Solutions Tech Lab

Total Posts

Enhancing Security Visibility with ClearPass Email Notifications

Published by

Ariya Parsamanesh

on

Updated on

This technote builds upon the previous one, where we configured a messaging server to enable the ClearPass cluster to send email notifications. In this follow-up, we explore two specific security-related use cases that leverage email notification.

  • Access Monitoring for Individuals of Interest – Grant network access to designated individuals while simultaneously receiving email notification as soon as they are connected. These alerts include location data based on the access points to which they connect, allowing the organization to monitor movement and take appropriate action as needed
  • Quarantine Notification for Insecure Devices – Automatically send an email containing device details and location when a client, device, or IoT entity is assigned a quarantine role due to the use of insecure TLS version 1.0. The device is redirected to a quarantine captive portal, where it receives restricted access.
Email Notification Enf Profile v0.2Download

Discover more from Solutions Tech Lab

Subscribe to get the latest posts sent to your email.

3 responses to “Enhancing Security Visibility with ClearPass Email Notifications”

  1. Picard Avatar
    Picard

    This looks great and I’ve followed every step, but never get an email after authentication and no events in event viewer

    Reply
    1. Ariya Parsamanesh Avatar
      Ariya Parsamanesh

      If your test email also does not work then it is something fundamental, perhaps it is best to reach out to HPE Networking TAC or use Airheads community to explore if others have seen this behaviour.

      Reply
    2. Jim Grumbles Avatar
      Jim Grumbles

      I’m having the same issue. Oddly enough when I go to the Access Tracker entry, click Change Status, select the same Context Server Action and Context Server I use in the Enforcement Profile and click Submit the email actually generates.

      Alternatively what I’ve done for now is configure an Alert in the Insight module to send an email every time the Enforcement Profile with the email action is being used, even if the email action isn’t working. It won’t be instantaneous or contain any specific information but you can at least tell when the specific Enforcement Profile that is *supposed* to send an email was at least used by ClearPass when authenticating a client.

      Reply

Leave a Reply

Previous Post
Next Post