Security

Hi Athan

To be able to form a cluster with a Publisher and one or more Subscribers all nodes must be the same version as the Publisher. You shoud not mix FIPS and non-FIPS nodes in the same cluster.

The cluster password is the same as the appadmin password, so if you change the cluster password you have to use the new one when accessing the CLI and loggning in with appadmin. Changeing the cluster password does not affect the function of the authentications of network clients.

On the Subscriber you need to trust the root CA of the https certificate to be able to form the cluster. Also it's recommended to have a https certificate. This certificate is utilized for the administative GUI pages, guest portal pages and Downloadable User Role.

If you don't have a correct certificate you will get certificate warnings as admin or guest or the Downloadable User Roles will not be downloaded. ClearPass Onboard also require a correct certificate.

Plan the names in the https certificate with care, as the names you need to have in the certificate may differ depending on the use case you have. If you are unsure, consult a local Aruba partner or Aruba TAC.

If you are deploying a new ClearPass you should deploy 6.11.1 and apply latest patches.

ClearPass 6.9.x and 6.10.x are only supported until 2023-12-15

Thanks for your reply 

Please could you explain me different version between 

 [FIPS] or c10000V

Original Message:
Sent: Mar 23, 2023 06:14 AM
From: jonas.hammarback
Subject: Error Suscraiber clear Pass

Hi Athan

To be able to form a cluster with a Publisher and one or more Subscribers all nodes must be the same version as the Publisher. You shoud not mix FIPS and non-FIPS nodes in the same cluster.

The cluster password is the same as the appadmin password, so if you change the cluster password you have to use the new one when accessing the CLI and loggning in with appadmin. Changeing the cluster password does not affect the function of the authentications of network clients.

On the Subscriber you need to trust the root CA of the https certificate to be able to form the cluster. Also it's recommended to have a https certificate. This certificate is utilized for the administative GUI pages, guest portal pages and Downloadable User Role.

If you don't have a correct certificate you will get certificate warnings as admin or guest or the Downloadable User Roles will not be downloaded. ClearPass Onboard also require a correct certificate.

Plan the names in the https certificate with care, as the names you need to have in the certificate may differ depending on the use case you have. If you are unsure, consult a local Aruba partner or Aruba TAC.

If you are deploying a new ClearPass you should deploy 6.11.1 and apply latest patches.

ClearPass 6.9.x and 6.10.x are only supported until 2023-12-15

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution

Hi

FIPS mode is indended for US government usage and restricts some protocols and functions.

Find more information here:

https://www.arubanetworks.com/techdocs/ClearPass/6.9/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_FIPS_tab.htm

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------


Original Message:
Sent: Mar 23, 2023 07:02 AM
From: athan
Subject: Error Suscraiber clear Pass

Thanks for your reply 

Please could you explain me different version between 

 [FIPS] or c10000V

Original Message:
Sent: Mar 23, 2023 06:14 AM
From: jonas.hammarback
Subject: Error Suscraiber clear Pass

Hi Athan

To be able to form a cluster with a Publisher and one or more Subscribers all nodes must be the same version as the Publisher. You shoud not mix FIPS and non-FIPS nodes in the same cluster.

The cluster password is the same as the appadmin password, so if you change the cluster password you have to use the new one when accessing the CLI and loggning in with appadmin. Changeing the cluster password does not affect the function of the authentications of network clients.

On the Subscriber you need to trust the root CA of the https certificate to be able to form the cluster. Also it's recommended to have a https certificate. This certificate is utilized for the administative GUI pages, guest portal pages and Downloadable User Role.

If you don't have a correct certificate you will get certificate warnings as admin or guest or the Downloadable User Roles will not be downloaded. ClearPass Onboard also require a correct certificate.

Plan the names in the https certificate with care, as the names you need to have in the certificate may differ depending on the use case you have. If you are unsure, consult a local Aruba partner or Aruba TAC.

If you are deploying a new ClearPass you should deploy 6.11.1 and apply latest patches.

ClearPass 6.9.x and 6.10.x are only supported until 2023-12-15

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution

How then is it possible?
I believe I downloaded the same OVA for two nodes, and that node 2 may have 6.9.0.130064.
[FIPS] 

is there a specific OVA for FIPS ? 

Hi

FIPS mode is indended for US government usage and restricts some protocols and functions.

Find more information here:

https://www.arubanetworks.com/techdocs/ClearPass/6.9/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_FIPS_tab.htm

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution


Original Message:
Sent: Mar 23, 2023 07:02 AM
From: athan
Subject: Error Suscraiber clear Pass

Thanks for your reply 

Please could you explain me different version between 

 [FIPS] or c10000V

Original Message:
Sent: Mar 23, 2023 06:14 AM
From: jonas.hammarback
Subject: Error Suscraiber clear Pass

Hi Athan

To be able to form a cluster with a Publisher and one or more Subscribers all nodes must be the same version as the Publisher. You shoud not mix FIPS and non-FIPS nodes in the same cluster.

The cluster password is the same as the appadmin password, so if you change the cluster password you have to use the new one when accessing the CLI and loggning in with appadmin. Changeing the cluster password does not affect the function of the authentications of network clients.

