Security

The VIPs make replacement of appliances easier as you don't have to worry about the actual IP address of the appliance should you need to change that for some reason (e.g., deploying new appliances because of an upgrade requirement ala 6.10 to 6.11) or should you be dealing with a NAD that doesn't have the concept of a server group.

You can probably ignore the VIP FQDN, shouldn't ever be using those to access ClearPass as you always want to be on the Publisher.  Only reason to have a SAN for a FQDN associated with a VIP is if you need such for captive portal.  Otherwise you look good to go.

------------------------------
Carson Hulcher, ACEX#110
------------------------------

Thanks @chulcher. 

I think you've swayed me to 2xVIPs :)

In this scenario, would the VIP FQDN not be used for DUR?

I suppose you could, but the reason to use a VIP is to simplify the move of an IP address which is useful when the NAD only uses an IP address to define a server.  DUR, using the FQDN...just change the DNS mapping should that become a requirement.  Which you'd probably end up having to do anyways.

Thanks @chulcher. 

I think you've swayed me to 2xVIPs :)

In this scenario, would the VIP FQDN not be used for DUR?

Original Message:
Sent: Mar 04, 2026 05:49 PM
From: chulcher
Subject: CPPM - Two VIPs and Certificates

The VIPs make replacement of appliances easier as you don't have to worry about the actual IP address of the appliance should you need to change that for some reason (e.g., deploying new appliances because of an upgrade requirement ala 6.10 to 6.11) or should you be dealing with a NAD that doesn't have the concept of a server group.

You can probably ignore the VIP FQDN, shouldn't ever be using those to access ClearPass as you always want to be on the Publisher.  Only reason to have a SAN for a FQDN associated with a VIP is if you need such for captive portal.  Otherwise you look good to go.

------------------------------
Carson Hulcher, ACEX#110

Ok, so sounds like DNS wouldn't be required for the VIP in my scenario then. 

Just to confirm, my radius entries will suffice, no need to add any specific host/vips in the SAN for those?

I suppose you could, but the reason to use a VIP is to simplify the move of an IP address which is useful when the NAD only uses an IP address to define a server.  DUR, using the FQDN...just change the DNS mapping should that become a requirement.  Which you'd probably end up having to do anyways.

Thanks @chulcher. 

I think you've swayed me to 2xVIPs :)

In this scenario, would the VIP FQDN not be used for DUR?

Thanks @chulcher. 

I think you've swayed me to 2xVIPs :)

In this scenario, would the VIP FQDN not be used for DUR?

Also, a note on DUR.

Downloadable user roles are already not supported in AOS 10, support in AOS-CX and AOS-S hasn't changed but the general recommendation is to use local user roles, especially if you're managing the switch configuration through a Central or NetEdit.

Thanks @chulcher. 

I think you've swayed me to 2xVIPs :)

In this scenario, would the VIP FQDN not be used for DUR?

Original Message:
Sent: Mar 04, 2026 05:49 PM
From: chulcher
Subject: CPPM - Two VIPs and Certificates

The VIPs make replacement of appliances easier as you don't have to worry about the actual IP address of the appliance should you need to change that for some reason (e.g., deploying new appliances because of an upgrade requirement ala 6.10 to 6.11) or should you be dealing with a NAD that doesn't have the concept of a server group.

You can probably ignore the VIP FQDN, shouldn't ever be using those to access ClearPass as you always want to be on the Publisher.  Only reason to have a SAN for a FQDN associated with a VIP is if you need such for captive portal.  Otherwise you look good to go.

------------------------------
Carson Hulcher, ACEX#110

This environment is using Central so thanks for pointing the recommendation out. I always thought that DUR was the 'future' but interesting to hear that it's not necessarily the case out.  Do you have a link to any documentation in relation to that sort of information/recommendation?

Also, a note on DUR.

Downloadable user roles are already not supported in AOS 10, support in AOS-CX and AOS-S hasn't changed but the general recommendation is to use local user roles, especially if you're managing the switch configuration through a Central or NetEdit.

Thanks @chulcher. 

I think you've swayed me to 2xVIPs :)

In this scenario, would the VIP FQDN not be used for DUR?