Authentication and Authorization

  2 minute read  

Central NAC enforces strong authentication methods, ensuring that only authorized users or devices can access the network. This typically involves certificates or unique pre-shared keys to verify the identity of users and devices. Authentication ensures that each individual or device requesting access is properly identified before being granted entry.

Once authentication is successful, Central NAC uses granular authorization policies to determine the level of access granted. These policies are based on various factors, such as the user’s group membership in identity store, location, authentication method, device category, compliance and other context around the device.

Central NAC monitoring dashboard can be used to monitor the authentication status and troubleshoot connectivity issues whether its bad credentials or authorization failure.

Central NAC triggers a re-authentication whenever there is a change in the context of the user or device, prompting a re-evaluation of the access policies. This approach ensures that Zero Trust is enforced dynamically by continuously verifying the user and device context. User context is available in the form of IDP group membership and device context in the form of client tags and category from Aruba Central client insights.

Configuring Authentication and Authorization profiles

Here are the steps to configure authentication and authorization profiles in Central NAC:

1. The first step is to create WLAN and wired port profiles and assign to appropriate scope. Note to select Central NAC as the authentication server.

2. Configure identity providers needed for authentication and authorization. Steps to configure IDPs are documented at:

https://arubanetworking.hpe.com/techdocs/new-central/content/nac/config-identity-store.htm

3. Configure an authentication profile to select the authentication method and IDP to to be used with a particular network.

4. Configure authorization policies that provide appropriate level of access based on the user and device context. Authorization policies have pre-conditions that determine which policy would be used. When a policy is first created, it would only have the Deny All rule within it. Additional rules would have to be configured that specify the role / vlan / session timeout to be returned after a successful authentication. Rules can be used to assign different enforcement actions like role, VLAN ID and session timeout.

Frequently Asked Questions

Q: If any change is made to the authorization policy, does it impact connected users?
A: New policies will be applied when the client reauthenticates. Changing policies does not trigger a mass re authorization