Wireless Access

 View Only
last person joined: 5 days ago 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

ClearPass cluster VIP and routing rules

This thread has been viewed 11 times

  • 1.  ClearPass cluster VIP and routing rules

    Posted Feb 02, 2024 10:03 AM

    Good Afternoon,

    We have a cluster of two clearpass servers set up with a VIP using the management interface. We also have our VPN gateways on the same VLAN  or /24 network.

    We have a problem when VPN users try to authenticate a Guest access request. The clearpass servers have a default route defined which is our core router. The problem is when a VPN user tries to access a CP server the return traffic is sent to the router, not the VPN gateway device.

    We partially  solved this by adding network rules to each node such as

    network ip add mgmt -i 500 -d 10.255.0.0/21   -g 192.168.1.55   

    This work when the VPN user is connecting to the IP address of the cluster member, not the VIP, if the VIP is used the traffic goes to the router and is lost.

    Is there any way of applying the routing rules to the VIP

    Can anyone tell me if adding a rule

    network ip add mgmt -i 502 -s 192.168.1.50  -d 10.255.0.0/21   -g 192.168.1.55

    is likely to work or will it break the cluster or will the command just fail, I am have trouble getting an outage window to test

    192.168.1.1 - Core Router

    192.168.1.50 - Cluster VIP

    192.168.1.51 - Cluster Publisher

    192.168.1.52 - Cluster Subscriber

     Network Commands

    Arubanetworks remove preview
    Network Commands
    The ClearPass Policy Manager command line interface includes the following commands: network ip6 network ping6 network reset network traceroute6 network traceroute Use the command to add, delete, or list custom routes to the data or management interface routing table in IPv6 networks.
    View this on Arubanetworks >



  • 2.  RE: ClearPass cluster VIP and routing rules

    Posted Feb 14, 2024 04:30 AM

    Did you get anywhere with this? I try to avoid using the data interface whenever possible, but think that if traffic destined for a virtual IP on the management port is returned to the data port, that would be considered a bug. Did you open a support case for this?

    As nobody responded yet, and you mention that it's production and you can't take risks of outages, it may be wise to build/test this in lab before deploying in production. That may be something that your Aruba partner or Aruba support can assist with.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message