"Network Access Control Deployment Guide: Rolling Out Aruba ClearPass Without Breaking Production"
Network access control is one of those projects that looks straightforward on the architecture diagram and turns into a help-desk firestorm the moment you flip it on. The risk is rarely the technology itself; it is the cutover. This ClearPass deployment guide lays out a phased NAC rollout plan built around monitor mode, role mapping, and staged 802.1X enforcement so you can deploy Aruba ClearPass to thousands of ports without locking out a single legitimate user on day one.
If you are buying NAC for a federal, SLED, healthcare, or enterprise environment, the procurement and the deployment plan are tied together. You want hardware sized for growth, licensing scoped to your real device count, and a rollout sequence that survives an audit. Here is how to get all three.
Why NAC projects break production
Most network access control failures trace back to a single decision: turning on enforcement before you understand your own traffic. Real networks are messy. They have printers that do not speak 802.1X, badge readers and HVAC controllers that only support MAC authentication, contractor laptops, IP phones daisy-chained behind workstations, and a long tail of devices nobody documented. Flip enforcement on globally and every one of those endpoints lands in quarantine at once.
The fix is sequencing. ClearPass is designed to watch before it acts. A disciplined rollout uses that capability to build an accurate picture of who and what is on the network before any port starts denying access. Skipping the observation phase is the number-one cause of a stalled NAC deployment.
Phase 0: Design and sizing before you rack anything
Before the first appliance is racked, settle three questions: how many concurrent authenticated sessions you need, which enforcement methods you will support, and where ClearPass sits relative to your identity stores.
ClearPass Policy Manager runs on physical or virtual appliances, and you size by concurrent unique endpoints, not user headcount. The hardware lineup spans entry-class boxes up through models like the C2010 (built on an HPE DL20 Gen10, roughly 5,000 concurrent sessions) and the C3010 (an HPE DL360 Gen10, roughly 25,000 concurrent sessions). For redundancy and policy replication you deploy a publisher/subscriber cluster, so plan for at least two nodes in any production design.
Licensing is separate from the appliance. The core platform licenses by endpoint count, and feature modules are added on top:
| Component | What it does | Sizing driver |
|---|---|---|
| ClearPass Policy Manager (Access) | RADIUS/TACACS+ AAA, policy engine, role mapping | Concurrent unique endpoints |
| OnGuard | Posture/health checks (AV, patch, disk encryption) | Endpoints requiring posture |
| OnBoard | Certificate-based BYOD provisioning | BYOD/device-cert users |
| Guest | Sponsored and self-service guest access | Guest portal usage |
Buy a little headroom on endpoint licensing. IoT and OT device counts almost always come in higher than the first inventory suggests.
Phase 1: Stand up ClearPass and integrate identity (no enforcement)
Deploy the cluster, then connect ClearPass to your sources of truth without touching a single switch port's enforcement setting. That means:
- Identity stores — Active Directory / LDAP, and any SQL or external sources you authenticate against.
- Network device admission — add switches, WLAN controllers, and gateways as RADIUS clients with shared secrets.
- Profiling feeds — enable DHCP, HTTP user-agent, and SNMP-based device fingerprinting so ClearPass can classify endpoints automatically.
At the end of Phase 1 you have a working AAA brain that knows your users and is learning your devices, but is not yet the gatekeeper. Nothing is denied.
Phase 2: Monitor mode — watch everything, block nothing
This is the phase that saves the project. In ClearPass monitor mode, switches send authentication requests and ClearPass evaluates them against your draft policies, but the network does not act on the result. Every endpoint keeps its existing access while you collect the data.
Configure your switch ports for 802.1X (or MAB) in an open/monitor posture and watch the Access Tracker. You are looking for:
- Endpoints that authenticate cleanly via 802.1X (managed laptops, modern devices).
- Endpoints that fall back to MAC authentication (printers, cameras, OT).
- Endpoints that would have been rejected under your draft policy — these are the ones that would break.
