Aruba Networks ClearPass Guest 3.9, Deployment Manual

Page: 369 / 518

ClearPass Guest 3.9 | Deployment Guide Administrator Tasks | 369
Secondary network interfaces have the same name as the underlying physical interface, with a suffix such
as “:1”, “:2” and so on for each subsequent IP address created.
All secondary interfaces will be brought down if the corresponding physical interface is brought down.
Login Access Control
Authentication and role based access control is used to identify operators and their level of access to the
system. The default login access settings require HTTPS for both operators and guests.
For security reasons, it may be desirable to prevent guests from obtaining login access to the administrator
user interface. This may be achieved by first ensuring that guests and operators are using different network
address ranges, and then defining those networks in the
Network Login Access form. To access this form,
navigate to Administrator > Network Setup then click the Network Login Access command link.
The login access rules that have been defined will only apply to the components of the system that require
an operator login. Guest specific pages that do not require an operator login are not affected by any allow/
deny rules and are always available, regardless of the IP address used to access them.
The Network Login Access form also controls the access restrictions used for SSH console access, if it is
enabled. See “Changing Network Security Settings” in this chapter for more information about
remote console access via SSH.
The ‘Allowed Access’ and ‘Denied Access’ fields are access control lists that determine if an operator is
permitted to view the login page. You can specify multiple IP addresses and networks, one per line, using
the following syntax:

1.2.3.4 – IP address

1.2.3.4/24 – IP address with network prefix length

1.2.3.4/255.255.255.0 – IP address with explicit network mask