Selling Guide, Aruba ClearPass Policy Manager™ Version 6.0
THE ARUBA CLEARPASS POLICY MANAGER
COMPONENTS
The ClearPass Policy Manager provides identity- and device-based network
access services for leading multivendor wired, wireless or VPN infrastructures.
Policy management, endpoint profiling, guest access, RADIUS and TACACS+
services, device provisioning and registration, endpoint posture assessments,
and comprehensive reporting are built-in to automate the enforcement of
network access policies. The results are scalable and secure network access
that meets bring-your-own-device (BYOD) and IT-managed endpoint
requirements in a single platform.
ClearPass Policy Manager Virtual Appliance – available for VMware ESX or ESXi Server
4.0 or higher:
 CP-VA-500 – supports a maximum of 500 unique devices
 CP-VA-5K – supports a maximum of 5,000 unique devices
 CP-VA-25K – supports a maximum of 25,000 unique devices
ClearPass Policy Manager Hardware Appliances – optimized to run the entire ClearPass
software suite, the following options are available:
 CP-HW-500 – supports a maximum of 500 unique devices
 CP-HW-5K – supports a maximum of 5,000 unique devices.
 CP-HW-25K – supports a maximum of 25,000 unique devices
Application capacity for ClearPass Policy Manager
 ClearPass Onboard – LIC-CP-OB-XXX* (persistent) or SUB1/3/5-CP-OB-XXX* (subscription)
 ClearPass OnGuard – LIC-CP-OG-XXX* (persistent) or SUB1/3/5-CP-OG-XXX* (subscription)
 ClearPass Guest – LIC-CP-GM-XXX* (persistent) or SUB1/3/5-CP-GM-XXX* (subscription)
 Enterprise Bundle – LIC-CP-EN-XXX* (persistent) or SUB1/3/5-CP-EN-XXX* (subscription)
ClearPass Policy Manager advantages include network access privileges based
on user role, device type and posture of the endpoint, location, time-of-day,
and more. As a result, an employee using a corporate-owned device can be
given access to more sensitive data than when connected via a personallyowned device on the same network.
Built-in web-based management, with provisioning, registration, and guest
access portals ensure that IT staff and users are given a simple way to securely
maintain secure network access requirements for up to 1 million endpoints.
* Each application Part Number is available in the following increments (as indicated by the XXX): 100, 500, 1,000, 2,500,
5,000, 10,000, 25,000, 50,000 and 100,000 devices.
** Each application Subscription Part Number is available in one, three, or five year increments.
APPLICATIONS FOR THE CLEARPASS POLICY MANAGER
USE CASES FOR CLEARPASS POLICY MANAGER WITHIN VERTICALS
The ClearPass Policy Manager includes an enterprise starter bundle of
applications that deliver the following capabilities. Ordering additional capacity
allows organizations to right-size per use-case.
ClearPass is designed for organizations that need to modernize their Policy
Management/AAA/RADIUS infrastructure to deliver consistent and secure network
access for today’s evolving BYOD and mobility requirements.
 ClearPass Onboard – self-service provisioning for Windows, Mac OS X, iOS,
and Android devices including the configuration of 802.1X Wi-Fi and wired
settings, distribution and revocation of unique device credentials, and
certificate authority information.
 ClearPass OnGuard – performs advanced endpoint posture assessments, as
well as basic network access control (NAC) and network access protection
(NAP) health checks to ensure compliance and network safeguards before
devices connect.
 ClearPass Guest – simplified workflows that allow non-IT staff (sponsors) to
create temporary accounts for Wi-Fi and wired access. Includes delivery of
login credentials via SMS text message or email, branding, and more.
 ClearPass Enterprise Bundle – the ability to order capacity that can be
dynamically shared across the three applications.
Copyright © 2012 Aruba Networks Inc.
