Security

Hello

Is there any mechanism we can apply to automatically identify if RADIUS/NAC configuration has been removed from a switch?

As of now, we can only know this:

1. If incoming RADIUS requests stops from a particular switch which we only know at the later time OR
2. Through configured SPLUNK alert if there are any alternation in switch configuration

There is an option in ClearPass Insight to configure alerts via email or SMS. I never tried, but may help to resolve your issue.

------------------------------
Harendra | ACEX165 | ACEP | CWDP | CWSP
If you find my answer useful, consider giving kudos and/or mark it as the solution.
------------------------------

Can your monitoring system send test authentications and evaluate the responses? And send an alarm if no response is received?

------------------------------
Regards,

Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------

Original Message:
Sent: Jun 13, 2025 10:39 AM
From: NHN
Subject: Any mechanism to identify if NAC-related configuration is removed from NAD(switch) device

There is an option in ClearPass Insight to configure alerts via email or SMS. I never tried, but may help to resolve your issue.

------------------------------
Harendra | ACEX165 | ACEP | CWDP | CWSP
If you find my answer useful, consider giving kudos and/or mark it as the solution.
------------------------------

An alternative approach would be to use TACACS+ to monitor for any changes within the switches configuration… 

We do have an alert configured in SPUNK when any modification are done at switch level.

Original Message:
Sent: Jun 15, 2025 05:00 AM
From: derinmellor
Subject: Any mechanism to identify if NAC-related configuration is removed from NAD(switch) device

An alternative approach would be to use TACACS+ to monitor for any changes within the switches configuration…