ClearPass, developed by Aruba Networks, is a network access control solution that provides a range of features for managing and securing network access. One of these features is the ability to implement certificate-based 802.1x authentication. This blog post will guide you through the process of setting up this feature in ClearPass.
Overview
Certificate-based 802.1x authentication involves using digital certificates to authenticate devices on a network. ClearPass Policy Manager (CPPM) acts as the central policy engine for controlling all forms of access, including certificate-based authentication[1].
Steps to Implement Certificate-based 802.1x Authentication
1. Configuring ClearPass to Support Onboarding
ClearPass Onboard simplifies the process of provisioning devices with the settings and certificates required for secure authentication. It provides a self-service app that enables users to provision their own devices[1].
To configure ClearPass to support onboarding, you must create at least one Network Settings definition. This object defines whether wired, wireless, or both types of connections will be provisioned, as well as settings for the wireless network. It defines which EAP authentication methods are supported (protocols), and where the certificates that Onboard sends will be stored on the client (authentication)[1].
2. Options for Onboard Certificate Authorities
ClearPass Onboard can act as a root Certificate Authority (CA) or an intermediate CA. If you want Onboard to act as an EST server for certificates that it issues itself, you should choose the root CA option. These certificates will only be valid for use within the ClearPass cluster. If you want Onboard to act as an EST server for a PKI that the company has already established, you should choose the intermediate CA option[1].
3. Installing Certificates on CPPM
You have two choices for installing certificates on CPPM. You can create the private key and Certificate Signing Request (CSR) online using the Web UI, or you can create the private key and CSR offline using a tool like OpenSSL. Once you have the signed certificate, you can upload it to CPPM[1].
4. Types of ClearPass Server Certificates
ClearPass uses server certificates for four purposes: RADIUS/EAP, RadSec, HTTPS, and Database. Each of these certificates has specific requirements and uses[1].
- RADIUS/EAP: CPPM uses this certificate during the 802.1X process to authenticate itself to 802.1X supplicants (users and clients). This certificate must not use a wildcard for its CN, as some clients will reject RADIUS/EAP certificates with wildcards[1].
- RadSec: CPPM uses the RadSec certificate to authenticate itself to network devices that use RadSec. The network access devices (NADs) must be manually configured by admins to trust the root CA associated with this certificate[1].
- HTTPS: ClearPass uses this certificate to authenticate itself to clients that access its web interfaces, including its management interface, Guest portal, and Onboard. Any clients that might need to access these interfaces must trust this certificate[1].
- Database: ClearPass uses the database certificate to authenticate to clients that access its Insight Database. When you deploy a cluster, the database certificates of cluster members must have a DNS type SAN, but with the server’s IP address as the value[1].
5. Types of Trusted CAs on ClearPass
ClearPass can integrate with endpoint context servers, such as a Palo Alto firewall or mobile device management (MDM), to exchange contextual information with those servers. To secure these communications, the servers can authenticate to CPPM with certificates. CPPM uses this type of CA certificate to validate these servers’ certificates[1].
6. Certificate Requirements for Forming a ClearPass Cluster
To join the cluster, Subscribers must trust the HTTPS certificate on the Publisher. The Publisher must also have a database certificate that has its own IP address listed as the DNS SAN. Similarly, each Subscriber must have its own database certificate with its own IP address listed as the DNS SAN[1].
Conclusion
Implementing certificate-based 802.1x authentication in ClearPass involves several steps, including configuring ClearPass to support onboarding, choosing an Onboard certificate authority, installing certificates on CPPM, understanding the types of ClearPass server certificates, understanding the types of trusted CAs on ClearPass, and understanding the certificate requirements for forming a ClearPass cluster. By following these steps, you can enhance the security of your network by ensuring that only authenticated devices can gain access[1].
Citations:
[1] Aruba Certified Network Security Professional Certification Study Guide
[2] https://community.arubanetworks.com/discussion/clearpass-ad-azure
[3] https://community.arubanetworks.com/discussion/8021x-certificate-based-authentication
[6] https://www.securew2.com/solutions/radius-aaa-solutions/clearpass-policy-manager-radius-eap-tls
[8] https://www.packetswitch.co.uk/everything-you-need-to-know-about-nac-802-1x-and-mab/
[11] https://www.thenetworkdna.com/2011/01/peap-protected-eap-protocol-8021x.html?m=1
[12] https://youtube.com/watch?v=Y3Ff_z6x7FM
[14] https://www.packetswitch.co.uk/meraki-local-auth-802-1x-without-a-radius-server/
[15] https://www.reddit.com/r/ArubaNetworks/comments/g2w1g7/8021x_without_user_certificate/?rdt=64657
[16] https://community.arubanetworks.com/discussion/clearpass-solution-guide-wired-policy-enforcement
[17] https://www.flomain.de/2023/12/clearpass-guest-access-with-username-only/
[20] http://mackenziewifi.com/index.php/blog/
[21] https://youtube.com/watch?v=buNyG5WneKY
[22] https://youtube.com/watch?v=Wom0M1SnwjU
[23] https://www.securewirelessworks.com/ClearPass-Onboard.asp
Related Articles
How Does Cerrtificate-based authentication work (802.1x TLS)
Explore the intricacies of 802.1X authentication, a cornerstone of secure network access, and understand how it integrates with Cisco switches and ClearPass as the RADIUS server.Lionel Medina is a seasoned expert in enterprise wireless design with over two decades of...
Post 7: Creating Your First SSID – Building the Wireless Network (Week 7)
Purpose Guide readers through SSID creation with security, VLAN, and RF settings, resulting in a live, joinable wireless network. Content Outline What is an SSID? SSID = Service Set Identifier (the Wi-Fi network name users see) Each SSID represents a wireless network...
Post 7: Creating Your First SSID – Building the Wireless Network (Week 7)
Purpose Guide readers through SSID creation with security, VLAN, and RF settings, resulting in a live, joinable wireless network. Content Outline What is an SSID? SSID = Service Set Identifier (the Wi-Fi network name users see) Each SSID represents a wireless network...
0 Comments