ClearPass Profiling is a foundational feature used to gain visibility into every device on the network. It uses various "collectors" (such as DHCP fingerprints, HTTP User-Agents, and MAC OUIs) to determine the Category, OS Family, and Name of an endpoint. In a high-density environment like a university, profiling allows administrators to generate reports on specific device types. When an upgrade is required for a specific model (e.g., a specific version of Android or a certain laptop brand), the administrator can instantly see exactly how many of those devices are currently active, allowing for better capacity planning and impact analysis.

Custom Operator Profiles (which define what a Guest administrator can see and do) are mapped to users during their login to the ClearPass Guest/Workflows interface. For a new profile to be active, the administrator must navigate to the Guest Operator Login policy and add a rule that assigns that specific profile based on the user's ClearPass Role. Without this mapping in the login policy, the system will fall back to a default profile or deny access.

When a guest is redirected to the captive portal, their browser sends an HTTP Get request. Included in the headers of this request is the User-Agent string (e.g., Mozilla/5.0 (iPhone; CPU iPhone OS 17_0...)).
ClearPass Guest parses this string to identify the specific OS and browser version. This information is then shared with the Policy Manager to update the endpoint database, providing immediate profiling context even before the user logs in.

Unlike agent-based solutions where the client initiates contact, Agentless OnGuard requires ClearPass to
"reach out" to the Windows endpoint using WMI and SMB. For ClearPass to have the necessary permissions to perform these remote administrative tasks on domain-joined machines, the ClearPass Policy Manager server must itself be joined to the Active Directory domain . This allows the server to use domain administrator or service account credentials to authenticate against the target endpoints.

Communication between the OnGuard agent and ClearPass requires specific firewall ports to be open. TCP Port 443 (HTTPS) is used for the initial control channel and software updates. TCP Port 6658 is the proprietary port used for the agent's "heartbeat," which provides real-time health updates and session monitoring. If either port is blocked, the agent will appear offline or fail to report its posture status.