ClearPass Service Routing

The following guidance has been produced to aid field engineering, customers and partners to understand how ClearPass Policy Manager provides services on either the Data or Management Interface or both.

Background

ClearPass has the ability to support multiple physical Ethernet Interfaces. Commonly referred to as the ‘Data Port / Data Interface’ and the ‘Management Port / Management Interface’. We use the term port and interface loosely to mean the same thing. As we explain in this document, when both interfaces are configured the expected behavior as to which services listen on which interface and which interface is used to reply when a request is received is not always as expected. This document attempts to provide some clarity.

• Today CPPM only supports the use of two physical interfaces (C1000/C2010/C3010), even though all of our hardware actually ships with four physical interfaces we only utilize a maximum of two today (Sep 2021). This restriction also applies for VM deployments, where a maximum of two supported interfaces can be configured.

• We allow the configuration of a dedicated SPAN port on one of the two spare Ethernet port on the onboard 4-port card. This allows us to ingest DHCP Discover and Request packets for profiling, this helps remove the requirement to configure DHCP IP helpers across the entire network.

• CPPM can also be deployed using a single interface, this would be the Management Interface. However, the second interface (data port) should exist physically on the system and is optionally configured. This applies specifically to a VM deployment.

When both the interfaces are configured there are changes in the way our listening daemons run and bind to interfaces. Details of the different services and the respective interfaces they bind are explained below.

Radius Request in 6.9.x and 6.10.x

The Data port interface alone cannot be configured. The manageport is mandatory and the data port is optional. Once an interface is given an IP address it in effect then becomes capable of receiving and replying to requests, be that RADIUS, Captive Portal, OnGuard etc.

However, when both the interfaces are configured, the radius request can be sent to both the interfaces and we reply with the radius response on the interface we initially received the request on.

OnGuard communicated with ClearPass through the data interface of both management and data interfaces are configured.

Client to CPPM Route selection

The following covers how route selection is chosen, this covers Client <-> CPPM.

• For network traffic that are received on the Management Interface, this interface is used as the return interface.

• For network traffic that are received on the Data Interface, this interface is used as the return interface.

• If the data interface is not configured all traffic will use the Management Interface.

CPPM Auxiliary Traffic Route selection

The following services follow the below rules in regard to how their route selection is chosen, this specifically covers CPPM <-> CPPM communications.

Active Directory, LDAP, NTP, Network devices, CPPM Cluster Communications, Cloud updates, CRL, OSCP, CoA, Endpoint Context-Servers (PANW, MDM)

When CPPM is configured with both interfaces, the following applies to route selection….

• If the destination network/address is in the management subnet then we use the management interface.

• If the destination network/address is in the data subnet then we use the data interface.

• If the destination network is not in either management or data subnets, then we use the data interface by default. 

When CPPM is configured with a single interface, the following applies to route selection…

• When only one interface is configured, then the traffic goes through management port.  This applies to all the network communication within CPPM

The following command example can be used to add routes as and if required. Make special notice of the option in the command syntax of “network ip add mgmt / data……..”

CPPM cluster traffic interfaces

CPPM cluster traffic TCP/UDP ports used

• UDP Port 123 NTP (Subscriber to Publisher)

• TCP Port 443 HTTPS (Bi-directional)

• TCP Port 5432 PostgreSQL for DB replication (Subscriber to Publisher)

• TCP Port 5433 PostgreSQL for insight and log DB queries between cluster nodes

• TCP Port 80 Bi-direction - change status queries between CPPM nodes.

Onboard and Guest Portal Caveats

Both Onboard and Guest Portal are supported on the Data and Management interfaces, separately and concurrently.

OnGuard Caveats

If Management and Data interfaces are configured concurrently, then OnGuard communicates with ClearPass through the Data interface.

• 6658 TCP for OnGuard client to communicate with CPPM. Otherwise, client doesn’t appear in OnGuard Activity tab.

CPPM to Active Directory

From: https://docs.microsoft.com/en-us/troubleshoot/windows-server/identity/config-firewall-for-ad-domains-and-trusts

The following is the list of services and their ports used for Active Directory communication:

• UDP Port 88 for Kerberos authentication

• UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations.

• TCP Port 139 and UDP 138 for File Replication Service between domain controllers. (Probably not necessary for CPPM)

• TCP and UDP Port 389 and 636 for LDAP to handle normal queries from client computers to the domain controllers.

• TCP and UDP Port 445 for File Replication Service (Not necessary for CPPM)

• TCP and UDP Port 464 for Kerberos Password Change

• TCP Port 3268 and 3269 for Global Catalog from client to domain controller.

• TCP and UDP Port 53 for DNS from client to domain controller and domain controller to domain controller.

VIP Caveats - Physical v Virtual Caveats

You can configure VIP address pairs concurrently across the Management and Data Interfaces. Prior to 6.1.1 if the server had both Management and Data VIP configured, then the VIP will only work with the data interfaces. 

VIP address can be used for the following services…..

• RADIUS

• Guest

• TACACS+

• WEBAUTH, this includes dissolvable OnGuard agent

  • OnGuard persistent agent always go to the Physical IP address

For other Services we use the Physical Interface IP address

• GRE / SMTP

Other Interface Rules / Suggestions

The CLI can ONLY be accessed from the Mgmt Interface. If a customer has concerns over ClearPass Policy Manager Admin UI access, you can restrict access using the Application Access Control. Found under Server Manager –> Server Configuration –> Network

To access this command, login to the CLI with the appadmin account and issue the following command:

system app-access-reset

DHCP Forwarded messages can be sent to either Management or Data Interface and we will update our fingerprint database accordingly.

Interfaces in DMZ/Trusted firewall Zones

If a deployment is such that an interface needs to be deployed into a ‘public’ environment such as a firewall DMZ, we recommend that you have the Data interface in the DMZ and the Management interface in the trusted zone. Secure access to the Data Interface through a combination of firewall rules that allows access to the DMZ and by the use of CPPM’s Application Access Control feature discussed previously.

External Updates

Every CPPM node requires HTTP(80) and HTTPS(443) to [clearpass.arubanetworks.com/webservice] for plugin updates.

Publisher/Subscriber Cluster

Finally, remember that any publisher or subscriber can process service requests on their Data or Management ports under the restrictions highlighted in this document.