Aruba ClearPass alternatives: replacing on-premise NAC with cloud RADIUS

For most multi-site estates, the strongest ClearPass alternative is cloud RADIUS. Purple runs EAP-TLS authentication against Microsoft Entra ID, Okta or Google Workspace on the access points you already own. It carries 99.999% platform uptime. Cloud RADIUS delivers network access control without hosting on-premise RADIUS appliances.

Should you replace ClearPass with cloud RADIUS?

Yes, if you run WiFi across many sites and your identities already live in the cloud. Aruba ClearPass Policy Manager is a mature network access control (NAC) platform. NAC decides which people and devices join the network, and which segment they land on. ClearPass makes that decision on appliances you host, size, patch and refresh.

Cloud RADIUS makes the same decision as a service. RADIUS is the protocol your access points use to ask a server whether a device may join (RFC 2865). IEEE 802.1X is the port-based access standard that carries that exchange between device, access point and server. With cloud RADIUS, the access point, the SSID and the 802.1X exchange stay the same. Only the server answering changes.

The verdict for Purple holds under these conditions:

• Your identities live in Microsoft Entra ID, Okta or Google Workspace.
• Your estate runs more than one access point vendor, or may do after the next refresh.
• Your team would rather manage policy than manage RADIUS servers.

Cloud RADIUS removes the appliance estate without removing control, providing centralized policy management across all sites.

{"items":[{"value":"99.999%","label":"Platform uptime SLA","note":"Purple Access"},{"value":"99.999%","label":"Purple platform uptime"},{"value":"80,000+","label":"venues in 90 countries"},{"value":"5,000","label":"JPMorgan branches on Purple","note":"Staff WiFi"}]}

Purple runs the largest cloud RADIUS in the world. RADIUS migration is usually a weekend exercise, and you replace no access points.

Which criteria decide a ClearPass replacement?

We compared options that network teams shortlist when ClearPass appliances or licences come up for renewal:

• Aruba ClearPass Policy Manager, on-premise. The status quo for many HPE Aruba estates, deployed as hardware or virtual appliances.
• FreeRADIUS, self-hosted. The open-source RADIUS server (freeradius.org) that teams with strong Linux skills often consider.
• Purple cloud RADIUS. The authentication engine behind the secure network in Purple Access.

We left out NAC sold as part of a single hardware vendor's management cloud. Your estate runs more than one vendor, so a single-vendor policy engine only solves part of the problem.

The criteria that decide the choice for multi-site WiFi:

1. Operating model. Who hosts, patches and upgrades the authentication servers.
2. Availability. How uptime is achieved, and who carries the commitment.
3. Access point fit. Which access points work without change across Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist and Ubiquiti UniFi.
4. Identity. Where the directory lives, and how joiners, movers and leavers reach network policy.
5. Certificate-based access. Support for EAP-TLS (RFC 5216), where each device proves itself with a certificate rather than a password. This criterion also covers who runs the public key infrastructure (PKI).
6. Network scope. Whether one platform covers open, secure and xPSK networks.

Running cost and migration effort get their own sections below. Each option is scored only on what its own public documentation states.

{"tone":"note","title":"Scope of this comparison","text":"This guide covers WiFi authentication. Wired 802.1X on switch ports, TACACS+ device administration and endpoint posture agents are ClearPass capabilities outside that scope, and we flag them where they change the answer."}

How do ClearPass alternatives compare?

