Configuring Client Access Policy

To configure Client Access Policy, complete the following steps:

1. In the WebUI, set the filter to Global.

   The global dashboard is displayed.

2. Click Security > Authentication & Policy and click Config icon.

   The Policies page is displayed.
   

3. Click Setup in the Client Access Policy section.

   The MAC Media Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network.  Authentication page is displayed.

4. In the Allowed MAC Addresses table, perform one of the following steps to add MAC addresses:

   • Click the Upload CSV Comma-Separated Values. A file format that stores tabular data in the plain text format separated by commas. File icon in the Allowed MAC Addresses table.

     The Upload CSV File dialog box appears.

     1. In the Upload CSV File dialog box, drag and drop the CSV file, or click browse to locate the CSV file and click UPLOAD.

        The CSV file is uploaded. The Allowed MAC Addresses table is updated with the MAC addresses from the CSV file. A status box displays a message about the upload and shows if there are any errors. A link to download the error report is also available.

        The CSV file must contain MAC address and the corresponding client-name of the devices that needs to be added.

     or

   • Click the Add New Row + icon and do the following:

     1. In Add MAC based clientdialog box, prompt, enter the MAC address of the device and the Client Name.
     2. Click Save. The new MAC address is added and appears in the table.

   You can click the icon to download all the entries in the Allowed MAC Addresses table onto a CSV file.

5. To add a new row in the Client Profile Tag to Client Role Mapping table, do the following:

   1. Select a client tag from the drop-down list under Client Profile Tag.
      • The values that appear in this drop-down list are mapped to system tags and user tags available in Classic Central. For more information about adding Tags, see Managing Tags.
      • As part of the default policy mapping, the Unspecified client tag is now available. Users who do not belong to any of the existing client tag will be categorized as Unspecified. You can assign a role from the Client Role drop-down to the unspecified client tag.
   2. Select a corresponding client role for the user group from the drop-down list under Client Role.
   3. To create a new row in the Client Profile Tag to Client Role Mapping table, click the + icon and repeat steps a and b.
   • Client Role drop-down list displays roles that are created in the WLAN Wireless Local Area Network. WLAN is a 802.11 standards-based LAN that the users access through a wireless connection. configuration. For more information, see Configuring User Roles for IAP Clients.
   • Client Role must be created for all wired and wireless configurations including those on APs, Gatewayss and Switches. This will ensure that Cloud Authentication and Policy is applied globally across wired and wireless networks.
   • If you delete a client role associated with a client access policy, the client access policy will not work as expected.

   • After 2.5.6 upgrade, Unspecified will be introduced replacing Unprofiled in the role mapping table. However, policies will continue to have the Unprofiled behavior until the policy is re-saved by the network administrator, once it is saved it will have the Unspecified behavior.

   • After the upgrade, when the admin wants to make changes to the policy and save it again, it will be necessary for the Admin to select a valid role for Unspecified. Otherwise, the policy cannot be saved.

   • Unprofiled will be visible in the policy summary screen, but once the policy is saved and Unspecified has a valid role, Unprofiled will not be applicable anymore and it will be removed from the UI.

   • Deny role is not available for client profile tags as it is necessary for the ClearPass ClearPass is an access management system for creating and enforcing policies across a network to all devices and applications. The ClearPass integrated platform includes applications such as Policy Manager, Guest, Onboard, OnGuard, Insight, Profile, QuickConnect, and so on. Device Insights to have visibility of those clients in order to profile and assign all the applicable tags. You can use a role with the least privileges for the Unspecified client profile tag.
6. Click Save.
7. Click the Client Access Policy accordion to view the newly created client access policy.

The following animation shows you how to create a client access policy.