Using User Roles with User-Based Tunneling

User-Based Tunnels can also be used with Local User Roles and any third-party RADIUS server. This requires that the user roles be preconfigured on the switch. For truly colorless and dynamic policy management, Aruba recommends the use of ClearPass to dynamically send policies to both the switch and controller using Downloadable User Roles along with User-Based Tunneling.

  • There are two roles required when using Downloadable User Roles with User-Based Tunneling:

    Primary user role: Configured on switch

    Secondary user role: Configured on controller

  • Both primary and secondary role can be either statically configured or downloaded from the ClearPass.

NOTE:

This feature is only available for:

  • ClearPass 6.7.0 onward

  • Aruba Controller Version 8.3.0 onward

    • To support Downloadable User Roles on controller, a new VSA (HP-CPPM-Seconday-Role) is introduced in ClearPass 6.7.0, which contains the secondary user role name.

    • To use the Reserved VLAN mode in 16.08, a minimum version of 8.4 is required on the Controller.

The Aruba switch downloads user policies from ClearPass using downloadable user roles. This makes the ClearPass a centralized point to administer user policy to the access switch and minimize user configuration on the Aruba switch. For downloadable user roles to work appropriately, the signing Certificate Authority (CA) of the ClearPass HTTPS certificate must be added to the Aruba switch and marked as trusted. With ArubaOS-Switch 16.08, there is an automated way to download the CA certificate of ClearPass. Please refer to the Access Security Guide on using this feature.

ClearPass Sample Configuration 

aaa authorization user-role name "<role-name>" 
vlan-id <vlan id> tunneled-node-server-redirect VSA

When the primary user role is downloaded onto the switch and the secondary user role is downloaded onto the controller:

When the primary user role is downloaded onto the switch and the secondary user role is manually configured on the controller (not sent through VSA):

NOTE:

For more information on user roles, see Access Security Guide for ArubaOS-Switch for your switch.