{"caption":"ClearPass alternatives compared on the criteria that decide a multi-site WiFi estate","asOf":"2026-06-10","columns":[{"key":"c","label":"Criterion"},{"key":"cp","label":"Aruba ClearPass (on-premise)"},{"key":"fr","label":"FreeRADIUS (self-hosted)"},{"key":"pa","label":"Purple cloud RADIUS","highlight":true}],"rows":[["Where it runs","Hardware or virtual appliances in your data centre","Linux servers you build and host","Cloud-native service run by Purple; nothing on site"],["Patching and upgrades","Your team schedules each release and patch","Your team patches the OS and packages","Purple updates the platform, which runs at 99.999% uptime"],["Availability","Publisher and subscriber cluster you size and host","Redundant servers and failover you design","99.999% platform uptime"],["Access point fit","Standards-based RADIUS from multi-vendor network devices","Standards-based RADIUS from any network device","Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme, Fortinet"],["Identity sources","Active Directory, LDAP, SQL and token servers","LDAP, SQL and Kerberos modules you configure","Microsoft Entra ID, Okta, Google Workspace; joiners, movers and leavers flow from the IdP"],["EAP-TLS and certificates","Supported; Onboard module provisions device certificates","Supported; you run the PKI","Supported; certificates bound to IdP identity"],["Policy to VLAN","Enforcement profiles return RADIUS attributes","Policy files you write and test","Identity sets the VLAN through RADIUS attributes"],["Networks covered","Policy Manager plus Guest and Onboard modules","Authentication only; portal and PKI are separate builds","Open, secure and xPSK networks, plus Passpoint, on one platform"]],"footnote":"Scored from each option's own public documentation. Wired port enforcement, TACACS+ and posture agents sit outside this WiFi scope.","download":{"filename":"clearpass-alternatives-matrix.csv"}}

All options speak standard RADIUS, so none of them forces new access points. The differences sit above the protocol. ClearPass and FreeRADIUS both put the servers, the redundancy design and the patch cycle on your team. Purple takes all three off your team and commits to platform uptime.

Identity is the second divide. ClearPass and FreeRADIUS grew up around on-premise directories. Both can reach cloud identity, but you configure and maintain that link. Purple starts from Microsoft Entra ID, Okta or Google Workspace. A leaver disabled in the IdP loses network access without a separate change in the NAC.

Where does each option win?

Every option here brings different capabilities. The question is whether its design matches your estate.

Where ClearPass wins

Aruba ClearPass is designed around on-premise hardware deployments and legacy infrastructure requirements. Aruba documents wired 802.1X enforcement on switch ports, TACACS+ for switch and router administration, and OnGuard posture checks. A posture check inspects a device's security state, such as antivirus status, before admitting it. If your security model depends on these capabilities from a central console, ClearPass covers that scope.

ClearPass also appeals to organizations with existing infrastructure investments. Teams with years of tuned enforcement services and trained ClearPass engineers face a switching cost. That cost is mostly policy translation, which the migration section below addresses.

Where FreeRADIUS wins

FreeRADIUS provides open-source flexibility and control. It is open source under the GPL, so there is no licence fee and you can read every line. It fits self-managed implementations run by teams fluent in Linux and RADIUS configuration.

The trade-off is that you build everything around it. That includes redundancy, a PKI for EAP-TLS, a captive portal for visitors and monitoring. No vendor carries an uptime commitment. At multi-site scale, that engineering time becomes the dominant cost.

Where Purple cloud RADIUS wins

Purple wins on multi-site, multi-vendor estates whose identity has moved to the cloud. You point each SSID at Purple from the console you already use. Those consoles include the Cisco Meraki Dashboard, HPE Aruba Networking Central, Juniper Mist and the UniFi Network application. Identity from your IdP sets the VLAN, and the same rule applies at every site.

It also delivers broad operational scope. Purple Access runs open, secure and xPSK networks on a single platform. The open network covers captive portal access and BYOD onboarding. The secure network covers EAP-TLS, IdP integration, Passpoint and cloud RADIUS. The xPSK network gives each device or resident its own key. On ClearPass, the equivalent spans Policy Manager plus separately licensed Guest and Onboard modules.

