Configuring DHCP relay on ClearPass in order to allow the client to receive DHCP after
being profited

Enabling DHCP relay on Network Access Devices (NADs) to forward DHCP requests to
ClearPass

DHCP profiling is enabled on ClearPass by default configuration of DHCP relay on the
Network Access Device (NAD) is not required

Enabling the DHCP server to profile endpoints and forward the meta-data to Clearpass

This strategy effectively stops employees from putting their own corporate devices on
the guest network.

This will enable additional information to be gathered about guests during the
conference.

This allows guest users to create and manage their own login account.

This will allow employee personal devices to be Onboarded to the corporate network

This will allow conference employees to pre-load additional device information as guests
arrive and register

Cisco Device Sensor

Exchange Plugging agent

3rd part MDM

DNS fingerprinting

NAD ARP listening handler

Using the "Import Accounts" under ClearPass Guest

Using the "Create Account" or "Create Multiple'' options under ClearPass Guest

Assigning the default role "Lobby Ambassador to a receptionist to then add the accounts

Using the "Sync Accounts'' under ClearPass Guest

importing accounts from Active Directory once ClearPass is added with Admin
credentials

It allows ClearPass to transmit messages to the Network Attached Device/Network
Attached Server (NAD/NAS) to modify a user’s session status

It allows clients to issue a privilege escalation request to ClearPass using RADIUS to
switch to TACACS+

It is a mechanism that enables ClearPass to assigned a User-Based Tunnel (UBT)
between a switch and controller for Dynamic Segmentation

It forces the client to re-authenticate upon roaming to an access point controlled by a
foreign mobility controller

ClearPass will validate the user credentials, then, for the duration of the cache.
ClearPass will just fetch account attributes.

The Cache Timeout is designed to reduce the amount of traffic between ClearPass and
the A/D server by caching the credentials

The Cache Timeout is designed to reduce the amount of traffic between ClearPass and
the A/D server by caching the attributes.

ClearPass will validate the user credentials on the first attempt, then will always fetch
the account attributes

These are endpoints whose beacons have been detected but have never completed
authentication

The label "Known" indicates rogue endpoints labeled as "friendly" or "ignore"

"Known" endpoints have be fingerprinted to determine their operating system and
manufacturer.

"Known" endpoints can be authenticated based on MAC address to bypass the captive
portal login.