Security

We are using a 3 member CPPM Cluster, geographically separated. The #2 CPPM is the publisher, #1 & #3 are subscribers. When a guest that points to #1 CPPM for registration, they are presented with the registration page but when they click Submit, they receive a message stating:

"Received Request From Unknown Subscriber"

and the registration page just stays there. 

When I point them to the #2 CPPM (Publisher), the registration works properly. 
I am under the impression that subscribers can handle Guest Registrations and they pass the information to the Publisher. Is this not the case, or do I have something else wrong? 
I am not sure what information I should provide for troubleshooting, please let me know. 

UPDATE: Also I notice that when I go to the Guest Manager of the Subscriber node and click on Manage Accounts, I get that exact same message. I tried removing the subscriber from the Cluster and re-adding it, but that did not work. I am also seeing this exact same issue on the #3 subscriber, so it is not isolated to just the #2 server. 

The ClearPass Subscriber can handle guest registration as long as the Publisher is rechable. Subscriber will proxy the information to the publisher and get the same written/replicated to the subscribers.

Do you have Data Interface configured on the Subscriber(#1)?

Are the Publisher and Subscriber MGMT interfaces on different Subnets?

If the answers for the above questions are true, then there might be a chance where the Subscriber(#1) contacting the Publisher via its data interface for guest registration/lookup and getting the error "Received Request From Unknown Subscriber", since the publisher is only aware of Subscriber's MGMT interface.

Please confirm the above, we will be able to work around this with a static route on subscriber.

Hi,

Here, subscriber was trying to contact Publisher's Management IP through it's Data port.

So, we needed to write route in the subscriber to tell it to go through the Management interface, if it is trying to reach the Publisher's Management IP.

It worked prefectly..

Hi,

Here, subscriber was trying to contact Publisher's Management IP through it's Data port.

So, we needed to write route in the subscriber to tell it to go through the Management interface, if it is trying to reach the Publisher's Management IP.