Clearpass 6.X Tech Note: Clearpass Enterprise Mobility Management Integration November 2015 V5
Total Page:16
File Type:pdf, Size:1020Kb
ClearPass 6.x Tech Note: ClearPass Enterprise Mobility Management Integration November 2015 V5 Version Date Modified By Comments 1.0 April 2013 Danny Jump Initial Published Version 2.0 Oct 2013 Danny Jump Add XenMobile support and minor Updates 3.0 Oct 2014 Danny Jump Added SAP Afaria, a new section on SCEP Enrollment for MobileIron/Airwatch and ‘other’ minor updates 4.0 Sept 2015 Danny Jump Added details of BlackBerry BES10 server integration and minor updates for CPPM 6.5 5.0 Nov 2015 Danny Jump Added integration with Globo “Go! Enterprise MDM” ClearPass 6.x Tech Note: ClearPass and EMM Integration Guide November 2015 - V5 Table of Contents Table of Contents ............................................................................................................................................ 2 Table of Figures ............................................................................................................................................... 3 Introduction ........................................................................................................................................... 6 EMM Integration ................................................................................................................................... 7 Configuration of EMM Vendors ................................................................................................................ 10 Normalized Dataset ...................................................................................................................................... 12 Using EMM Data for Network Enforcement ......................................................................................... 14 Endpoint Data ................................................................................................................................................................ 14 Jail broken or Rooted-Device Detected .............................................................................................................. 15 Blacklisted App Detected .......................................................................................................................................... 17 Corporate Issued vs. Employee Liable Device ................................................................................................. 18 EMM Agent Removed ................................................................................................................................................. 20 Profile Data ..................................................................................................................................................................... 21 iPad vs iPhone/iPod Network Access ................................................................................................................. 22 Quarantine Device Type ............................................................................................................................................ 23 Managing Endpoint Data .......................................................................................................................................... 24 Supported EMM Vendors s/w Versions ................................................................................................. 25 Enable / Disable Individual MDM Context Servers ....................................................................................... 25 AirWatch (Acquired by VMware in January 2014) ....................................................................................... 26 AirWatch Endpoint Attributes ............................................................................................................................... 28 JAMF Configuration ..................................................................................................................................................... 29 JAMF Endpoint Attributes ........................................................................................................................................ 30 MaaS360 Configuration (Acquired by IBM in December 2013) .............................................................. 31 MaaS360 Endpoint Attributes ................................................................................................................................ 32 MobileIron Configuration ......................................................................................................................................... 33 MobileIron Endpoint Attributes ............................................................................................................................ 34 SOTI Configuration ...................................................................................................................................................... 35 SOTI Endpoint Attributes ......................................................................................................................................... 36 XenMobile Configuration .......................................................................................................................................... 37 Xenprise Endpoint Attributes ................................................................................................................................. 38 SAP Afaria Configuration .......................................................................................................................................... 39 Afaria Endpoint Attributes ....................................................................................................................................... 40 Blackberry Enterprise Server v10 ........................................................................................................................ 41 BES10 Configuration ................................................................................................................................................................. 41 ClearPass Configuration for BESv10 .................................................................................................................................. 44 Globo GO! Enterprise v3.9.2 .................................................................................................................................... 47 Globo Configuration .................................................................................................................................................................. 48 ClearPass Configuration for Globo GO! ............................................................................................................................. 52 CPPM & MDM/EMM SCEP Setup .................................................................................................... 55 CPPM SCEP Configuration .......................................................................................................................... 55 EMM SCEP Configuration ............................................................................................................................ 56 AirWatch SCEP Configuration ................................................................................................................................. 56 Configure SCEP in AirWatch .................................................................................................................................... 56 Airwatch/SCEP-Server/Endpoint Dataflow ..................................................................................................... 61 Generating a SCEP Test Request in Airwatch .................................................................................................. 61 MobileIron SCEP Configuration ............................................................................................................................. 62 Aruba an HP Enterprise company 2 ClearPass 6.x Tech Note: ClearPass and EMM Integration Guide November 2015 - V5 Configure SCEP in MobileIron ................................................................................................................................ 62 Setting SCEP policy against EMM endpoint ...................................................................................................... 65 MobileIron/SCEP-Server/Endpoint Dataflow ................................................................................................. 68 Deleting Client TLS Certificates on MobileIron ............................................................................................... 69 Troubleshooting ................................................................................................................................ 70 Checking Logs files in CPPM ...................................................................................................................... 71 General SCEP/EST – Licensing – Q&A…. ............................................................................................................ 73 Caveats/Queries for CPPM SCEP/EST ................................................................................................................ 73 Table of Figures Figure 1 - Basic endpoint smart-device information ..................................................................................... 7 Figure 2 - Additional endpoint information retrieved thru DHCP fingerprinting ............................ 8 Figure 3 - Endpoint plus EMM attributes ...........................................................................................................