Central NAC with AOS-CX

Author: Willem Bargeman, Mathew George

Building a network based on Zero Trust principles requires effective network segmentation and access controls that adapt to both user and device context. Implementing 802.1X with MAC Authentication Bypass (MAB) alongside Central NAC enables a wide range of devices to securely connect to the wired network while receiving the appropriate level of access. Dynamic segmentation is achieved through device profiling with Client Insights, granular authorization policies enforced by Central NAC, and the segmentation capabilities of ArubaOS-CX switches.

Common use cases are:

Corporate managed devices → 802.1X with EAP-TLS with certificates and network profiles pushed from MDM solutions

BYOD devices → 802.1X with EAP-TLS after onboarding

Printers, IoT, badge readers, cameras, phones → Mac Authentication Bypass (MAB)

Unknown devices → guest/quarantine/deny role

Configuring Aruba OS CX switches to work with Central NAC

Before we get started, the switch needs to be onboarded to New Central and the device function should be assigned as Access Switch. These steps are beyond the scope of this guide. Please refer to New Central documentation for details around onboarding AOS CX switches.

In this example, an Aruba CX-6300 switch is used. The same steps apply to any other CX platform that supports 802.1X and MAC authentication.

Prerequisites

• Aruba CX switch managed by Aruba Central
• Minimum CX software version AOS-CX 10.15
• TCP-PORT 2083 open between the switch and Central NAC for RadSec communication

Configuration steps

The configuration consists of creating or updating the following profiles in Central.

1. System > Switch System : Configures global switch configuration including 802.1X/MAC

2. Security > AAA profile : Enable authentication protocols and the authentication server. This AAA profile will be used in the port profiles which in turn would be applied to interface profiles or specific interfaces

3. Interfaces > Port profile : Map the created AAA profile to the port profile

4. Interfaces > Interface profile : Map the port profile to an interface profile to use with a range of interfaces. Using interface profile is optional and the port profile can be applied directly to the interface as described below.

5. Switch > interfaces : If not using interface profile, the port profile can be directly applied to switch interfaces as well

Configure Switch System Profile

Navigate to:

Aruba Central → Configuration → System → Switch System

Create a new Switch System Profile (or edit an existing one) and assign the profile to gobal scope and Device Function. Configure the profile with the following information.

Configuration Pushed to the switch:

The following configuration will be pushed to the switch. You can validate this in the Aruba Central Audit Trail or on the switch CLI.

radius server-group sys_central_nac
    radius-server host naw2.cloudguest.central.arubanetworks.com tls port 2083 vrf default port-access keep-alive timeout
!
radius dyn-authorization client naw2.cloudguest.central.arubanetworks.com tls vrf default
!
aaa group server radius sys_central_nac
    server naw2.cloudguest.central.arubanetworks.com tls port 2083 vrf default
!
aaa radius-attribute group sys_central_nac
    nas-id value 'REMOVED'
    nas-id request-type both
!
aaa accounting port-access start-stop group sys_central_nac
!
aaa authentication port-access dot1x authenticator
    enable
    radius server-group sys_central_nac
!
aaa authentication port-access mac-auth
    radius server-group sys_central_nac
    enable
    auth-method pap
!

Configure AAA Profile

Navigate to:

Aruba Central → Configuration → Security → AAA Authentication

Create a new AAA Authentication Profile (or edit an existing one) and assign the profile to the right scope and device function. This AAA profile is intended for use within a Port Profile.

Assigning the profile alone applies only general AAA and certificate configurations to the switch. Full configuration is applied only when the profile is referenced in a Port Profile.

Configure the profile with the following information.

Configuration Pushed to the switch:

The following configuration will be pushed to the switch. You can validate this in the Aruba Central Audit Trail or on the switch CLI.

radius dyn-authorization enable
crypto pki ta-profile sys_central_nac
ta-certificate
[REDACTED_CERTIFICATE]
crypto pki certificate device-identity
crypto pki application radsec-client certificate device-identity

Configure Port Profile

Navigate to:

Aruba Central → Configuration → Security → AAA Authentication

Create a new Port Profile (or edit an existing one) and assign the profile to the global scope and Device Function. A Port Profile is a template that contains configuration settings for a switch interface. It can be assigned to either an interface profile that covers a range of interfaces or to specific interfaces. Any updates made to the Port Profile are automatically propagated to all associated interfaces. Assigning the profile alone does not trigger any configuration changes on the switch; changes occur only when it is referenced at interface level.

Configure the profile with the following information.

