• Network Requirements
o ClearPass Goals
o Network Topology
o List of available resources
o Scenario Analysis
o Authentication requirements
o Multiple user account databases
o User Account attributes
o High Level Design
• PDI and Digital Certificates
o Certificate Types
o PKI
o Certificate Trust
o Certificate File Formats
o ClearPass as CA
o Certificate Use cases:
 EAP
 HTTPS
 Service-based certificates
 Onboarding
 Clustering
 RadSec
 NAD Captive Portal
o Installing Certificates
o Enrollment over Secure Transport
• Cluster Design
o ClearPass Server Placement
o Determine the layout of the Cluster
o High-Availability Schema
o Design High-Availability
o VIP Failover
o VIP Mapping
o Insight Primary and Secondary
• Network Integration
o Authentication Sources
 Local User Repository
 Endpoint Repository
 Admin User Repository
 Guest User Repository
 Guest Device Repository
 Onboard Device Repository
 Active Directory
 SQL Server
o Define External Servers
 Unified Endpoint Management
 Email Server
o Endpoint Profiling
 IF-MAP
 Active Scans (SNMP)
 DHCP
 HTTPS
o Network Devices
 RadSec
 Dynamic Authorization
 Logging of RADIUS Accounting
 Device-groups
 Location Attributes
o Policy Simulation
• Corporate Access Design
o Define the Requirements
o High-level design
o Services Design
o Plan TIPs Roles
o User Authentication
o Machine Authentication
o Tunneled EAP, EAP-TLS and Protected EAP
o One versus Multiple Services
o Plan Enforcement
o Device-groups based Enforcement
o Service Implementation
o OnGuard Design and implementation
 Quarantine users
 Remediation
o Onboard Design and implementation
 User and device authorization
o Informational Pages
o Authorization validation
o Troubleshooting Enforcement
o Downloadable Roles
• Guest Access Design
o Guest Network Design
o Captive Portal Flow
o Design Tasks
o Define Web Pages
o Guest Services Design
o Guest Services
o Guest Access Controls
o Configure Network Access Devices
o Guest Account Creation
o Guest Self-Registration
o Guest Sponsor Approval
o Self-Registration AD Drop-Down List
o Requirements for Guest Enforcement
• Multi-Pre Shared Key
o Define the Requirements
o High-level design
o Device authorization
o Service Design and implementation
• Wired Access
o AAA configuration
o 802.1X and MAC auth
o Using client profiling for authorization
o Using conflict attribute for authorization
o User Roles configuration in ArubaOS-S
o User Roles configuration in ArubaOS-CX
o Web Redirection
o Multi-Service Ports
o Downloadable User Roles Enforcement Profiles
o Downloadable User Roles Configuration and Validation
• Administrative Access
o TACACs+ based NAD administration
o TACACs+ command Authorization
o Policy Manager Administrators
o Guest and Onboard Operators
o Register devices for MPSK
o Insight Operators
o Insight Reports and Alerts