Security

I am relatively new to CPPM and have been doing a lot of research and labbing in order to understand the architecture and configuration as best as I can. The one thing that I cannot determine through the aforementioned is best practices. Specifically, I would like best practices on how everyone categorises/organises their service list. I have done some research and have come across an old community post, which was great - it provided me with a list that I took as best practice. Below is the list I found

• 802.1x wireless
• 802.1x wired
• MAC auth wired 
• Guest registration (Radius)
• Guest MAC auth
• Wireless MPSK 

But the question that is bugging me is why? In theory, and correct me if I am wrong, you could lump wired and wireless into the same service and make highly granular service conditions and policies right? Is there something my uneducated mind is missing or is it simply for organisational purposes so we do not have services with rows upon rows of conditions?

Also is this a good general best practice list for a service set or are there others you've seen out in the wild within customer environments?

You could technically lump them together, and you'd regret it the first time something breaks. Service selection is first match, top down, so one giant service means every condition and every role-mapping rule gets evaluated for every request type, and troubleshooting turns into reading a wall of rules trying to work out which branch a client took.

Separate services keep the blast radius small. Wired and wireless usually want different enforcement anyway, different roles, different VLANs, different posture expectations, and when you split them you can change one without touching the other. Access Tracker also gets far more readable when the service name tells you what happened.

That list you found is a fine baseline. Add MPSK or Onboard services if you use those, and put your most specific services above the general ones since first match wins.

------------------------------
Dustin Burns

Lead Mobility Engineer @Worldcom Exchange, Inc.

ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
If my post was useful accept solution and/or give kudos
------------------------------