Dynamic Authorization

When a client connects for the first time, ClearPass Device Insight (CPDI ClearPass Device Insight provides a full-spectrum of visibility across the network by intelligently discovering and profiling all connected devices.) tags for the client are not available. For this initial connection, the client role that is configured for the “Unprofiled” Client Profile tag is used to enforce network access. CPDI notifies the Cloud Authentication Cloud Authentication and Policy allows you to configure user and client access policies that provide a secured, cloud-based network access control (NAC). service in the event tags for client changes. This can be triggered when tags are available after initial profiling or for incremental changes to tags later due to various factors. In such an event, the Cloud Authentication service triggers a session disconnect.

When the client reconnects, the client role based on the updated tags as configured by Admin are used to enforce network access. If the Client Profile tag is not configured to match one of the tags assigned to the client, then the client role mapped to the “Unprofiled” Client Profile tag will be used to enforce network access.

For more information about Client Profiles and client tags, see the following topics:

• Viewing the Profile of a Specific Client
• Managing Tags