Security

Using the RADIUS proxy functionality the RADIUS request will be forwarded to another RADIUS server. That RADIUS server needs to handle that request and do the authentication. The authentication respons is send to the ClearPass server and that server is sending the respons back to the switch.

So the return flow is the same. For the other ClearPass cluster is just an normal authentication request where the source IP is the first ClearPass server.

Ok, so the RADIUS response received by the customer facing cluster will just be returned to the original cluster without any other configuration being required?

I was thinking the response would stop at this intermediate. So I just need a RADIUS proxy service on both clusters 

Using the RADIUS proxy functionality the RADIUS request will be forwarded to another RADIUS server. That RADIUS server needs to handle that request and do the authentication. The authentication respons is send to the ClearPass server and that server is sending the respons back to the switch.

So the return flow is the same. For the other ClearPass cluster is just an normal authentication request where the source IP is the first ClearPass server.

Using the RADIUS proxy functionality the RADIUS request will be forwarded to another RADIUS server. That RADIUS server needs to handle that request and do the authentication. The authentication respons is send to the ClearPass server and that server is sending the respons back to the switch.

So the return flow is the same. For the other ClearPass cluster is just an normal authentication request where the source IP is the first ClearPass server.

I just wanted to revisit this to be sure. On my corporate cluster I create a RADIUS proxy service that forwards the auth request from the switch to my commercial cluster. On the commercial cluster I create a RADIUS proxy service with a condition that the request has originated from the corporate cluster and with proxy targets that forward the request to the third party. When the commercial cluster receives the response from the third party, will this automatically be forwarded back to the corporate cluster? Obviously the RADIUS proxy service on the commercial cluster has an enforcement policy which is defaulted to accept all. Is this going to affect the response?

I am just not seeing at the moment how the response will be returned and not just stop at the commercial cluster. I don't have two clusters  in my test environment so am not able to test this first

Using the RADIUS proxy functionality the RADIUS request will be forwarded to another RADIUS server. That RADIUS server needs to handle that request and do the authentication. The authentication respons is send to the ClearPass server and that server is sending the respons back to the switch.

So the return flow is the same. For the other ClearPass cluster is just an normal authentication request where the source IP is the first ClearPass server.

Yes that works. It's just a new authentication request between the two clusters. So the commercial clusters simply return the response to the IP address of the corporate cluster.

The RADIUS response (accept / deny + attributes) will be proxied from the and (by default) not altered. 

I just wanted to revisit this to be sure. On my corporate cluster I create a RADIUS proxy service that forwards the auth request from the switch to my commercial cluster. On the commercial cluster I create a RADIUS proxy service with a condition that the request has originated from the corporate cluster and with proxy targets that forward the request to the third party. When the commercial cluster receives the response from the third party, will this automatically be forwarded back to the corporate cluster? Obviously the RADIUS proxy service on the commercial cluster has an enforcement policy which is defaulted to accept all. Is this going to affect the response?

I am just not seeing at the moment how the response will be returned and not just stop at the commercial cluster. I don't have two clusters  in my test environment so am not able to test this first

Using the RADIUS proxy functionality the RADIUS request will be forwarded to another RADIUS server. That RADIUS server needs to handle that request and do the authentication. The authentication respons is send to the ClearPass server and that server is sending the respons back to the switch.

So the return flow is the same. For the other ClearPass cluster is just an normal authentication request where the source IP is the first ClearPass server.