On the Subscriber you need to trust the root CA of the https certificate to be able to form the cluster. Also it's recommended to have a https certificate. This certificate is utilized for the administative GUI pages, guest portal pages and Downloadable User Role.

If you don't have a correct certificate you will get certificate warnings as admin or guest or the Downloadable User Roles will not be downloaded. ClearPass Onboard also require a correct certificate.

Plan the names in the https certificate with care, as the names you need to have in the certificate may differ depending on the use case you have. If you are unsure, consult a local Aruba partner or Aruba TAC.

If you are deploying a new ClearPass you should deploy 6.11.1 and apply latest patches.

ClearPass 6.9.x and 6.10.x are only supported until 2023-12-15

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution

There is no specific OVA for FIPS, it is configured/enabled during the initial installation of the Virtual Appliance. The Cx00V denotes the model of the appliance, such as C1000V, C2000V, C3000V etc.

How then is it possible?
I believe I downloaded the same OVA for two nodes, and that node 2 may have 6.9.0.130064.
[FIPS] 

is there a specific OVA for FIPS ? 

Hi

FIPS mode is indended for US government usage and restricts some protocols and functions.

Find more information here:

https://www.arubanetworks.com/techdocs/ClearPass/6.9/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_FIPS_tab.htm

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution


Original Message:
Sent: Mar 23, 2023 07:02 AM
From: athan
Subject: Error Suscraiber clear Pass

Thanks for your reply 

Please could you explain me different version between 

 [FIPS] or c10000V

Original Message:
Sent: Mar 23, 2023 06:14 AM
From: jonas.hammarback
Subject: Error Suscraiber clear Pass

Hi Athan

To be able to form a cluster with a Publisher and one or more Subscribers all nodes must be the same version as the Publisher. You shoud not mix FIPS and non-FIPS nodes in the same cluster.

The cluster password is the same as the appadmin password, so if you change the cluster password you have to use the new one when accessing the CLI and loggning in with appadmin. Changeing the cluster password does not affect the function of the authentications of network clients.

On the Subscriber you need to trust the root CA of the https certificate to be able to form the cluster. Also it's recommended to have a https certificate. This certificate is utilized for the administative GUI pages, guest portal pages and Downloadable User Role.

If you don't have a correct certificate you will get certificate warnings as admin or guest or the Downloadable User Roles will not be downloaded. ClearPass Onboard also require a correct certificate.

Plan the names in the https certificate with care, as the names you need to have in the certificate may differ depending on the use case you have. If you are unsure, consult a local Aruba partner or Aruba TAC.

If you are deploying a new ClearPass you should deploy 6.11.1 and apply latest patches.

ClearPass 6.9.x and 6.10.x are only supported until 2023-12-15

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution

good, thanks

I'll check the cli command for the one that disables FIPS.

On the other hand, the other node will need to be updated with the same version:

MAIN NODE 

SUSCRAIBER NODE

ClearPass Policy Manager 6.9.0.130064 [FIPS] 

There is no specific OVA for FIPS, it is configured/enabled during the initial installation of the Virtual Appliance. The Cx00V denotes the model of the appliance, such as C1000V, C2000V, C3000V etc.

How then is it possible?
I believe I downloaded the same OVA for two nodes, and that node 2 may have 6.9.0.130064.
[FIPS] 

is there a specific OVA for FIPS ? 

Hi

FIPS mode is indended for US government usage and restricts some protocols and functions.

Find more information here:

https://www.arubanetworks.com/techdocs/ClearPass/6.9/PolicyManager/Content/CPPM_UserGuide/Admin/ServerConfig_FIPS_tab.htm

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution


Original Message:
Sent: Mar 23, 2023 07:02 AM
From: athan
Subject: Error Suscraiber clear Pass

Thanks for your reply 

Please could you explain me different version between 

 [FIPS] or c10000V

Original Message:
Sent: Mar 23, 2023 06:14 AM
From: jonas.hammarback
Subject: Error Suscraiber clear Pass

Hi Athan

To be able to form a cluster with a Publisher and one or more Subscribers all nodes must be the same version as the Publisher. You shoud not mix FIPS and non-FIPS nodes in the same cluster.

The cluster password is the same as the appadmin password, so if you change the cluster password you have to use the new one when accessing the CLI and loggning in with appadmin. Changeing the cluster password does not affect the function of the authentications of network clients.

On the Subscriber you need to trust the root CA of the https certificate to be able to form the cluster. Also it's recommended to have a https certificate. This certificate is utilized for the administative GUI pages, guest portal pages and Downloadable User Role.

If you don't have a correct certificate you will get certificate warnings as admin or guest or the Downloadable User Roles will not be downloaded. ClearPass Onboard also require a correct certificate.

Plan the names in the https certificate with care, as the names you need to have in the certificate may differ depending on the use case you have. If you are unsure, consult a local Aruba partner or Aruba TAC.

If you are deploying a new ClearPass you should deploy 6.11.1 and apply latest patches.

ClearPass 6.9.x and 6.10.x are only supported until 2023-12-15

------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution