Aruba ClearPass Onboard
Automated mobile device provisioning and configuration for secure BYOD

Overview:

Automate device provisioning for secure BYOD

We make it easy to automatically provision settings and certificates for network connectivity on Windows, Mac OS X, iOS, Ubuntu, Chromebook and Android mobile devices. This enables them to connect securely to any wireless and wired enterprise network.

IT controls who connects

BYOD doesn’t mean a wide-open network. IT writes the rules about who can connect, from which device and from what location.

ClearPass QuickConnect

Now you can automate 802.1X device configurations for wired and wireless networks without having to create distribution-of-unique-device certificates.

Features:

• Enables users to self-register and securely onboard multiple devices
• Supports Windows, Mac OS X, iOS, Android, Chromebook and Ubuntu operating systems
• Sponsor-based onboarding allows for custom workflows
• Active Directory and social login credential authentication supported
• Automates the configuration of network settings for wired and wireless endpoints
• Unique provisioning and revocation of device-specific credentials and certificates
• Contains built-in certificate authority specifically for BYOD
• Uses profiling to identify device type, manufacturer and model
• Provides BYOD visibility and centralized policy management capabilities

Advantage:

With the industry's most advanced auto-provisioning features, onboarding thousands of devices is amazingly simple through integrated policy management, customizable user-facing portal, and built-in certificate authority.

Automated Policy management

With ClearPass, IT can use context collected during onboarding to enforce device type and ownership-based network access policies. Centrally-defined policies also limit the types of devices that can be onboarded and which user groups can onboard them.

Built-in certificate authority simplifies administration for BYO devices

Flexible workflow options

The onboard configuration process can be managed via sponsor and non-sponsor required workflows. User authentication can prompt for active directory or social login credentials.

Customized device provisioning

A centrally-managed administrator portal allows IT to configure device certificates and trust details, network access, VPN, and health check settings, and authentication protocols for wireless and wired networks.

ClearPass Onboard also define the number of devices that can be onboarded devices per user and how long their certificates are valid.

Advanced Onboarding Capabilities:

Built-in certificate authority for BYOD

The distribution of published device credentials through ClearPass Onboard's built-in certificate authority (CA) safeguards organizations that want to adopt BYOD initiatives's without requiring the implementation of an external certificate authority. ClearPass Onboard issued certificates are unique as they also include specific user and device context.

The Onboard CA provides the option to utilize certificate management without the need to make changes to an internal public key infrastructure (PKI) or active directory (AD).

ClearPass also supports the distribution of Onboard generated certificates requested by third-party applications - mobile device management (MDM) or enterprise mobility management (EMM) - through SCEP and EST (RFC 7030) protocols.

Revocation of unique certificates

Easy-to-use search and menu-driven capabilities ensure the rapid revocation and deletion of certificates for specific mobile devices if a user leaves a organization or the mobile device is lost or stolen. Online Certificate Status Protocol (OCSP) supported.

Details of unique credentials for onboard BYOD endpoints.

Ordering Guidance:

ClearPass Onboard can be ordered via perpetual license or subscription that includes ArubaCare for the length of the subscription. Available Enterprise options provide the ability for organizations to flexible use the licenses for ClearPass Onboard, Guest or OnGuard.

Ordering ClearPass Onboard involes the following three steps:

1. Determine the number of unique endpoints that users will provision within your environment.
2. Select the total number of Onboard licenses. Anything over the capacity of a base appliance will require the purchase of a second Policy Manager appliance.
3. Choose the appropriate ClearPass Policy Manager hardware or virtual appliances to accommodate the total number from above.

Example - To support the provisioning 2000 total devices, ensure that Policy Manager platform is sized to accommodate the 2000 devices and any other endpoints that will authenticate via 802.1X, MAC auth, etc.

Purchase the following:

• ClearPass Hardware Appliance -CP-HA-5K
• ClearPass Onboard - 2 X LIC-CP-OB-1K

Additional Onboard capacity can be purchased at any time to meet growth demands.

Documentation:

Aruba ClearPass Onboard Datasheet (.PDF)