Applying port profile to interface profile

The Interface Profile helps configure and manage interface level configurations for a large number of devices, based on the deployment type, model, and number of ports in SKUs. It uses port profiles within Interface Profiles to configure individual interfaces and apply Link Aggregation Group (LAG) configurations.

To create an interface profile, navigate to

Library > Interfaces > Interface Profile > Create

Applying Port Profile to a switch interface

Navigate to:

Aruba Central → Configuration → Switch Level → Switch Interface Configuration

The Port Profile can also be assigned at the switch device level. Select the desired interface and apply the Port Profile to it. This action applies the previously configured template to the selected switch interface.

Configure the profile with the following information.

Configuration Pushed to the switch:

The following configuration will be pushed to the switch. You can validate this in the Aruba Central Audit Trail or on the switch CLI. The configuration contains some additional configuration like spanning-tree and app-recognition. These configurations are not mandatory for Central NAC.

interface 1/1/3
    no shutdown 
    no routing
    vlan access 1
    spanning-tree bpdu-guard
    spanning-tree root-guard
    spanning-tree tcn-guard
    spanning-tree port-type admin-edge
    port-access onboarding-method concurrent enable
    no aaa authentication port-access allow-lldp-auth
    no aaa authentication port-access allow-cdp-auth
    aaa authentication port-access radius-override enable
    aaa authentication port-access dot1x authenticator
        radius server-group sys_central_nac
        enable
    aaa authentication port-access mac-auth
        enable
        radius server-group sys_central_nac
    app-recognition enable
    ip flow monitor sys_cx_monitor_v4_default in
    ipv6 flow monitor sys_cx_monitor_v6_default in
    exit

Configure a Role

Navigate to:

Aruba Central → Configuration → Roles & Policies → Roles

Create a new Role and assign the profile to the right scope and Device Function.

A Role defines authorization attributes such as VLAN, authentication mode, PoE settings, and more. This Role is returned by Central NAC during client authentication on the network.

The Role shown here is for demonstration purposes only. In production environments, multiple Roles are typically defined and used.

Configure the Role with the following information.

Employee Role :

Configuration Pushed to the switch:

The following configuration will be pushed to the switch. You can validate this in the Aruba Central Audit Trail or on the switch CLI.

port-access role employee
    auth-mode client-mode                                      
    stp-admin-edge-port 
    vlan access 1

Configure survivability (optional)

When Central NAC is unavailable for any reason, network access may be impacted. In AOS-CX, authentication survivability features can be configured to mitigate this. Several options are available, with the most comprehensive being the Cached Critical Role feature. This feature allows previously authenticated clients to be authorized using their last assigned roles when the RADIUS server (Central NAC) is unreachable.

Update the Switch System Profile for Authentication Survivability

Navigate to:

Aruba Central → Configuration → System → Switch System

Update the previously created Switch System Profile. Configure the profile with the following information.

Configuration Pushed to the switch:

The following configuration will be pushed to the switch. You can validate this in the Aruba Central Audit Trail or on the switch CLI.

aaa authentication port-access cached-critical-role
    enable 
    persistent-storage
        enable

Central NAC configuration

While this guide focuses on the configuration of Aruba CX switches, the following outlines the minimum steps required within Central NAC. These steps are specifically focused on MAC authentication.

Configure Authentication Profile for MAC Authentication

Navigate to:

Aruba Central → Central NAC → Configuration → Authentication Profiles

Create a new Profile for MAC Authentication. Configure the profile with the following information.

MAC Authentication Profile

Configure the Authorization Policy

Navigate to:

Aruba Central → Central NAC → Configuration → Authorization Policies

Authorization Policies define how devices are mapped to Roles based on specific conditions. These policies evaluate attributes and assign the appropriate Role to a device during authentication.

The conditions available within Authorization Policies depend on the Central NAC license. Central NAC Core enables the configuration of basic policies, while Central NAC Pro provides greater flexibility and more advanced policy options.

Refer to the following resource for detailed information.

https://arubanetworking.hpe.com/techdocs/NAC/central-nac/central-nac-understanding-foundation-vs-advanced-subscriptions/

Configure the Authorization Policy with the following information.

Authorization Policy Rule

Add a new Rule to the created Authorization Policy. Configure the Rule with the following information.

Validation

The required configuration steps are now done. Connect a client to the switch interface. The client should be authenticated via Central NAC and placed in Role employee.

Validation - Central NAC

To view the client authentication requests and details. Navigate to:

Aruba Central → Central NAC → Clients

This page shows all authentication requests in Central NAC.

Click on a client to view the authentication details.

Switch validation commands

Common issues

Hereby a list of common configuration related issues seen in the field