Run monitor mode for at least one to two full business cycles. A week catches daily patterns; longer catches the contractor who only comes in on Thursdays and the lab gear that powers up monthly. Every "would-be reject" you resolve here is a help-desk ticket you never receive after cutover.
Phase 3: Role mapping and policy design
With real data in hand, build the enforcement model. ClearPass maps each authenticated endpoint to a role based on attributes — AD group, device category, certificate, location — and that role drives the enforcement result (VLAN assignment, downloadable ACL, or Aruba user role).
Keep the first role set small and unambiguous:
- Corporate-managed — domain-joined device + valid user → full access VLAN.
- BYOD — valid user, unmanaged device → restricted/internet VLAN.
- IoT/OT — MAC-authenticated, profiled category → segmented VLAN, locked-down ACL.
- Guest — sponsored or self-registered → captive portal, internet-only.
- Quarantine/remediation — failed posture or unknown → limited remediation network.
Resist the urge to model your entire org chart in v1. Five to seven roles cover most environments; you refine from there. Validate every role against the monitor-mode data so you know exactly which endpoints land where before anyone is enforced.
Phase 4: Staged enforcement
Now flip to enforcement — gradually. Never globally on day one. A safe rollout order:
- Pilot a low-risk site or VLAN (often IT's own floor) and confirm roles, VLANs, and ACLs behave as designed.
- Expand by building, floor, or switch stack, not all at once. Keep a documented rollback to the open/monitor port profile.
- Enforce wired and wireless on the same schedule per site so users get consistent behavior.
- Turn on OnGuard posture checks last, after authentication and role mapping are stable, so you are not debugging two new variables at once.
Keep a quarantine role with a clear remediation path throughout. The goal is that any failure degrades gracefully into limited access, never a hard lockout, while your team triages.
How Uniqcli helps
Uniqcli is an authorized HPE and HPE Aruba Networking reseller, and we scope NAC engagements end to end — not just ship a box. Tell us your endpoint count, identity environment, and switching/WLAN footprint and we will right-size the ClearPass appliance cluster (physical or virtual), the endpoint licensing, and the OnGuard/OnBoard/Guest modules you actually need, with TAA-compliant hardware where compliance is required.
On procurement, we sell through the vehicles public-sector and enterprise buyers already use — GSA, NASA SEWP V, and E-Rate for eligible K-12 and library projects — so your NAC purchase lands on a compliant, auditable contract instead of an open-market PO. Browse the product catalog, compare ClearPass options, or request a quote and we will turn around configuration and pricing quickly.
Beyond the buy, we support the rollout itself: deployment planning, the monitor-mode-first sequence described above, role and policy design review, and post-cutover support. The deliverable is a NAC platform that passes audit and does not page your help desk on go-live morning. Start at our products page to see the full Aruba security and networking line.
FAQ
What is ClearPass monitor mode and why does it matter? Monitor mode lets switches send authentication requests to ClearPass and lets ClearPass evaluate them against policy without enforcing the result. Endpoints keep their existing access, so you can see exactly which devices would be rejected before any port starts denying access. It is the single most important step for a safe NAC rollout.
How long should a ClearPass deployment take? Plan for weeks, not days. Phase 1 integration is quick, but you should run monitor mode for at least one to two full business cycles to capture intermittent users and devices, then enforce in staged waves by site. Rushing straight to enforcement is what breaks production.
Do I need 802.1X for every device? No. 802.1X is ideal for managed endpoints, but printers, cameras, and OT gear that cannot do 802.1X are handled with MAC authentication (MAB) and device profiling. ClearPass classifies them automatically and assigns a restricted role, which is exactly why profiling in Phase 1 matters.
How is ClearPass licensed and sized? You size the appliance and license by concurrent unique endpoints, not user count, plus optional modules (OnGuard for posture, OnBoard for BYOD certificates, Guest for visitor access). Buy headroom because IoT/OT counts usually exceed first estimates. We model this with you before quoting.
Sources: HPE Aruba Networking ClearPass Policy Manager, ClearPass Hardware Appliance Specifications, GSA IT contract vehicles.