Attributes and Operators

Attributes and operators are a set of parameters required to configure policies for the HPE Aruba Networking Central NAC. These parameters are defined under the Pre-conditions for a policy.

Note:

Configuration of attributes is subject to licensing. For more details, see Licensing.

Attributes

The following table lists the supported attributes for Central NAC:

Table 1: Attributes for Central NAC

Name Description Supported Operators
Authentication Source Name of the selected identity store is equal to

Authentication Type

Type of authentication:

  • Device Provisioning Protocol (DPP)

  • MPSK

  • EAP-TLS

  • MAC Authentication Bypass (MAB)

  • Captive Portal (CP)

 is equal to
Wi-Fi Easy Connect (DPP)

Contains the DPP service type:

  • Bootstrap-Authorization

  • Identity-Update

  • Net-Access

  • Reconfigure

is equal to
is not equal to
CA CN Common Name (CN) attribute of the issuing certificate authority (CA)

is equal to
is not equal to
begins with
contains text

Client Tags

Displays list of user-defined tags

contains any
contains none
Client Category Client MAC address

is equal to
Client CN

Common Name (CN) attribute of the client certificate

is equal to
begins with
contains text

Client SAN SubjectAltName of the client certificate

is equal to
begins with
contains text

Client SAN URI

SubjectAltName of the client URI

is equal to
is not equal to
begins with
contains text

Client SAN DNS

SubjectAltName of the client DNS

is equal to
is not equal to
begins with
contains text

Connection Type

Type of connection—wired or wireless

is equal to
MAC Address Client MAC address

is equal to
is not equal to
begins with
contains text

NAD Vendor

List of Device Vendor name

is equal to
is not equal to
Site List of sites where the authentication occurred

is equal to
is not equal to
SSID SSID where the authentication occurred

is equal to
is not equal to
Identity Store – User Group Fetches maximum of 200 user groups from the configured identity store

contains
contains any

MPSK Ownership

Conditional attribute. Value is limited to user-owned.

is equal to
is not equal to

MPSK Type

Conditional attribute. Value is limited to unbound.

is equal to
is not equal to

Operators

The following table lists the supported operators for Central NAC:

Table 2: Operators for Central NAC

Operator Definition
Is equal to String equals (e.g. "Hello" EQUALS "Hello")
Is not equal to String not equals (e.g. "Hello" NOT_EQUALS "World!")
begins with

String has prefix (e.g. "Hello, World!" BEGINS_WITH "Hello")
contains text String contains a substring (e.g. "Hello, World!" CONTAINS "llo")

contains

List contains a string (e.g. ["Hello", "World!"] CONTAINS_ELEM "World!")

contains any

List contains a sublist (e.g. ["a", "b", "c"] CONTAINS_ANY ["z", "c"])

contains none

List contains none of the elements of another list (e.g. ["a", "b"] CONTAINS_NONE ["a", "d"])

Table 3: Limits on Central NAC entities

Entities Max Limit

Number of authorization policies

100

Number of pre-conditions in a policy

10

Number of rules in a policy

32

Number of conditions in a rule

10

Number of enforcement profiles attached to each rule

1