A network administrator is configuring a new Network Access Device (NAD) in ClearPass. They select RadSec for the network device and notice that the PSK field automatically changes to ‘radsec’ regardless of what is typed. What is the most likely reason for this behavior?

RadSec (RADIUS over TLS) does not use a Pre-Shared Key (PSK) for security; it relies on TLS certificates for mutual authentication and encryption between the NAD and the ClearPass server. When RadSec is selected in the ClearPass UI, the PSK field is no longer relevant. The system automatically populates it with the fixed, non-editable string 'radsec' as a placeholder to indicate that a traditional shared secret is not being used. While the option is poorly worded (RadSec does not require a PSK), it is the only choice that correctly links the behavior to the RadSec protocol itself.

B. The network device is not compatible with RadSec configuration: This is incorrect. The UI behavior is a function of the protocol selected within ClearPass, not the compatibility of the external device.
C. The administrator’s user permissions restrict changes to the PSK field: This is incorrect. The field becomes non-editable due to the selection of the RadSec protocol, a system-wide behavior unrelated to user-specific permissions.

- Aruba ClearPass Policy Manager 6.11 User Guide, page 111, "Adding and Modifying Network Devices". The guide notes, "If you select RadSec for the network device, the Shared Secret field is automatically populated with the string 'radsec' and cannot be changed. RadSec uses TLS for authentication and not a shared secret."