Security

Do I need to join and bind CPPM to AD in order to perform EAP-TLS authentication for a client?

No.

Hi,

   I've got a user testing this at the moment and its failing.

They are getting -

Alerts for this Request 

Not sure I known how to point the authentication to the customers cert that I have installed in the trust list on CPPM?

Why do you have the endpoints repository as an auth source? That should be your identity store.

Hi Tim,

 It wont let me leave it blank - is there something else that should be there instead?

I'm hoping to auth against the cert in the trust list - have I uploaded the cert to the wrong location?

So you don't want to validate that the user account  actually exists in your identity store?

No I dont think so, the customer doesn't have any link to AD for the devices so its just a match for a valid certificate I guess. CPPM Is a replacement for NPS - not being an expert I don't fully understand what they were checking and they couldn't explain fully.

Create a new EAP-TLS method with authorization disabled.

Hi Tim,

   I've created and added that to the service and it has a different error in the Alert tab -

[Endpoints Repository] - localhost: User not found.
EAP-TLS: fatal alert by client - unknown_ca
TLS Handshake failed in SSL_read with error:14094418:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca
eap-tls: Error in establishing TLS session

1) Remove all authentication sources.

2) The client does not trust the EAP server certificate

Hi Tim,

    I assume this means the ClearPass certificate? The user doesn't see any cert errors (perhaps they are not displayed). Should I get the user to install the CPPM cert in their trust list?

Deploying certificates need to be carefully planned out and shouldn't be done with changes on the fly like this. Have you reached out to your Aruba partner?

Hi Tim

  The client certs are already deployed, we are migrating the customer from NPS to CPPM. I am the Aruba partner, but none of the documentation on CPPM explains how to do what I've need to achieve here.

The clients need to be configured to properly trust the EAP server certificate.

I wish there was a step by step guide for those of us that haven't ever done eap-tls / cert based authentication with clearpass with apple / jamf. 

All the guides I see are for AD bound devices and sadly that doesn't help :(

Original Message:
Sent: Jun 20, 2018 08:22 AM
From: cappalli
Subject: EAP-TLS

The clients need to be configured to properly trust the EAP server certificate.

We are going to use the certs & consulting services of SecureW2 to implement EAP/TLS in our large campus environment.  More to report over the next few months. 

Original Message:
Sent: Feb 10, 2024 08:28 AM
From: Thorleik Lodinsson
Subject: EAP-TLS

I wish there was a step by step guide for those of us that haven't ever done eap-tls / cert based authentication with clearpass with apple / jamf. 

All the guides I see are for AD bound devices and sadly that doesn't help :(

Original Message:
Sent: Jun 20, 2018 08:22 AM
From: cappalli
Subject: EAP-TLS

The clients need to be configured to properly trust the EAP server certificate.

We are already wuite a ways down that path with SecureW2. Since this is a little off-topic, competing with CPPM OnBoard, please reach out to me in a PM.

------------------------------
Bruce Osborne ACCP ACMP
Liberty University

The views expressed here are my personal views and not those of my employer
------------------------------

Original Message:
Sent: Feb 12, 2024 09:50 AM
From: ucbob
Subject: EAP-TLS

We are going to use the certs & consulting services of SecureW2 to implement EAP/TLS in our large campus environment.  More to report over the next few months. 

Original Message:
Sent: Feb 10, 2024 08:28 AM
From: Thorleik Lodinsson
Subject: EAP-TLS

I wish there was a step by step guide for those of us that haven't ever done eap-tls / cert based authentication with clearpass with apple / jamf. 

All the guides I see are for AD bound devices and sadly that doesn't help :(

Original Message:
Sent: Jun 20, 2018 08:22 AM
From: cappalli
Subject: EAP-TLS

The clients need to be configured to properly trust the EAP server certificate.