Security

I'm having some issues setting up our WLC -> AVI Load Balancer -> ClearPass cluster to authenticate wireless users. Currently we're using NetScaler to load balance, and previously used F5. 

When I test radius from my WLC through the AVI LB, I'm getting an error in ClearPass: Failed to decode RADIUS packet - Received packet from X.X.X.X with invalid Message-Authenticator! (Shared secret may be incorrect.)

When I test radius from my WLC straight to ClearPass it works fine. I'm assuming when the packet is going through AVI LB it's changing the packet. Does anyone have experience with AVI LB and ClearPass?

I didn't know AVI Load Balancer, but from a quick search it appears to be an Application Load Balancer, not a Network Load Balancer.

When load balancing RADIUS traffic, make sure it's just doing simple UDP load balancing (with persistence to make sure that all traffic from one switch/AP/site always goes to the same ClearPass server) and prevent it from looking-into/modifying the traffic. If this loadbalancer has specific support for RADIUS, it may work but you probably will need to configure it further with RADIUS secrets and as RADIUS clients.

One more thing is that many load balances will do Source-NAT, which means that the RADIUS traffic arriving at ClearPass will have the source address of the load balancer (or one of it's NAT (pool) addresses). The RADIUS secret for THAT IP is used in ClearPass. This is not different from using an F5, and if you have different shared secrets (or different device types as switch/AP/brands), you may need to specifically assign different Source NAT IPs for requests from those devices.

As you came from F5, I'd expect that you configured that the same on this load balancer.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------

Just wanted to update this thread in case other's are using AVI LB.

I was able to get it to work (same way as F5/NetScaler). The only thing I had to change was the LB device make in clearpass device manager. I had it as IETF, switched it to Aruba and voila, it started working. Not sure what difference it made, but it works now.

Original Message:
Sent: Oct 06, 2023 06:34 AM
From: Herman Robers
Subject: WLC -> AVI Load Balancer -> ClearPass Cluster

I didn't know AVI Load Balancer, but from a quick search it appears to be an Application Load Balancer, not a Network Load Balancer.

When load balancing RADIUS traffic, make sure it's just doing simple UDP load balancing (with persistence to make sure that all traffic from one switch/AP/site always goes to the same ClearPass server) and prevent it from looking-into/modifying the traffic. If this loadbalancer has specific support for RADIUS, it may work but you probably will need to configure it further with RADIUS secrets and as RADIUS clients.

One more thing is that many load balances will do Source-NAT, which means that the RADIUS traffic arriving at ClearPass will have the source address of the load balancer (or one of it's NAT (pool) addresses). The RADIUS secret for THAT IP is used in ClearPass. This is not different from using an F5, and if you have different shared secrets (or different device types as switch/AP/brands), you may need to specifically assign different Source NAT IPs for requests from those devices.

As you came from F5, I'd expect that you configured that the same on this load balancer.

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------