HPE HPE Aruba Networks Networking ClearPass Workshop - Onboard #1 - Setting up the Onboard CA

In this video we will cover the steps needed to setup ClearPass Onboarding, and setup the Onboarding Certificate Authority for our lab.
ClearPass Onboarding setup steps:
Make sure you have a valid HTTPS Certificate
Setting up the Onboarding CA (optional)
Create Onboarding settings and profiles
ClearPass Services for Onboard
Check video HPE HPE Aruba Networks Networking ClearPass Workshop - Getting Started #5 - Installing the HTTPS certificate on ClearPass to learn how to install the proper HTTPS certificate on ClearPass.
This video is part of the HPE HPE Aruba Networks Networking ClearPass Workshop series. In this series, I will show all steps that are needed to go from scratch to a pretty standard and representative ClearPass deployment.
Index page for all videos: community.arub... HPE Aruba Networks Networking-ClearPass-Workshop-Video-series/td-p/291597

[@hermanrobers]

And a more common color for the background, for those who care ;-) Nice Orange.

[@neilgoddard9613]

Excellent video Herman, very clear and easy to follow.

[@grahammccann8554]

Hi Herman, Thank you for making these video.. :-)

[@ricardoraul]

is it possible to cover the other CA modes? great video btw

[@cuti4795]

Great Video.Could you please also make videos related onguard?

[@owenvaningen2030]

Very clear!

[@JohnEgilSolberg]

Hello Herman! You say to use localhost in the OCSP URL as best practice when using Aruba Clearpass only. Can you elaborate on that?

[@hermanrobers]

Yes, that is correct. That is because the certificate database is distributed in the cluster, so all ClearPass nodes do have the list of current valid certificates. By querying 'localhost', you will always have a local lookup and you will be independent of the availability of other nodes in the cluster for your OCSP, and also you prevent the lookup to take place over the network. If you use multiple certificate authorities, story may become a bit more complex, as those will not be available on localhost. In the case that you just have Onboard certs, the best-practice is to override the URL and use localhost as the OCSP server.

[@sureshhkumar955]

Hi,, how to do onboard using single SSID, pls share the document

[@hermanrobers]

I don't have such a document and after some changes in Android and IOS it is no longer recommended to use single SSID Onboarding. One example in Android is that it is no longer possible from QuickConnect to replace the SSID configuration with the post-onboard configuration. This has to do with the APIs from Android itself that have changed and now prevent such changes. If, for educational reasons, you want to test with it, it is mostly the same where on an authentication from a non-onboarded device (most times authentication type PEAP) you return a role with captive portal and the required white-lists (github.com/aruba/clearpass-cloud-service-whitelists/blob/master/onboard/onboard_android.md). Then after the client returns, you return the normal access on the TLS authentication. And, I have an old video on how it works: kzbin.info/www/bejne/i5_KgWamq6tjgZY

[@sureshhkumar955]

@@hermanrobers thanks