Skip to content

Aruba ClearPass

The RTA is a headless Linux appliance with no 802.1X supplicant, no domain membership, and no NAC agent. On a ClearPass-controlled network it will be denied, quarantined, or placed in a remediation VLAN with no egress, and will never reach the firewall.

Note

For general background on why NAC blocks RTAs and what the fix looks like across vendors, see the NAC overview and the full troubleshooting background.

The resolution is three steps: allowlist the appliance MAC address via MAC Authentication Bypass (MAB), map it to a VLAN/role with outbound internet access, and ensure posture checks are not required for the device.

Choose how to apply the fix

  • GUI (Policy Manager)

    Full click-through in ClearPass Policy Manager: allowlist the MAC, set enforcement, bypass posture, and verify in Access Tracker.

  • CLI (REST API)

    Script the MAC allowlist step with curl against the ClearPass REST API (endpoints repository or static host list); enforcement stays in Policy Manager.

  • AI assistant (LLM)

    A copy-paste prompt that has your AI assistant walk the Policy Manager configuration with you, pausing for your confirmation before anything is saved.