Security

I was under the impression that clearpass redundancy would have to be set at the authenticator level (switches/controllers)?

I.e. I would have to add the publisher and the subscriber nodes as 2 seperate radius servers in my authenticating server group in my wlan controllers.

Now I see however a "virtual ip settings" option in clearpass 6.1 (not sure if it was there in earlier versions).

Is this indeed like a vrrp where I enter both publisher and its subscriber with the result that my server group only needs the virtual-ip configured?

Any advantages of this over configuring 2 auth servers in your authenticators?

The virtual IP in 6.1 does indeed provide similar functionality to VRRP. You would point your devices to the single virtual IP. I think the benefits would depend on your network. If you have hundreds of switches and controllers, it's much easier to add a single RADIUS server config.

Can a vip be assigned to the data and management interfaces?

I only ask as i get an error when trying to assign a vip to the data interfaces after adding a vip to the mgmt interfaces.

cheers

I think your issue is that you don't have both IP addresses on the same segment 

I know :smileyembarrassed:

bit of a typo missed the 1 got so excited to test this new feature that I missed the typo.

Using Virtual IP interfaces in a ClearPass Cluster:

http://www.youtube.com/watch?v=0kk8HSoPiZQ

High availability for a ClearPass Cluster

http://www.youtube.com/watch?v=dHLRU_kYsUs