A company needs to enforce 802.1X authentication for its Windows domain computers to HPE Aruba Networking ClearPass Policy Manager (CPPM). The company needs the computers to authenticate as both machines and users in the same session. Which authentication method should you set up on CPPM?

TEAP (Tunneled EAP) is the correct authentication method as it is specifically designed to support EAP chaining. This feature allows for multiple authentication transactions to occur within a single, secure TLS tunnel. For this scenario, TEAP can be configured to first authenticate the Windows machine (e.g., using a machine certificate via EAP-TLS) and then authenticate the logged-in user (e.g., using credentials via EAP-MSCHAPv2). This entire sequence happens within one EAP session, fulfilling the requirement to authenticate both the computer and the user simultaneously. HPE Aruba Networking ClearPass fully supports TEAP for this use case.

B. PEAP MSCHAPv2: This method authenticates either the user or the machine in a single session, but not both. Machine and user authentications are separate RADIUS sessions.
C. EAP-TTLS: While it creates a tunnel like PEAP, the native Windows supplicant does not support chaining both machine and user authentication within a single session.
D. EAP-TLS: This method uses certificates to authenticate a single entity per session—either the machine or the user—but cannot authenticate both in the same transaction.

1. IETF RFC 7170

Tunnel Extensible Authentication Protocol (TEAP) Version 1:

Section 1

Introduction

Paragraph 3: "TEAP also provides for the 'chaining' of multiple EAP methods within a single EAP conversation. This allows TEAP to support deployments that require combined user and machine authentication in a single EAP conversation..."

DOI: https://doi.org/10.17487/RFC7170

2. Aruba Networks Official Documentation

ClearPass TEAP for Windows 10 Configuration Guide:

Page 3

Introduction: "TEAP allows for EAP Chaining which allows for both the machine and the user to be authenticated in a single EAP session. This is useful for policy decisions as both the machine and user are known." This document provides a step-by-step guide for the exact scenario described in the question.

3. Microsoft Documentation

Extensible Authentication Protocol (EAP) for network access:

Section: EAP-TEAP: "Supports EAP chaining. TEAP can establish a secure tunnel and authenticate the client and the server. It can also authenticate the user inside the tunnel." This confirms native support and functionality in Windows operating systems.