The Enforcement Policy is the logic engine of ClearPass. While the "Service" selects which policy to run, and the "Profile" contains the actual attributes (like VLANs) to send, the Enforcement Policy Rules are responsible for the evaluation. These rules use "If/Then" logic to compare the gathered context-such as user role, device type, and OnGuard posture status-against predefined security criteria to determine the final access level.

The ClearPass Insight Dashboard provides several quick-filter options (e.g., Today, Last 24 Hours, Last 7 Days). For a specific one-month range that doesn't fit these presets, the analyst must use the "Custom" filter.
This opens a date picker where they can define the exact start and end dates for the data they wish to review across all widgets and reports.

RadSec (RADIUS over TLS) replaces the traditional MD5-based Pre-Shared Key (PSK) with a secure TLS tunnel. While the UI might show a placeholder "radsec" PSK, the actual security relies on Mutual Authentication via certificates. For the TLS handshake to succeed, ClearPass must trust the Certificate Authority (CA) that signed the NAD's certificate, and vice versa. Therefore, verifying that the NAD's trust chain is uploaded to the ClearPass Trust List is the most critical step for a successful connection.

In OnGuard, you can configure Post-Auth Actions . When a device fails compliance, simply telling the user is often not enough. By choosing an action to "Restart the session," ClearPass sends a RADIUS CoA (Change of Authorization) to the switch or controller, which bounces the user's connection. This forces the device to re-authenticate, at which point the new "Unhealthy" status will trigger a restricted or quarantine policy.

In ClearPass service configuration, the Posture tab is not visible by default. To enable health check logic, the administrator must check the "Posture Compliance" box in the Service tab. This adds the Posture configuration screen where the administrator can select the specific Posture Policy that will evaluate the reports sent by the OnGuard agents.