Aruba Clearpass Deployment

Scope: Hundreds of Aruba switches and thousands of access points 100+ school and administrative buildings across the ISD and local districts A complex network environment with over 1,000 VLANs The first phase of the deployment focused on TACACS+ for management-plane authentication. ClearPass was configured as the TACACS+ server for all switches and access points, enabling centralized control over administrative access. By integrating ClearPass with Active Directory, admin accounts are automatically provisioned — eliminating the need to maintain local credentials on individual devices and ensuring that access rights stay in sync with directory group memberships. ClearPass was deployed to automatically identify and classify devices connecting to wired switch ports. Using profiling and policy enforcement, ClearPass dynamically assigns the correct VLAN and port configuration based on device type. In a network with over 1,000 VLANs, this automation dramatically reduced the administrative burden of manual port provisioning and minimized the risk of misconfiguration across the district's many locations. Device certificates issued through Active Directory Certificate Services were used to authenticate endpoints via 802.1X. This approach provides strong, credential-free authentication for domain-joined devices and ensures that only trusted, managed endpoints gain access to protected network resources. MFA was integrated into the ClearPass administrative authentication workflow, adding a second layer of verification for any management-level action on switches and access points. Every network device across the ISD and its local districts is secured behind MFA, significantly reducing the risk of unauthorized administrative access. ClearPass was integrated with Palo Alto Networks firewalls to share identity context. As users and devices authenticate through ClearPass, identity and role information is passed to Palo Alto, enabling user-aware firewall policies. This integration provides consistent security enforcement from the network edge through the firewall, tying access control and threat prevention to verified identities.