Security

Reply
Occasional Contributor I
Posts: 5
Registered: ‎03-30-2015

Branch deployment (Gotchas of EAP over Internet) + Multiple branch with same private IP

Hello I am involved in mulitple branch deployment connected via Internet to Head office where ClearPass will be located. Two issues I am dealing with for 802.1X designing EAP-PEAP for Corporate users. 200 Branches.

 

1. Branches have IAP's. I want to use EAP for Corporate users. I have been told that I cannot simply run EAP in scenario below. I must do some kind of tunnel from branch IAP to head office. 

Branches have IAP with (Private IP address)> .....<Internet Public IP>.........<(Private IP) Head office ClearPass location.

If this is true. It means, I must add a controller at the head office to do site to site VPN.

 

2. Above scenario (tunnelled) creates problem for us. Currtly multiple branches have same IP addresses assinged.

 

Can I deploy without tunne? if not, how do I resolved the multi - branch same private IP address issue.

 

Thanks

 

 

 

Guru Elite
Posts: 8,191
Registered: ‎09-08-2010

Re: Branch deployment (Gotchas of EAP over Internet) + Multiple branch with same private IP

You would need a small controller and you would set the RADIUS source IP as the inner address of the Instant side of the tunnel.


Thanks,
Tim

Tim Cappalli | Aruba ClearPass TME
@timcappalli | ACMX #367 / ACCX #480 / ACEAP / CWSP
Occasional Contributor I
Posts: 5
Registered: ‎03-30-2015

Re: Branch deployment (Gotchas of EAP over Internet) + Multiple branch with same private IP

Hi Tim,

Clarification need from your response. I will need a samll controller at the branch location or head office?

and how I deal with my issued number 2. Mulitple branches with same private IP addresses. Tunnel will creat problem?

 

Thanks

 

Guru Elite
Posts: 8,191
Registered: ‎09-08-2010

Re: Branch deployment (Gotchas of EAP over Internet) + Multiple branch with same private IP

Controller at the head end office and you'd have to get creative with NAT to use the same IP space everywhere.


Tim Cappalli | Aruba ClearPass TME
@timcappalli | ACMX #367 / ACCX #480 / ACEAP / CWSP
Search Airheads
Showing results for 
Search instead for 
Did you mean: