A customer would like to allow their IT Helpdesk to configure loT devices to connect lo a single SSID using a unique PSK that other devices cannot use. Which solution would you recommend?

The customer requires a solution for a Helpdesk to manage unique Pre-Shared Keys (PSKs) for IoT devices on a single SSID, ensuring each key is tied to a specific device. Aruba ClearPass Policy Manager is the ideal Network Access Control (NAC) solution for this scenario. ClearPass supports Multiple Pre-Shared Key (MPSK), allowing the creation of a unique key for each device. Crucially, it can enforce policies that bind a specific PSK to a device's MAC address, fulfilling the requirement that the key "cannot be used" by other devices. ClearPass also provides customizable operator profiles, which allow for delegating the task of device onboarding and PSK management to the Helpdesk in a secure, controlled manner.

A. MPSK AES with MAC Auth: This describes the technical mechanisms used but is not a complete solution. It does not specify the management platform (like ClearPass) that the Helpdesk would use to manage the keys and policies.
B. MPSK Local: This method involves storing keys directly on the network infrastructure (controllers or APs). It is not a scalable or manageable solution for a Helpdesk, as it lacks a centralized administrative interface.
C. MPSK AES with Cloud Auth: While Aruba Central's Cloud Auth is a viable solution that supports MPSK, ClearPass is Aruba's specialized, feature-rich NAC platform offering more granular policy control and customizable delegated administration for Helpdesk roles.

1. Aruba Solution Overview: Securing IoT with Aruba ClearPass: This document states, "ClearPass can also be used to generate a unique pre-shared key (PSK) for each IoT device... This approach, known as MPSK, is far more secure than using a single PSK for all devices." It also details how ClearPass Onboard and operator profiles can be used to delegate device management. (Refer to sections on IoT Onboarding and MPSK).

2. ArubaOS 8.10.0.x User Guide: In the chapter on "MPSK Security," the guide specifies the implementation methods: "MPSK can be configured using a local key server on the managed device or using an external server like ClearPass Policy Manager (CPPM)." This explicitly positions ClearPass as the external server solution for managing MPSK.

3. Aruba ClearPass Policy Manager Data Sheet: The data sheet highlights its capability for securing devices that do not support 802.1X: "For devices that do not support 802.1X, like some IoT and OT devices, ClearPass can use a device’s MAC address for authentication and authorization. Unique pre-shared keys (MPSK) can also be used to provide more secure access than a single PSK." (Refer to section on "Comprehensive Policy Enforcement").