{"kind":"lanes","direction":"lr","caption":"On-premise ClearPass backhauls RADIUS to appliances you host; Purple answers the same 802.1X request from the cloud","alt":"Two lanes compare access points sending RADIUS over the WAN to a hosted ClearPass cluster and Active Directory with the same access points sending RADIUS to Purple cloud RADIUS, which checks the identity provider and returns a VLAN.","lanes":[{"id":"l1","label":"Today: on-premise ClearPass"},{"id":"l2","label":"After: Purple cloud RADIUS"}],"nodes":[{"id":"a1","label":"Access points","sub":"Aruba, Meraki, Ruckus, Mist, UniFi","lane":"l1","tone":"neutral"},{"id":"b1","label":"Site WAN or VPN","sub":"RADIUS backhauled to the data centre","lane":"l1","tone":"neutral"},{"id":"c1","label":"ClearPass cluster","sub":"Publisher and subscriber appliances you host","lane":"l1","tone":"neutral"},{"id":"d1","label":"Active Directory","sub":"On-premise directory and LDAP","lane":"l1","tone":"neutral"},{"id":"a2","label":"Access points","sub":"Same hardware, same SSIDs","lane":"l2","tone":"neutral"},{"id":"c2","label":"Purple cloud RADIUS","sub":"EAP-TLS with 99.999% uptime","lane":"l2","tone":"brand"},{"id":"d2","label":"Your identity provider","sub":"Microsoft Entra ID, Okta, Google Workspace","lane":"l2","tone":"neutral"},{"id":"e2","label":"VLAN by identity","sub":"RADIUS attributes returned to the access point","lane":"l2","tone":"success"}],"edges":[{"from":"a1","to":"b1","label":"802.1X request","style":"solid"},{"from":"b1","to":"c1","label":"RADIUS","style":"solid"},{"from":"c1","to":"d1","label":"Directory lookup","style":"solid"},{"from":"a2","to":"c2","label":"RADIUS","style":"solid"},{"from":"c2","to":"d2","label":"Identity and groups","style":"solid"},{"from":"c2","to":"e2","label":"Access-Accept","style":"solid"},{"from":"e2","to":"a2","label":"VLAN applied","style":"dashed"}]}

Where does Purple fit against ClearPass?

{"title":"Which ClearPass alternative fits your estate","options":[{"name":"Aruba ClearPass (on-premise)","fitsWhen":["Legacy requirements specify on-premise hardware infrastructure","You depend on OnGuard posture checks before admission","One engine must also cover TACACS+ and wired ports"],"notWhen":["You want to stop running appliances","Your ClearPass specialists have moved on"]},{"name":"FreeRADIUS (self-hosted)","fitsWhen":["Small scope with strong Linux and RADIUS skills","You want open-source code you control"],"notWhen":["You need a vendor uptime commitment","You need guest access or BYOD onboarding built in"]},{"name":"Purple cloud RADIUS","fitsWhen":["Your estate mixes Meraki, Aruba, Ruckus, Mist or UniFi","Identity lives in Entra ID, Okta or Google Workspace","You want no RADIUS servers to host or patch","You run open, secure and xPSK networks"],"notWhen":["You want to build and manage on-premise RADIUS appliances"]}],"recommendation":"For multi-site WiFi estates with cloud identity, choose Purple cloud RADIUS: hardware-agnostic, 99.999% platform uptime and a migration that is usually a weekend exercise."}

Purple fits as a cloud overlay on the network you already run. No controller is replaced and no appliance is installed. The access points keep doing what they do. They send an 802.1X request, receive an Access-Accept with VLAN attributes and place the device on the right segment.

The VLAN assignment uses the standard tunnel attributes defined for 802.1X in RFC 3580. Those attributes are Tunnel-Type, Tunnel-Medium-Type and Tunnel-Private-Group-ID. Every vendor in the canonical list honours them, which is why one policy works across a mixed estate.

{"tone":"proof","title":"Proven at branch scale","text":"JPMorgan runs Staff WiFi on Purple across 5,000 branches, on the largest cloud RADIUS in the world."}

Purple also covers the networks ClearPass splits across modules. Visitors reach the open network through a captive portal, the web page that grants access before the network does. Staff devices reach the secure network with EAP-TLS. Devices that cannot run 802.1X, such as printers and smart TVs, join the xPSK network with a key of their own. Passpoint, also called Hotspot 2.0, lets enrolled devices join automatically and securely without a portal.

