Displays configured RADIUS servers, ports, and reachability.
show radius dyn-authorization Shows dynamic authorization (CoA) status and counters for Disconnect-Requests, CoA-Requests, ACKs, and NAKs.
show port-access clients Displays active authenticated clients, MAC addresses, switch ports, and assigned roles.
show port-access clients detail Provides deep telemetry for a specific client: EAP method, VLAN ID, user role, and session timers.
show port-access role Lists all locally configured and dynamically downloaded user roles and bound policies.
Common Exam Traps
Transport Port Numbers: RADIUS Authentication runs over UDP 1812 , Accounting over UDP 1813 , and RADIUS CoA over UDP 3799 . Notice that all three use UDP, contrasting sharply with TACACS+ which runs over TCP port 49.
Forgetting dynamic authorization: On AOS-CX switches, radius-server host <ip> enables standard authentication only. To accept CoA messages on UDP 3799 you must enable radius dyn-authorization enable and define the sending server with radius dyn-authorization client <ip> secret-key ... .
Disconnect vs. CoA Distinction: A common exam question tests which message type changes an active user role without disrupting link state. A Disconnect-Request drops the link/session, whereas a CoA-Request modifies session attributes in-place without disconnecting.