Security

 View Only
  • 1.  CPPM - Two VIPs and Certificates

    Posted Mar 04, 2026 10:12 AM
    Edited by kb1 Mar 04, 2026 10:28 AM

    Hi,

    Currently deploying a 2 node cluster. It will mainly be used for RADIUS/EAP and TACACS.

    I'm thinking to go down the 2 VIP route as mentioned on Hermans youtube series for the more efficient failover, not for any web requirements (still considering whether this is a bit of an overcomplication in my scenario)

    I've been doing a fair bit of reading up on certificates but I just wanted to make sure I've got this right. 

    As their is no plan for guest/onboarding, I believe the HTTPS certificate will only be used to join the pub and sub, when browsing to the CPPM GUI,  and also for DUR if i go down that route with the CX switches. So i need both HTTPS and RADIUS/EAP certificates.

    I'm thinking I'd rather use one cert to cover both servers for each service so 2 certs in total, one for EAP on both servers, and one for HTTPS.

    The HTTPS cert would be formatted as follows:

    • CN:
      • web.cppm.[domain].local  ###DNS record doesn't exist - not sure about this, if it does need to exist, what IP would it need to point at???
    • SAN:
      • DNS: web.cppm.[domain].local  
      • DNS: cppmvip1-cppm.[domain].local  ###DNS record exists
      • DNS: cppmvip2-cppm.[domain].local  ###DNS record exists
      • DNS: cppm-pub  ###actual name of cppm pub server, DNS record exists
      • DNS: cppm-sub  ### actual name of cppm sub server, DNS record exists

    The RADIUS cert would be formatted as follows:

    • CN:
      • auth.cppm.[domain].local  ###DNS record doesn't exist
    • SAN:
      • DNS: auth.cppm.[domain].local

    Does the above look right?



    -------------------------------------------



  • 2.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 04, 2026 05:49 PM

    The VIPs make replacement of appliances easier as you don't have to worry about the actual IP address of the appliance should you need to change that for some reason (e.g., deploying new appliances because of an upgrade requirement ala 6.10 to 6.11) or should you be dealing with a NAD that doesn't have the concept of a server group.

    You can probably ignore the VIP FQDN, shouldn't ever be using those to access ClearPass as you always want to be on the Publisher.  Only reason to have a SAN for a FQDN associated with a VIP is if you need such for captive portal.  Otherwise you look good to go.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 3.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 05, 2026 02:36 AM
    Edited by kb1 Mar 05, 2026 03:36 AM

    Thanks @chulcher

    I think you've swayed me to 2xVIPs :)

    In this scenario, would the VIP FQDN not be used for DUR?

    -------------------------------------------



  • 4.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 05, 2026 09:27 AM

    I suppose you could, but the reason to use a VIP is to simplify the move of an IP address which is useful when the NAD only uses an IP address to define a server.  DUR, using the FQDN...just change the DNS mapping should that become a requirement.  Which you'd probably end up having to do anyways.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 5.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 09, 2026 11:24 AM

    Ok, so sounds like DNS wouldn't be required for the VIP in my scenario then. 

    Just to confirm, my radius entries will suffice, no need to add any specific host/vips in the SAN for those?

    -------------------------------------------



  • 6.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 09, 2026 12:06 PM

    Your RADIUS certificate is usually going to be an old-school standard single host certificate with the single SAN matching the CN.  The important thing is that the FQDN really shouldn't have a DNS entry.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 7.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 05, 2026 09:29 AM

    Also, a note on DUR.

    Downloadable user roles are already not supported in AOS 10, support in AOS-CX and AOS-S hasn't changed but the general recommendation is to use local user roles, especially if you're managing the switch configuration through a Central or NetEdit.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 8.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 09, 2026 11:17 AM

    This environment is using Central so thanks for pointing the recommendation out. I always thought that DUR was the 'future' but interesting to hear that it's not necessarily the case out.  Do you have a link to any documentation in relation to that sort of information/recommendation?

    -------------------------------------------



  • 9.  RE: CPPM - Two VIPs and Certificates

    Posted Mar 09, 2026 11:46 AM

    Nothing quite that formalized.

    Central, especially the new implementation, expects you to create roles and policies within the centralized configuration that then gets applied to the devices.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------