The default ClearPass service for Mac Auth uses the MAC-Auth Expiry attribute for determining if the expire time for when the account is expires. However, the default expire timestamp in Guest uses the expiry_time attribute in the Guest User Repository, and the default ClearPass Service Template does not include the necessary Authorization sources to make Mac Auth service functional. Nor does the Mac-Auth Expiry ever get set by a default service template in the endpoints repository.

To make this work, setting the attribute in the endpoint repository is required.

For the post_auth profile, set the Mac-Auth Expiry

%{Authorization:[Time Source]:Now Plus 2hrs}

You can also use the Guest user repository Expire Time attribute.

%{Authorization:[Guest User Repository]:ExpireTime}

In order for these sources to be available, you must add the Time Source to the authorization tab of the service.

Mac authentication must be enabled or configured on ArubaOS. For Instant, its a checkbox in the security settings for the network configuration. For ArubaOS, you must setup mac authentication under AAA profiles.

If adding a custom expiration length to an account is required, this can be done by editing the default expire after attribute in the Guest Registration form or adding a custom Time Attribute to the Time Source.