A company has HPE Aruba Networking APs and AOS-CX switches, as well as HPE Aruba Networking ClearPass. The company wants CPPM to have HTTP User- Agent strings to use in profiling devices. What can you do to support these requirements?

The most effective and standard method for ClearPass Policy Manager (CPPM) to obtain HTTP User-Agent strings is by using a captive portal redirect. When a new or unprofiled device connects, the network access device (HPE Aruba Networking AP or AOS-CX switch) is configured with a role that intercepts the client's initial HTTP/HTTPS traffic. This traffic is then redirected to a web page hosted on ClearPass, typically the Guest portal. During this redirection process, the client's browser sends an HTTP request to CPPM, which includes the User-Agent header. ClearPass captures this header and uses the information to accurately profile the device.

A. The IP helper-address feature forwards broadcast traffic, primarily DHCP requests, to a specified server. While this is used for DHCP-based profiling, it does not capture HTTP traffic or User-Agent strings.
B. Scheduling subnet scans uses active probes (like Nmap) to identify device characteristics such as open ports and OS type. This method does not involve intercepting HTTP requests from the client.
C. Mirroring all client HTTP traffic to CPPM is highly inefficient, not scalable, and would generate an excessive amount of traffic, likely overwhelming the ClearPass server. It is not a designed profiling method.

1. HPE Aruba Networking, "ClearPass Policy Manager 6.11 User Guide" (December 2022): In the section on Endpoint Profiling, it describes the HTTP collector. It states, "The HTTP collector extracts the User-Agent string from the HTTP session of a device that is redirected to ClearPass for Web-based Authentication." This confirms that a redirect is the intended mechanism. (Reference: Chapter "Endpoint Profiling" > Section "Endpoint Profiling Collectors").

2. HPE Aruba Networking, "ArubaOS-CX 10.11 Port Access Security Guide" (May 2023): In the chapter on "Captive Portal," the guide details configuring a captive-portal-profile on AOS-CX switches. This profile is applied to a user role to redirect a client's web browser to an external server, such as ClearPass, for authentication or device fingerprinting. (Reference: Chapter "Captive Portal" > Section "Configuring Captive Portal").

3. HPE Aruba Networking, "ClearPass Deployment Guide" (Version 2.0, March 2019): This guide outlines profiling strategies. In Section 3.2, "Profiling Collectors," it explains that the HTTP collector works by "extracting the User-Agent string from the HTTP session of a device that is redirected to ClearPass for Web-based Authentication." This explicitly links the redirect mechanism to capturing the User-Agent string. (Reference: Section 3.2, "Profiling Collectors," page 19).