ClearPass and CX Switch Authentication with ubt tunneling

@nafithsalama
This video builds on the MAC authentication with Local User Role

It goes one step further by creating GRE tunnel between the switch and the gateway (mobility Controller)

The enforcement policy will trigger the enforcement profile (the action) to assign that locally created role which will dictate the tunnel establishment

00:00 Introduction
01:57 Mobility Controller preparation and verification
05:13 ubt zone and transit VLAN configuration
07:01 ubt settings verification
10:26 Define Firewall role on the mobility controller
12:10 Defining Local User Role on the switch

***CX switch configuration and verification***
radius-server host 10.254.1.32 key plaintext aruba123
aaa group server radius cppm
server 10.254.1.32
exit
aaa accounting port-access start-stop interim 5 group cppm
!!replay-protection should be kept enabled in real production"
radius dyn-authorization client 10.254.1.32 secret-key plaintext aruba123 replay-protection disable
radius dyn-authorization enable

!!!enable radius tracking
radius-server tracking user-name cx-radius-track password plaintext aruba123
radius-server host 10.254.1.32 tracking enable

!!! MAC authentication global
aaa authentication port-access mac-auth radius server-group cppm
aaa authentication port-access mac-auth enable

!!! Create client VLAN 11
vlan 11

!!! assign a role this is without tunneling
port-access role employee
vlan access 11
exit

!!! Interface MAC authentication
interface 1/1/8
no routing
vlan access 11
aaa authentication port-access mac-auth
enable
exit

show aaa authentication port-access mac-auth interface 1/1/8 client-status

show mac-address-table
show aaa accounting port-access interface all client-status
show port-access role
show aaa authentication port-access interface all client-status
show radius dyn-authorization client 10.254.1.32

!! define ubt zone
ubt zone mc
primary-controller 10.1.30.10
Invalid input: 10.1.30.10
enable

port-access ubt-fallback-role [ROLE-NAME]
show ubt
show ubt state

!! Create the port-access role and map the ubt zone to the local user role
port-access role employee
gateway-zone zone mc gateway-role authenticated
exit

*** mobility controller configuration and verification ***
!! mobility controller needs three types of licenses, AP, PEF and RFP for the tunneling to work
show license
firewall
dpi
show tunneled-node-mgr tunneled-node
show license-usage
show datapath-tunnel
user-role mc-employee
access-list session allowall
vlan 31
show configuration pending
show rights

[shahdsalama]

Good effort Nafith many thanks for the clear explanation