Adjacent capabilities sit in other Purple products. Guest marketing runs in Engage, and DNS filtering runs in Shield. Neither is needed to replace ClearPass.

What does each option cost to run?

Licence lines rarely decide this comparison. The running cost does. The table below sets out the cost structure of each option, not the amounts.

{"caption":"Running cost structure by option (structure only, no amounts)","asOf":"2026-06-10","columns":[{"key":"line","label":"Cost line"},{"key":"cp","label":"Aruba ClearPass (on-premise)"},{"key":"fr","label":"FreeRADIUS (self-hosted)"},{"key":"pa","label":"Purple cloud RADIUS","highlight":true}],"rows":[["Software","Licences per concurrent endpoint, plus add-on modules","No licence fee; GPL open source","Subscription to Purple Access"],["Infrastructure","Appliances or hypervisor capacity you provide","Servers or cloud instances you provision","None to host; Purple runs the RADIUS estate"],["High availability","Additional cluster nodes you buy and host","Additional servers and failover you build","Included: 99.999% platform uptime"],["Certificates","Onboard licensing plus your certificate authority","Your certificate authority and enrolment tooling","Covered by the Purple Access secure network"],["Upgrades","Staff time and change windows per release","Staff time per OS and package update","Run by Purple"],["Skills","ClearPass specialists or partner support","Linux and RADIUS engineering","Network team manages policy in one console"],["Refresh","Appliance refresh at end of support","Server refresh on your hardware cycle","No hardware refresh"]],"footnote":"ClearPass licensing structure from Aruba's public licensing documentation. FreeRADIUS licence terms from freeradius.org."}

ClearPass costs scale with endpoints and with resilience. Every additional cluster node adds hardware or hypervisor capacity, plus another system to patch. Add-on modules such as Onboard and OnGuard add their own licence lines. Appliance refresh returns on a fixed cycle whether your estate has grown or not.

FreeRADIUS moves cost from licences to people. The software is free, but redundancy, PKI, monitoring and guest access are engineering projects. Each one needs maintaining after the engineer who built it moves on.

Purple consolidates those lines into one subscription. You stop buying cluster nodes, patching appliances and planning refreshes. Purple carries the uptime commitment. When you build your business case, count the staff hours ClearPass upgrades consume each year. That line is usually the one that moves the decision.

What does moving off ClearPass involve?

Moving off ClearPass is a policy translation exercise, not a hardware project. The RADIUS cutover itself is usually a weekend exercise. The work that makes it uneventful happens in the weeks before.

1. Read your ClearPass services. List each service, its authentication source, its enforcement policy and the RADIUS attributes it returns. Most estates find a small number of services carry nearly all the traffic.
2. Map roles to VLANs. Rewrite each enforcement rule as identity group to VLAN. Note which rules depend on profiling or posture, because those need a decision before cutover.
3. Connect your identity provider. Link Microsoft Entra ID, Okta or Google Workspace to Purple. Groups in the IdP become the inputs to network policy.
4. Plan certificate trust. Decide how devices will trust the new RADIUS server certificate, and how ClearPass Onboard devices will re-enrol for EAP-TLS.
5. Pilot one site. Add Purple as the RADIUS server on one SSID in your existing console. Confirm VLAN assignment for each identity group.
6. Cut over in waves. Repoint SSIDs site by site, usually across a weekend, with ClearPass still available as a fallback.
7. Decommission ClearPass. After a soak period, retire the cluster. Export accounting logs first, in line with your retention policy.

{"tone":"warning","title":"The risk that bites: certificate trust","text":"PEAP and EAP-TLS clients validate the RADIUS server certificate, so a new server certificate breaks connections on unmanaged profiles. Push the updated trust settings through your MDM before cutover, not on the night."}

PEAP (Protected EAP) wraps a password login inside a TLS tunnel, so it relies on that server certificate too. MDM, or mobile device management, is the fastest way to update trust on corporate devices. Examples include Microsoft Intune and Jamf. BYOD devices re-onboard through the open network.

