培训教程基本配置

•支持更多的终端、用户•支持更多的终端、用户和协–––––越来越多的智能终端开始连接网络，不仅仅是Windows终802.1X日益发展的Cloud应用要求具备对单点登录（SSO）能力的支•支持更加复杂的基于情境的授––––通常认证过程只能提供“是”或者“否”两种结支持更多的场景识别并提供更加精细的网络授•可视性和故障分析能力不•可视性和故障分析能力不–––无法对连接到网络中的终端进行自动识别和信息•扩展性和可靠性不缺乏足够的EAP不支持active-active•缺乏丰富的功–––仅提供有限的AAA,缺少便捷的访客账户管理功On-On-On-On-管理802.1X终端设外置Raidus功认证服1234传输SELABSELAB远程组远程组园区WLAN测主用数备用数控制控制用S1500交换机模拟广域远程测服务器远程组远程组园区WLAN测主用数备用数控制控制用S1500交换机模拟广域远程测服务器 ADCPPMAMPAdminIPvlandefaulttotoac1(@datacentertoac2(@datacentertointernettocampustoremotetoinstanttototoserver-toAdminIPvlandefaulttotoac1(@datacentertoac2(@datacentertointernettocampustoremotetoinstanttototoserver-towan-towan-server1systeminstalledoninstalledonserver2systeminstalledoninstalledonClearPass服务器基本认ClearPass服务器基本认证主用数备用数控制控制用S1500交换机模拟广域远程测服务器 ADCPPMAMPCLEARPASS资源CLEARPASS资源和许可说CP-VA-CP-VA-CP-VA-CP-VA-CP-VA-CP-VA-VmwareESXiVmwareESXiVmwarePlayerVmwarePlayer是免费软件，支持多CPU、多下载地址：CPPM测试机2Virtual40GBCPPM测试机2Virtual40GBdisk4GB2Gigabitvirtualswitchedports(only1neededifnotusingseparateportsfordataand2Virtual250GBdisk••4GB2Gigabitvirtualswitchedports(only1neededifnotusingseparateportsfordataand•8Virtual8GB2Gigabitvirtualswitchedports(only1neededifnotusingseparateportsfordataand••512GBdiskAtleast24GB2Gigabitvirtualswitchedports(only1neededifnotusingseparateportsfordataand1AuthenticatingDevice=11AuthenticatingDevice=1Totaledper7-UniqueMACTotalGuestsDevicesperdayAuthenticatingGuests1GuestTotalGuestsDevicesperdayAuthenticatingGuests1Guest1PolicyManager7-dayTotalUniqueHealthChecks1Onguard7-dayTotalUniqueHealthChecks1Onguard1PolicyManagerUniqueDevicesUniqueDevicesLicenseUsedCount30-dayaverageofLicenseUsedCount30-dayaverageofper-daytotaluniqueGuest30-dayaverageof7-daytotaluniquedeviceHealthChecksTotalOnboardedPolicy30-dayaverageof7-daytotaluniquedeviceStudent&StaffAllLaptops802.1X4,000SameStudent&StaffAllLaptops802.1X4,000Samestudents&staffeveryGuest1000DifferentguestsperStudent&StaffHealthChecks3,000laptops(outof4000)Samestudents&staffeveryday4,000personal4000LaptopsLicenseLicensePolicy4000LaptopsLicenseLicensePolicy1000Guestsper=7000Guestsper1000Guestsper=7000Guestsper7-LicenseLicensePolicy4,000+=(outof4000License(outof4000LicenseLicensePolicy4000StudentPersonalLicenseLicense4000StudentPersonalLicenseLicensePolicy11,000+= CP-HW-25KorCP-VA-LicenseLicense CP-HW-25KorCP-VA-LicenseLicensePolicyLicensingTabLicensingTabUpdates:Exceeding-Exceeding-UserscontinuetocanbeLOCKEDLicenseUserscontinuetocanbeLOCKEDLicenseEnforcementActionTaken30-dayaverageofper-daytotalGREATER_THANTotalFOR4outof6NoActiontaken.NotePolicyManagerlicenseTotalCount=UsedCount.CannotOnboardmorePolicy30-dayaverageof7-daytotalGREATER_THANTotalFOR4outof6CLEARPASS服务CLEARPASS服务器安ClearPass虚拟机ClearPass虚拟机资源配置CLEARPASSCLEARPASS多种策略–Role,VLAN,多种策略–Role,VLAN,ACL下发，CoAAD,LDAP,SQL,令牌服务器,EAPornon-EAPmethodforEAPornon-EAPmethodforclientauthentication.PolicyManagersupportsfourbroadclassesof•••EAP,non-tunneled:EAP-TLSorEAP-MAC_AUTHmustbeusedexclusivelyinaMAC-basedAuthenticationService.WhentheMAC_AUTHmethodisselected,PolicyManager:(1)makesinternalcheckstoverifythattherequestisindeedaMACAuthenticationrequest(andnotaspoofedrequest)and(2)makessurethattheMACaddressofthedeviceispresentintheauthentication•AnAuthenticationSourceistheAnAuthenticationSourceistheidentityrepositorywhichPolicyManagerverifiesidentity.ItsupportstheseAuthenticationSourcetypes:MicrosoftActiveDirectoryRSAorotherRADIUS-basedtokenSQLdatabase,includingthelocaluserstore.StaticHostLists,inthecaseofMAC-basedAuthenticationofmanagedAnAuthorizationSourcecollectsAnAuthorizationSourcecollectsattributesforuseinRoleMappingRules.Youspecifytheattributesyouwanttocollectwhenyouconfiguretheauthenticationsource.PolicyManagersupportsthefollowingsourceMicrosoftActiveDirectoryRSAorotherRADIUS-basedtokenSQLdatabase,includingthelocaluseragainstwhichPolicyManagerverifiesidentity.ItsupportstheseAuthenticationSourcetypes:MicrosoftActiveDirectoryanyLDAPcompliantdirectorySQLdatabase,includingthelocaluserstore.StaticHostLists,inthecaseofMAC-basedAuthenticationofmanagedPolicyManagerevaluatesPolicyManagerevaluatesRequestsagainstRoleMappingPolicyrulestomatchClientstoRole(s).AllrulesareevaluatedandPolicyManagermayreturnmorethanoneRole.Ifnorulesmatch,theAnInternalPostureAnInternalPosturePolicytestsRequestsagainstinternalPosturerulestoassesshealth.Postureruleconditionscancontainattributespresentinvendor-specificposturePolicyManagertestsPostureTokens,Roles(andsystemtime)againstEnforcementPolicyrulestoreturnonePolicyManagertestsPostureTokens,Roles(andsystemtime)againstEnforcementPolicyrulestoreturnoneormorematchingEnforcementProfiles(thatdefinescopeofaccessfortheEnforcementPolicyProfilesEnforcementPolicyProfilescontainattributesthatdefineaclient’sscopeofaccessf