ClearPass MFA Workflows

Multi Factor Authentication (MFA) is a security mechanism that requires users to present two or more verification factors when accessing a network resource (VPN, Wi-Fi, wired network access, login portals, admin consoles, etc.). It goes beyond traditional username/password authentication to reduce the risk of unauthorized access. Password are inherently insecure with people using the same password in multiple places, choosing weak and easily guessed words, and is highly susceptible to social engineering attacks. MFA provides mitigation from brute force attacks, phishing, and exposed login credentials. MFA is also increasingly becoming part of compliance requirements as well.

While MFA does provide more security than just password, it can also lead to poor user experience if not implemented correctly. Certain workflows are more tolerant of the delays when the user has to access a registered device to respond to the MFA prompt.

The different factors that are used to verify identity and authorize access to network or applications are:

Something you know

• Password
• PIN
• Security Question

Something you have

• TOTP (Time based One Time Password) with mobile authenticator apps (Google Authenticator, Microsoft Authenticator, Okta Verify, Duo Mobile, etc.)
• Push notification approval
• Hardware tokens (Yubikey, RSA Secure ID, Smartcards/CAC),FIDO2 / WebAuthn security keys, HOTP, etc.)
• SMS one time passcode
• Email one time passcode
• Device certificates

Something you are

• Fingerprint (TouchID, biometrics readers)
• Facial Recognition (Windows Hello, Face ID)

MFA workflows with ClearPass

With respect to ClearPass implementation, the following workflows are MFA friendly and commonly deployed:

Management login to ClearPass using SAML SSO

ClearPass supports using SAML SSO for logging into different management interfaces like ClearPass Policy Manager admin UI, Insight module and Guest module. This is standard web based authentication and MFA can be embedded into the login flow itself. Identity providers like Google, Okta, and Microsoft Entra all support adding MFA to web-based login workflows.

Operator login to ClearPass Guest

User can log into ClearPass Guest with different personas to create or manage guest accounts, create or manage device registrations, and approve guest accounts as a sponsor. Operator logins can also be enabled with SAML SSO which can be secured with MFA workflows supported by the IDP.

Management login to other applications and network devices

ClearPass can also act as IDP where the credentials are validated against authentication sources like active directory, Okta, Google workspace etc. This allows using ClearPass for logging into web interface of applications like HPE GreenLake and network elements like firewalls, load balancers, cloud management portals, etc. This is useful when you want to leverage a local identity source like Active Directory or LDAP without having to configure SAML on those identity sources.

TACACS+/RADIUS authentication for management login to network devices

Logging into devices whether its the command line interface or the web can also be secured by using MFA. Typically the authentication protocols used are either RADIUS or TACACS+. ClearPass enables MFA for device logins by either making API calls against the MFA provider or by forwarding the auth request to a RADIUS agent. For example, Okta has a RADIUS agent for triggering MFA. Okta RADIUS agent uses API calls to Okta to authenticate the user and evaluate MFA; either by triggering a push notification or evaluating the MFA token within the password attribute. Below is the flow diagram of how the integration with Okta works:

More details about this integration with Okta can be found at:

https://arubanetworking.hpe.com/techdocs/NAC/tech-corner/okta-mfa/

The integration with PingID uses a direct API integration using the PingID extension in ClearPass. Details about this integration can be found at:

https://arubanetworking.hpe.com/techdocs/NAC/clearpass/integrations/multi-factor-authentication/pingid-mfa/

Web login using SAML SSO / Cloud Identity

ClearPass allows captive portal login using SAML SSO and also uses OAuth to authenticate users against a list of cloud identity providers. This is useful when employees need to connect to guest network to maybe onboard their device or to perform some recovery or remediation action. The SAML SSO can be combined with different web based MFA to verify the identity of the user. Cloud identity providers also support a wide range of MFA options.

VPN authentication

RADIUS is typically used for VPN authentication and it can be secured by adding MFA in the form of push notification, FIDO2/WebAuthn, OTP, etc. The primary authentication would validate the user credentials and then a range of MFA options like TOTP, Push, Okta Verify, etc. can be used to further secure the VPN authentication. Note that while CHAP / MS-CHAPv2 can be used for primary authentication, it cannot be combined with MFA since the server needs the password in cleartext to trigger MFA.

802.1X authentication

The most common way to implement MFA with 802.1X is using EAP-GTC protocol. It supports MFA factors like push / TOTP, passcode, RSA tokens, Yubikey OTP but does not support interactive MFA factors like WebAuthn/FIDO2 or security questions. The default supplicants on common OS platforms do not support EAP-GTC natively and hence need a custom supplicant which adds to the complexity of the deployment.

Another way to approach securing 802.1X authentication is to use EAP-TLS for authentication and use MFA during the device provisioning or onboarding process so that user identity is verified at the time of the certificate provisioning. Alternatively, it is also possible to use a captive portal after 802.1X to force a web based MFA. However the latter approach leads to a sub optimal user experience and is not generally used outside of environments that have very stringent and specific security requirements.

MFA Providers and ClearPass

ClearPass can integrate with MFA providers in different ways:

1. RADIUS proxy: Many MFA providers have a RADIUS interface which can be used to trigger MFA. ClearPass in this case would just proxy the authentication request to the RADIUS interface of the MFA provider. The MFA solution would then handle the secondary factor validation like push notification, OTP validation etc. This requires that the user credentials are in cleartext so supported authentication methods are PAP, EAP-TTLS, and EAP-GTC.

There are different ways in ClearPass to proxy requests to an external RADIUS server like:

• Proxy Target Server used with RADIUS Proxy service type
• Authentication Source of type RADIUS / RadSec
• Token Server Authentication Source

Of these methods, the token server authentication source is best suited for MFA use cases since it allows doing an authorization lookup before sending the request to the MFA provider. This means ClearPass can validate that the user exists in identity source and is a valid user before triggering MFA thus preventing the MFA provider from being overwhelmed by invalid requests.

Popular MFA providers that have a RADIUS interface:

• Okta through Okta RADIUS Agent
• Ping ID through Ping Federate RADIUS Proxy
• Cisco Duo through Duo Authentication Proxy
• Microsoft / Entra ID through NPS
• RSA Secure ID

2. API integration: ClearPass extensions provide ability to integrate with third party applications. At present, there is an extension for PingID that allows ClearPass to use API calls to trigger push notification instead of using the RADIUS interface. The modular and flexible design of extensions allow the development of similar integrations with other provider if needed.

3. HTTP Authorization: The HTTP authentication source in ClearPass can be used to trigger REST API calls against external systems like MFA providers. Most of the providers have REST APIs which can be used to trigger MFA workflows. A HTTP authorization workflow can be used to craft a REST API call to MFA provider which results in a 200 OK response if the validation is successful. Note that each provider has different set of REST APIs and processes to trigger MFA which will not be covered in this document. Please refer to vendor API documentation for more information.

Popular MFA providers that have REST API to trigger push notifications are:

• Okta
• Ping ID
• Cisco Duo
• OneLogin

ClearPass MFA Matrix

Note that this table lists some MFA providers which are known to work but this is not a comprehensive list. The RADIUS based MFA options can be used with any MFA provider that has a RADIUS interface and the HTTP / API based MFA options can be used with any provider that has REST APIs to trigger MFA.

Most MFA / Identity providers support SAML and OAuth based workflows so that should work with any of the third party providers