Notes from work on infrastructure other people depend on. Written when there is an incident worth recording or a configuration worth remembering, not on a schedule.
ClearPass's live monitoring screen (Monitoring > Live Monitoring > Access Tracker) that shows each authentication transaction together with all the data CPPM recorded for it.
Read the note
Notes written for myself six months from now, when the same incident comes back.
An EAP method that builds a TLS tunnel (only the server presents a certificate) and then authenticates inside it, usually with MSCHAPv2 against Active Directory accounts.
The AOS-CX feature that locks a port by MAC address: what it blocks, and four places where it silently does not protect — including the configuration being wiped when the port is added to a trunk.
The general framework for an external system to write data into ClearPass endpoints: custom endpoint attributes, an Operator Profile that limits permissions, an API Client using OAuth 2.0 client credentials, and Insight must be enabled.
802.1X and MAC-Auth parameters on AOS-CX switches whose defaults easily cause incidents (each port accepts only 1 client, a port nobody has authenticated on blocks even Wake-on-LAN, MAC-Auth excludes port security and LACP), the default timer table, and the commands to view, kick and force re-authentication of a client.
Backing up, patching, rolling back and upgrading CPPM from the appadmin shell, with a table of data-destroying commands and the defaults that lose data unless you pass a flag.