Pros and Cons of Aruba ClearPass 2024 (2024)

Reliable

Informative dashboards

Priced well

Integrates into non-aruba platforms

Easy to install patches

Little downtime

The user interface is outdated

Support is not as responsive as it used to be

I'd like to be able to build dashboards

Wireless authentication with EAP-TLS.

Wireless guest access with self-registration.

Interfacing with Aruba wireless controllers.

Very good logging/troubleshooting.

Wired NAC with non-Aruba switches is clunky and hard.

Configuration is not intuitive.

Training materials online are practically nonexistent.

Even when given on official training courses, training materials are terrible.

wide range of compatible devices

have an easy-to-understand and hierarchical rule-writing structure

easy-to-use interface and extensive documentation

seamless MS AD integration

Going to the end of the page to edit the rules and save them later causes problems.

An AND operation can be performed within a rule, but an OR operation cannot. therefore having to write too many rules

The license structure seems very complex at first.

Network access control

Guest network access

Network segmentation

More intuitive upgrade process.

Add in-service software upgrades.

Use common syntax across the various systems within Clearpass. For instance, monitoring view and guest view use different syntax's.

Heavily extensible logic that can solve a myriad of authentication and authorization scenarios.

Extensive logging for troubleshooting services and device connections

Standards based and compatible with nearly any device capable of 802.1X.

Good user base for support and solutions.

Policy manager and guest sections of ClearPass are disjointed, and where they overlap isn't readily apparent.

Some changes require a full service restart which can take 5 to 10 minutes.

Documentation is a bit dense and hard to navigate.

It does a great job of authenticating users and eliminating the need for us to run multiple SSIDs to “manually” separate users.

Integrates well with AD to support assigning users to segments based on security group membership

It integrates well with our Aruba controller environment

We’d like to see some logic being applied to the VLAN assignment so that we could do it based on more than one condition - for example, membership in a security group and operating system.

You can use ClearPass authenticate using wired and wireless network devices. This is helpful that you don't have to have multiple systems to accomplish this.

Because devices can have different purposes Clearpass can configure groups that will specify what access they have. You can use parameters such as vendor or mac address so clearpass know what group to push them to.

It is very easy to view device logs. This is really helpful to troubleshoot auth issues. Once you find the device Clearpass provides more than enough info to know what the issue is and to fix it.

Getting data out of ClearPass is difficult. You can get some with SNMP but he API is lacking. There is only a limited amount of info that you can get from it. Even some data that shows up in ClearPass Insight is not available to import into a 3rd party application.

In the past, if you have hardware/software issues you could troubleshoot them yourself through the CLI in a Linux type interface but now they have locked everything down and it makes troubleshooting difficult. You have to rely on them for everything. As a person who likes to understand the ins and outs of the systems I manage it is somewhat frustrating.

Steep learning curve, although support can assist and their forums like airheads can be helpful. This is a complex system and can take a while to grasp how everything works and integrates.

Granularity in access.

Multiple sources of authentication.

Manage guest and defined users with the same tool.

Nested configurations can get tiresome and hard to follow.

More robust reporting.

Add the ability to search MAC addresses including colons and periods.