Engagement Overview
The client operates a globally distributed, multi-vendor wired switching environment (Aruba, Cisco, and Meraki) and has an existing Aruba ClearPass deployment. This engagement requires a hands-on NAC specialist to design, configure, and implement Wired NAC for Guest Access across all three switch platforms, ensuring consistent policy enforcement, guest onboarding, and network segmentation regardless of underlying switch vendor.
Role Summary
We are seeking a Senior NAC/ClearPass Engineer with proven experience deploying wired 802.1X/MAC Authentication Bypass (MAB) guest access solutions in heterogeneous switching environments. The ideal candidate has delivered end-to-end NAC projects (not just administered an existing one) and is fluent in translating a single ClearPass policy model into vendor-specific switch configurations.
Key Responsibilities
• Design and implement wired guest NAC policies in Aruba ClearPass Policy Manager (service rules, enforcement profiles, role mapping, guest self-registration/sponsor workflows)
• Configure and validate 802.1X and MAB authentication on Aruba, Cisco (IOS/IOS-XE), and Meraki (dashboard-managed) switches to interoperate correctly with ClearPass RADIUS
• Build downloadable/dynamic ACLs, dynamic VLAN assignment, and CoA (Change of Authorization) enforcement across all three switch platforms, accounting for platform-specific RADIUS attribute and CoA support differences
• Develop and test guest captive portal / web-auth workflows integrated with the ClearPass Guest module
• Document per-vendor switch port configuration templates (global config, interface templates, AAA/RADIUS server config) for repeatable rollout across international sites
• Conduct site-by-site pilot testing and phased global rollout, accounting for regional network variances and change windows
• Identify and remediate gaps where Cisco or Meraki RADIUS/CoA feature support differs from Aruba's native integration (e.g., Meraki's limited CoA/dACL support vs. Aruba/Cisco)
• Produce as-built documentation, failure/fallback behavior (fail-open vs. fail-closed), and knowledge transfer materials for the client's network operations team
• Coordinate with client stakeholders on guest policy requirements (sponsor approval, self-registration, time-boxed access, bandwidth/role restrictions)
Required Qualifications
• 4+ years hands-on experience with Aruba ClearPass Policy Manager and ClearPass Guest (design, configuration, and troubleshooting — not just operational support)
• Demonstrated prior delivery of at least one full NAC implementation (wired and/or wireless) from design through production cutover
• Working knowledge of 802.1X, MAB, RADIUS (including CoA/RFC 3576), and dynamic VLAN/ACL enforcement
• Multi-vendor switch configuration experience across at least two of: Aruba (AOS-CX/AOS-Switch), Cisco IOS/IOS-XE, Meraki MS switches
• Understanding of Meraki dashboard-based RADIUS/NAC configuration and its feature limitations relative to Aruba/Cisco
• Experience supporting or designing for globally distributed sites (time zone coordination, regional change control, latency-aware RADIUS server placement)
• Strong documentation skills — able to produce switch config templates, policy diagrams, and test/validation plans
Preferred Qualifications
• Aruba ClearPass certification (ACCP or equivalent)
• Cisco Client exposure (useful for contrast/troubleshooting in mixed environments, even though ClearPass is the system of record here)
• Experience with ClearPass OnGuard, Onboard, or profiling modules
• Familiarity with guest access compliance requirements (data privacy, terms-of-use acceptance, session logging)