The ClearPass Onboard Process

This section provides provisioning Process of preparing a device for use on an enterprise network by creating the appropriate access credentials and setting up the network connection parameters. Same as onboarding. process overviews for different device types. It includes the following:

Devices Supporting Over-the-Air Provisioning

Devices Supporting Onboard Provisioning

Devices Supporting Over-the-Air Provisioning

ClearPass Onboardsupports secure device provisioning for iOS Operating system from Apple, Inc. for mobile devices, including the iPhone, iPad, and iPod Touch. 10 and later, iPasOS 13 and later, and recent versions of macOS Operating system from Apple, Inc. for desktop and laptop computers. Replaced the Mac OS X name. (10.13 “Sierra” and later). These are collectively referred to as “iOS devices”. The Onboard process for iOS devices is shown in Figure 1.

Figure 1  Onboard Process for iOS Devices

The Onboard process is divided into three stages:

1. Pre-provisioning. The enterprise’s root certificate is installed on the iOS device.

2. Provisioning. The user is authenticated at the device provisioning page and then provisions their device with the Onboard server. The device is configured with appropriate network settings and a device-specific certificate.

3. Authentication. After configuration is complete, the user switches to the secure network and is authenticated using an EAP-TLS EAP Transport Layer Security. Certificate-based authentication method supporting mutual authentication, integrity-protected ciphersuite negotiation, and key exchange between two endpoints. client In a server-client relationship, the client is a device or appliance that relies on the server for information, access, or other actions. Same as supplicant. certificate.

A sequence diagram showing the interactions between each component of this workflow is shown in Figure 2.

Figure 2  Sequence Diagram for the Onboard Workflow on iOS Platform

1. When a BYOD Bring your own device. Refers to using personal mobile devices within an employer's enterprise network infrastructure, and the associated network and resource management challenges. device first joins the provisioning network it does not have a set of unique device credentials Network authentication credentials that uniquely identify the device and user and enable management of provisioned devices. May be a username and password or a TLS client certificate, depending on the type of device.. This will trigger the captive portal Web page requiring users to authenticate and sign in before connecting to a public network. Captive portals are typically used by business centers, airports, hotel lobbies, coffee shops, and other venues that offer free Wi-Fi hotspots for the guest users. ClearPass supports the creation of a captive portal policy for use as a downloadable role enforcement profile for supported device types. for that device, which brings the user to the mobile device provisioning page.

2. A link on the mobile device provisioning page prompts the user to install the enterprise’s root certificate. Installing the enterprise’s root certificate enables the user to establish the authenticity of the provisioning server during device provisioning.

3. The user then authenticates with their provisioning credentials – these are typically the user’s enterprise credentials from Active Directory Microsoft Active Directory. Directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed.. If the user is authorized to provision a mobile device, the over-the-air provisioning Process used to securely provision a device and configure it with network settings; applies to iOS and macOS only. workflow is then triggered (see Figure 3, below).

4. After provisioning has completed, the device switches to EAP Extensible Authentication Protocol. An authentication framework that supports multiple authentication methods, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. In tunneled EAP methods, authentication and posture credential exchanges occur inside of a protected outer tunnel.-TLS Transport Layer Security. A cryptographic protocol that provides communication security over the Internet. TLS encrypts network connection segments above the Transport Layer by using asymmetric cryptography for key exchange, symmetric encryption for privacy, and message authentication codes for message integrity. Also EAP-TLS. authentication Verification of a user’s credentials. Typically accomplished with a username and password, a one-time token, or a digital signature. using the newly provisioned client certificate. Mutual authentication is performed (the authentication server verifies the client certificate, and the client verifies the authentication server’s certificate).

5. The device is now onboarded and is able to securely access the provisioned network.

Over-the-air provisioning is used to securely provision a device and configure it with network settings. Figure 3 shows a sequence diagram that explains the steps involved in this workflow.

Figure 3  Over-the-Air Provisioning Workflow for iOS Platform

1. The only user interaction required is to accept the provisioning profile. This profile is signed by the Onboard server, so that the user can be assured of its authenticity.

2. An iOS device will have two certificates after over-the-air provisioning is complete:

a. A Simple Certificate Enrollment Protocol (SCEP Simple certificate enrollment protocol. Protocol for requesting and managing digital certificates.) certificate is issued to the device during the provisioning process. This certificate identifies the device uniquely, and is used to encrypt the device configuration profile so that only this device can read its unique settings.

b. A Transport Layer Security (TLS) client certificate is issued to the device. This certificate identifies the device and the user that provisioned the device. It is used as the device’s network identity during EAP-TLS authentication.

Devices Supporting Onboard Provisioning

ClearPass Onboard supports secure device provisioning for supported Microsoft Windows, Apple macOS, and Android devices (smartphones and tablets). These are collectively referred to as “Onboard-capable devices”. For information regarding supported versions for these platforms, please refer to the latest ClearPass Policy Manager Module of the ClearPass access management platform used to create and enforce security policies across a network for all devices and applications. OnGuard and Profiler features and some Guest and AirGroup configuration items are included within the Policy Manager user interface. Release Notes. The Onboard process for these devices is shown in Figure 4.

Figure 4  ClearPass OnboardProcess for Onboard-Capable Devices

The Onboard process is divided into three stages:

1. Pre-provisioning. This step is only required for Android devices; the HPE Aruba Networking QuickConnect ClearPass functionality used to securely provision an Android, Windows, Linux, or macOS device and configure it with network settings. QuickConnect's functionality is incorporated within Onboard. app Application. This shortened form of the word is used for applications on mobile devices. must be installed for secure provisioning of the device.

2. Provisioning. The device provisioning page detects the device type and downloads or starts the QuickConnect app. The app authenticates the user and then provisions their device with the Onboard server. The device is configured with appropriate network settings and credentials that are unique to the device. See Figure 5 for details.

3. Authentication. After configuration is complete, the user switches to the secure network and is authenticated using PEAP Protected EAP. Addresses security issues associated with clear text EAP transmissions by creating a secure channel encrypted and protected by TLS. Same as EAP-PEAP.-MSCHAPv2 unique device credentials.

Figure 5  Sequence Diagram for the Onboard Workflow on Android Platform

1. When a BYOD device first joins the network it does not have a set of unique device credentials. This will trigger the captive portal for that device, which brings the user to the mobile device provisioning page.

2. The Onboard portal is displayed. The user’s device type is detected, and a link is displayed depending on the device type:

a. For Android devices, the link is to a file containing the Onboard configuration settings; downloading this file will launch the QuickConnect app on the device.

b. For Windows and Mac, the link is to a executable file appropriate for that operating system that includes both the QuickConnect app and the Onboard configuration settings.

3. The QuickConnect app uses the Onboard provisioning workflow to authenticate the user and provision their device with the Onboard server. The device is configured with appropriate network settings and credentials that are unique to the device.

4. After provisioning has completed, the app switches the device to PEAP authentication using the newly provisioned unique device credentials. Mutual authentication is performed (the authentication server verifies the client’s username and password, and the client verifies the authentication server’s certificate).

5. The device is now onboarded and is able to securely access the network.

The Onboard provisioning workflow is used to securely provision a device and configure it with network settings. Figure 6 shows a sequence diagram that explains the steps involved in this workflow.

Figure 6  Onboard Provisioning Workflow in the QuickConnect App