VERTICAL
FINANCE
HIGHER
EDUCATION
ENTERPRISE
K-12
USE CASE
CUSTOMERS
Policy-based differentiated access, AAA
services, BYOD, compliance archive and
reporting
Policy-based differentiated access (users
and location), increased visibility/control
for identifying compliance violations,
Guest access, AAA
Policy-based differentiated access, AAA,
NAC, BYOD, Guest access, remote
scalability, visibility and troubleshooting
Policy-based differentiated access, AAA,
NAC for student owned BYOD devices
WorldPay, Sun Life, Blue
Cross Blue Shield, Viking
Global Investors
Loyola Law School, Johnson &
Wales University, Ningbo
University
SAP, Applied Materials,
Rolex, NY Times, Apple
Santa Barbara Unified,
Charlotte County Day School,
Ithaca City School District
Confidential. For Aruba Employees and Authorized Partners Only.
Selling Guide, Aruba ClearPass Policy Manager™ Version 6.0
QUALIFYING QUESTIONS
 Are you looking to replace your existing AAA/RADIUS server or NAC system?
 Have you considered supporting a BYOD initiative?
 Would you like greater visibility and control over who is accessing your
network and with what devices?
 Have you deployed a multivendor network for your wired and wireless access?
 What do you use for an identity store (Active Directory, LDAP, etc.)?
 Do you struggle with the complexities and IT cost of onboarding employeeowned devices onto your network?
 Do you currently support and/or are looking to support Windows (XP, Vista, 7),
Linux, Mac, iOS, Android?
 What is the total number of users and devices that you will be authenticating?
 Do you need to provide secure network access for partners, contractors, or
other visitors?
 Are you using or do you plan to use 802.1X? Is MAC address-based
authentication an acceptable method?
 Are you looking to require endpoint health checks for all computers?
 Will you need to replace an existing TACACS+ solution?
 Have you implemented an MDM solution, but require greater Wi-Fi security?
COMPETING AGAINST CISCO
ClearPass Policy
Manager
Cisco ISE
$$
$$$$
Admin GUI runs on single appliance
Yes
Cisco suggests separate
appliance < 2,000
endpoints
Designed for multivendor networks
Yes
Very limited
Supports TACACS+
Yes
No
Includes comprehensive visibility/compliance
reports
Yes
No
Built-in endpoint profiling
Yes
No
Onboarding application includes built-in CA
Yes
No
Microsoft NAP compliance
Yes
No
Supports multiple AD domains
Yes
No
Enterprise-grade clustering and HA
Yes
Very limited
Customizable/scalable guest portal
Yes
Very limited
Cost
HANDLING OBJECTIONS
DIFFERENTIATION
S: Network access security and BYOD are too difficult to deploy.
A: Aruba’s ClearPass is a flexible and easy to maintain solution that includes
intuitive wizards, user and device visibility, and deployment tools that drastically
reduce the complexity of set-up and ongoing usage.
1. Optimized for Secure BYOD – Comprehensive onboarding, device registration, and
policy creation with enforcement for any device on any network.
2. Innovative Policy Management – combines AAA and NAC with identity, posture,
contextual information into a single set of consolidated policies using a single
management interface.
3. Open network architecture – supports industry standards to seamlessly integrate
with existing infrastructure from leading network and endpoint vendors across wired,
wireless and VPN connections.
4. Extensibility – supports multiple authentication protocols, identity stores, health
evaluation engines, and port and vulnerability scanning engines
5. Operational Efficiency – complete reporting, deployment, analysis and
troubleshooting tools deliver effective organization of network access transactions.
6. Scalability and Redundancy – easily cluster Policy Manager appliances via local and
remote network connections for enterprise-class availability.
7. Enterprise Packaging – each appliance comes with full featured policy management,
profiling, AAA services, reporting, guest access, onboarding, device registration, and
NAC for wireless, wired, and VPN networks.
S: Network access security isn’t a top priority for us right now.
A: BYOD initiatives, NAC, and context-aware authentication are all top security
considerations for organizations according to industry analysts. Deploying
ClearPass can help organizations prepare their network for mobility and BYOD,
while also addressing productivity, compliance, and security concerns.
Q: We already have a AAA solution, why do I need ClearPass Policy Manager?
A: Many legacy RADIUS and AAA servers are being replaced by their manufactures
and at the same time the requirements for AAA and NAC are changing to support
BYOD and enterprise-wide mobility. Aruba’s ClearPass is designed to support AAA
and policy management within a single solution to address user, device, and
network access security for BYOD in any multivendor environment.
Copyright © 2012 Aruba Networks Inc.
Confidential. For Aruba Employees and Authorized Partners Only.