ISE vs Aruba Clear Pass vs Forescout

[MrBeginner]

Hi All,

I would like to know the comparison NAC solution between ISE and aruba and forescout .

I tested Aruba Clear Pass for my work-group PC authentication with Certificate. In Aruba ClearPass, I need to create local user in clearpass and download this profile by using onboard function to install clients work Group PC.While i install onboard profile in clients PC ,it is auto install clearpass self-sign user Cert and my external MS root cert in to my PC. After that i can use 802.1x authentication. We need to pay per user for onboarding license if we want to authenticate workgroup PC.

I would like to know ISE and Forescout also same this scenario ? we need to buy extra license for this ?

ISE and forescout can handle work-group PCs also to authenticate 802.1x with certificate ?

if we are suing cert ,it is check root cert and user cert ? because some time i create csr manually and install in workgroup PC and test. it always show user not found error. It is always check in AD user .Let me know why ?

[Arne Bier · Accepted solution]

Hi @MrBeginner 

I have no comments on Forescout.  Clearpass and ISE are on par in terms of 802.1X processing. 

If you use ISE to build a BYOD solution then you need 1 base license and 1 Plus license to do BYOD. If you push a client cert to a device via other means then all you need is 1 Base License if the ISE authentication is successful.

Whether the windows PC is domain joined or in a workgroup should not make a difference. The network authentication using the Windows Supplicant will support either machine, user or both.

ISE does not have to perform an AD lookup if you are performing a certification authentication. It's an optional check.

And yes, every client cert is validated with the Trusted CA cert chain installed in ISE.

Checkout www.labminutes.com for ISE 802.1X processing.