Wired Intelligent Edge

Hi,

our setup with CX-Switches 10.16 works well with client ip tracker and also interim accounting.
the challenge is : use information that is already there and write it into clearpass´endpoint db - aka "profiling".

endpoints with static ip addresses are well visible, also via #show port-access clients dhcp-info command.

according to a previous thread dfp - device fingerprinting should do the trick
Security

Hpe		remove preview
Security Hi World,The endpoints in this scenario configured with static ip and layer 3 device (fw) doesn't support the necessary snmp OID which is required for the Clear View this on Hpe >

but applying a dfp profile with dhcp options does not generate valuable entries, neither at the switch level (#show client device-fingerprint), nor subsequent at clearpass.

my second approach was : use framed-ip-address, which is also already there (appears in access tracker within accounting details) to feed endpoint db. but got no idea on how to ... ?

Two problems here, and the first has a blunt answer: DHCP fingerprinting can't work for statically addressed endpoints. CX dfp is passive, so no DHCP traffic means options 12, 55 and 60 have nothing to populate from. Nothing's misconfigured, there's just no input.

CX supports DHCP, HTTP, LLDP and CDP, and that's the list. For static hosts LLDP is the realistic one:

client device-fingerprint profile FP1

    lldp tlv-name system-name

    lldp tlv-name system-description

Then show client device-fingerprint active to confirm it's armed on the port. Note that modifying an active profile wipes everything already collected, which makes it look broken while you're iterating.

To ClearPass it goes as Aruba-AVPair in interim accounting, off by default: vsa vendor hpe_anw type avpair group dfp-client-info under aaa radius-attribute group radius. On 10.16 check whether your build wants aruba or hpe_anw, since the rename was never documented. Confirm it's actually leaving the switch under Monitoring > Live Monitoring > Accounting > Details before blaming CPPM.

On Framed-IP-Address, I'd drop it. Entity Update Enforcement is post-authentication and Framed-IP only exists in accounting, so it'll always be empty at the point enforcement runs.

Instead let ClearPass read the ARP table off the switch, under Configuration > Network > Devices > your switch > SNMP Read Settings > Read ARP Table Info. The switch answers SNMP fine even though your endpoints and firewall don't, and IP Tracker is already keeping that table accurate, which is why your dhcp-info output works with no DHCP in play.

------------------------------
Dustin Burns

Lead Mobility Engineer @Worldcom Exchange, Inc.

ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
If my post was useful accept solution and/or give kudos
------------------------------