{"tone":"tip","title":"Run both servers during the pilot","text":"List Purple as the primary RADIUS server and ClearPass as the secondary on your pilot SSID. You validate policy on live traffic, and rollback is a single console change."}

The phases mirror a Cisco ISE exit closely. If you also run ISE elsewhere, the phased cutover plan for Cisco ISE uses the same structure.

How should you decide?

When evaluating your network architecture, consider the operational cost of managing on-premise server infrastructure. Cloud RADIUS eliminates appliance hosting, maintenance and manual upgrades while delivering centralized access control. Choose Purple cloud RADIUS for multi-site estates, mixed hardware environments or cloud identity integrations.

Before starting a migration, check any specialized requirements against your ClearPass configuration. If specific services depend on OnGuard posture, TACACS+ or wired port enforcement, scope those separately and move WiFi authentication first. WiFi is where most of the appliance load, the licence count and the upgrade effort sit.

Your next step is a pilot. Export your ClearPass services and connect your IdP to Purple. Then repoint one SSID at one site. For the wider security context, read the enterprise WiFi security guide. If ISE is also on your estate, compare it with the Cisco ISE alternatives guide.

Frequently asked questions

Is Purple a direct replacement for Aruba ClearPass?

Yes, for WiFi authentication. Purple replaces ClearPass Policy Manager, Guest and Onboard for wireless access with cloud RADIUS, a captive portal and BYOD onboarding. It runs on Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. Before you switch ClearPass off, scope any wired port enforcement, TACACS+ or posture checks separately. Those sit outside WiFi authentication and need their own decision.

Will cloud RADIUS work with the Aruba access points we already own?

Yes. HPE Aruba access points send standard 802.1X RADIUS requests, so you point the SSID at Purple instead of ClearPass. No access point is replaced and no new hardware arrives on site. The same applies to Cisco Meraki, Ruckus, Juniper Mist and Ubiquiti UniFi. A mixed estate therefore moves to one policy source, configured from the consoles your team already uses.

How long does a ClearPass migration take?

The RADIUS cutover is usually a weekend exercise. The planning before it takes longer. You read your ClearPass services, map roles to VLANs, connect your identity provider and decide how devices will trust the new server certificate. Most teams pilot one site first, then move the remaining sites in waves. ClearPass stays available as a fallback until the soak period ends.

How is cloud RADIUS priced compared with ClearPass?

Purple is a subscription with no appliances, hypervisor capacity or cluster nodes to host. ClearPass is licensed per concurrent endpoint, with add-on modules such as Onboard and OnGuard. It also runs on appliances or virtual machines you provide. Compare the full running cost, not the licence line alone. Include cluster nodes, upgrade effort, specialist time and appliance refresh.

Do devices need new certificates when we leave ClearPass?

Usually, yes. Devices enrolled through ClearPass Onboard hold certificates from that certificate authority, so they re-enrol for EAP-TLS. PEAP clients also validate the RADIUS server certificate, so their WiFi profile must trust the new one. Push the change through your MDM before cutover. Staff then reconnect without noticing that the server answering them has changed.

Can cloud RADIUS provide evidence for PCI DSS or ISO 27001 audits?

Yes. Purple holds ISO 27001 and Cyber Essentials certification. Identity-based VLAN assignment gives you evidence for PCI DSS network segmentation and for access reviews. Your auditor still assesses your whole environment. Cloud RADIUS supplies evidence for the access-control controls rather than a pass in itself, so plan which reports your auditor needs before cutover.

Does Purple support Passpoint and xPSK as well as 802.1X?

Yes. Purple Access runs open, secure and xPSK networks on one platform. Passpoint lets enrolled devices join automatically and securely, without a captive portal. xPSK gives each device or resident its own key, which suits devices that cannot run 802.1X, such as printers and smart TVs. Identity sets the VLAN on all three networks, so segmentation stays consistent across your estate.