Standard practice is just using the MGMT port unless your security policies need management traffic to exist on a separate air gaped or separate network segment for than the DATA. If you look up the routing decisions ClearPass makes while using MGMT+DATA it will make sense. Should be in the documentation I linked.
------------------------------
Dustin Burns
Lead Mobility Engineer @Worldcom Exchange, Inc.
ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
If my post was useful accept solution and/or give kudos
------------------------------
Original Message:
Sent: Jul 08, 2026 12:02 PM
From: MA-3o9358
Subject: Clearpass Zone DMZ or LAN
Thank you very much for the explanation.
What is the recommended ClearPass design:
- Management interface in the existing management VLAN (LAN zone) and data interface(DMZ Zone) in a separate guest-facing subnet?
- Or a dedicated ClearPass management VLAN in the DMZ zone with guest traffic and no data Port?
What should be considered when choosing between these two deployment designs?
Original Message:
Sent: Jul 08, 2026 10:55 AM
From: DB-280928
Subject: Clearpass Zone DMZ or LAN
We plan to place the ClearPass management interfaces and the Virtual IP (VIP) in a dedicated VLAN. According to Aruba best practices, should this VLAN be connected to the firewall's LAN zone or placed in a DMZ, considering that ClearPass will host the Guest captive portal? ClearPass is typically deployed in a DMZ or Network Services segment (RADIUS TACACS, AD, etc...) on your network. You would put the guest vlan into a MZ and control its access to the ClearPass destinations for webauth.
Is it recommended that the Publisher, Subscriber, and VIP management IP addresses reside in the same subnet, or should the VIP be placed in a separate subnet from the management interfaces? They would have to be in the same subnet to be a part of the same VIP. VRRP is used for the VIP, and requires you to be on the same layer-2 VLAN. If you are deploying VMs, read the ClearPass vm install documentation (ClearPass Docs | Configuration & Integration Guides, Solution Guides, Release Notes, User Guides | Security). Subscribers can be added to the same vlan or any other subnet that has L3 reachability to the Publisher for database sync and config. If you are deploying worldwide, you would end up using Zones to control the replication traffic propagation.
------------------------------
Dustin Burns
Lead Mobility Engineer @Worldcom Exchange, Inc.
ACCX 1271| ACMX 509| ACSP | ACDA | MVP Guru 2022-2023
If my post was useful accept solution and/or give kudos
------------------------------