A company has Aruba Mobility Controllers (MCs), Aruba campus APs, and ArubaOS-Switches. The company plans to use ClearPass Policy Manager (CPPM) to…

To classify endpoints using HTTP User-Agent strings, ClearPass Policy Manager (CPPM) needs visibility into the HTTP traffic from those endpoints. For devices connected to a switch, the standard and most efficient method to provide this visibility is using sFlow. The ArubaOS-Switch can be configured to sample packets on edge ports and send the sFlow data to CPPM, which acts as an sFlow collector. CPPM's profiling engine then analyzes these samples, extracts the HTTP User-Agent string from the packet headers, and uses this information to accurately classify the device type (e.g., Windows, macOS, iPhone).

A. While switches have some fingerprinting capabilities, they rely on sending protocol information like HTTP User-Agents to an external collector like ClearPass for detailed analysis.
B. Remote mirroring (RSPAN) sends full packet captures, which is highly inefficient for this purpose and would overwhelm CPPM. sFlow sends only sampled data, which is sufficient for profiling.
D. CPPM appliances are not designed with dedicated SPAN/mirror ports to receive traffic from multiple switches. This is not a scalable or standard architecture for device profiling.

ClearPass Policy Manager 6.9 User Guide, page 1, "Device Profiling using sFlow". The guide states, "ClearPass can be configured as an sFlow collector. When network devices are configured to send sFlow packets to ClearPass, the information from these packets is used for device profiling."

ArubaOS-Switch Management and Configuration Guide for K.16.02, page 561, "sFlow". The guide details how to configure sFlow on the switch and specify a collector's IP address, which in this scenario would be the CPPM server.