Posture is a highly dynamic state-a device can move from "Healthy" to "Infected" in seconds. Role mapping occurs early in the service processing logic. If posture is evaluated during the role mapping phase, ClearPass may rely on a cached posture token from a previous session. Best practice is to perform posture evaluation within the Enforcement Rules . This ensures that the system checks the most recent "Health" status reported by the OnGuard agent at the exact moment the access decision is being made, preventing a non-compliant device from gaining access based on old data.

Best practice for profiling is to never grant full access by default . Instead, the enforcement policy should include a fallback rule for unprofiled devices. This rule assigns a "Limited Access" or "Quarantine" role that allows only DHCP and HTTP traffic. This allows the device to communicate just enough to trigger the profiler collectors (like DHCP fingerprinting), after which the device can be re-authenticated with the correct role.

When an OnGuard agent finishes its scan, it sends the results to ClearPass. If the status has changed (e.g., from "Healthy" to "Unhealthy"), ClearPass evaluates its Enforcement Policy and selects a profile that includes a CoA (Change of Authorization) action. ClearPass sends this Disconnect-Request to the switch (NAD), which drops the client session. The device's supplicant immediately reconnects, triggering a new authentication that places the user in the correct, updated role.

While RADIUS requests (for network access) are almost always found in the Access Tracker, TACACS+ requests (for device administration) that fail early in the process-such as those from an unauthorized source IP-may not appear there. In these cases, the Event Viewer is the correct diagnostic tool. The Event Viewer captures system-level errors, including "Unknown NAD" alerts for TACACS+ attempts, which will help the administrator identify why the request isn't being processed by a service.

This is the "Profile and Bounce" workflow.
* Initial connection: Device is unknown (IsProfiled=false) and restricted.
* The device sends a DHCP request , which is intercepted by the ClearPass Profiler.
* ClearPass identifies the device (e.g., "Company Laptop") and updates the database.
* To apply the new "Full Access" policy, ClearPass must trigger a RADIUS CoA Terminate-Session to the NAD.
* The device immediately reconnects and authenticates again; this time, ClearPass sees the updated profile and grants full access.