An IT technician is tasked with ensuring that the Network Access Device's (NAD) trust chain is properly configured on ClearPass. They select RadSec…

When configuring RadSec (RADIUS over TLS), the Pre-Shared Key (PSK) is not the primary security mechanism. RadSec relies on TLS, which uses certificates to establish a secure and encrypted tunnel. The most critical step is to ensure that the certificate authority that signed the Network Access Device's (NAD) certificate is included in ClearPass's trust list. This allows ClearPass to validate the NAD's identity and establish a trusted TLS session. The 'radsec' PSK is often a placeholder and is superseded by the certificate-based trust.

A. The PSK field is largely irrelevant for RadSec's certificate-based authentication and encryption; changing it does not establish the required trust.

B. Rebooting the network device is a final activation step, not the critical configuration step for establishing the trust relationship in ClearPass.

- Aruba ClearPass Policy Manager 6.9 User Guide, page 563, "Configuring RadSec in ClearPass": "For RadSec, you must configure a trust list that includes the CA certificate that signed the RadSec server certificate on the network device." This highlights the necessity of the trust chain.

- RFC 6614, "Transport Layer Security (TLS) Encryption for RADIUS", Section 2.3: "The underlying TLS implementation provides for server authentication, and optionally for client authentication." This confirms the reliance on certificate-based authentication.