Security

 View Only
last person joined: yesterday 

Enterprise security using ClearPass Policy Management, ClearPass Security Exchange, IntroSpect, VIA, 360 Security Exchange, Extensions and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

ClearPass in Azure - Azure Load Balancer for RADIUS

This thread has been viewed 30 times
  • 1.  ClearPass in Azure - Azure Load Balancer for RADIUS

    Posted Oct 02, 2022 11:53 PM
    Hi Airheads,

    Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

    I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

    Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

    PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

    Thanks in advance
    Scott


  • 2.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    EMPLOYEE
    Posted Oct 03, 2022 12:45 AM
    just note that you can always configure VIPs on clearpass cluster and make use of all three nodes.

    ------------------------------
    Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
    ------------------------------



  • 3.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    Posted Oct 03, 2022 01:26 AM
    Hi Ariyap

    VIP address configuration is not supported in the Azure and AWP distributions of ClearPass, only on traditional virtual servers and hardware.
    Hence the need for the Azure load balancer in this case.

    Unfortunately I don't have any experiance with ClearPass behind Azure load balancers. Only traditional servers with traditional load balancer, and this works very well with EAP-TLS.

    ------------------------------
    Best Regards
    Jonas Hammarbäck
    ACCX #1335, ACMP, ACDP, ACNSP, ACEP
    Aranya AB
    ------------------------------



  • 4.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    Posted Nov 08, 2022 04:51 AM
    Hi Scott

    Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

    I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

    ------------------------------
    John-Egil Solberg |
    ACMX | ACCX
    ------------------------------



  • 5.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS
    Best Answer

    Posted Nov 08, 2022 02:35 PM
    Hey John-Egil,

    I sure did and i've been meaning to update this post so thanks for the prompt.

    The issue was that the client certificate response from the AP was sent with a paylod size that exceeded the MTU causing IP level fragmentation.

    I was able to work with TAC to implement a fix in AOS 10 using API calls to change the group config.

    There is a command "dot1x eap-frag-mtu <IPMTU> which can be applied to the AP to reduce the size of the EAP response. I set this to 1100 and the EAP packets were fragmented within the RADIUS packets, rather than at the IP level, this allowed them to pass through the Azure load balancer no problem!

    This setting is not available via Aruba Central GUI so i had to use API to push this to the group config. For this is used the Aruba central automation studio (Thanks Aaron!) which is here: https://central.wifidownunder.com/


  • 6.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    Posted Nov 08, 2022 03:33 PM
    Thanks for the quick reply Scott!

    We're using a Controller-based solution with AOS 8.9 so it's not quite the same setup, but it's AOS so... After looking a fair bit around in the Controller GUI I found the setting! It's a global setting so will affect the entire controller/level you add the value on.

    Authentication -> Advanced -> EAP Fragmentation IP MTU

    Currently it's empty, and when I do "show dot1x eap-frag-mtu" it shows me nothing.

    Will let you know how that works out for us :)

    ------------------------------
    John-Egil Solberg |
    ACMX | ACCX
    ------------------------------



  • 7.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    Posted Nov 09, 2022 07:20 AM
    It worked!!

    Now I just wonder if this is how it will be for everyone who implements Radius in Azure or if it's case-specific depending on what is handling the traffic en route to Azure. This customer has a site-to-site VPN to Azure.

    ------------------------------
    John-Egil Solberg |
    ACMX | ACCX
    ------------------------------



  • 8.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    Posted Nov 10, 2022 02:40 PM
    great news! glad to hear it worked for you too!


  • 9.  RE: ClearPass in Azure - Azure Load Balancer for RADIUS

    MVP EXPERT
    Posted Nov 10, 2022 05:45 PM
    We have ClearPass in Azure and had the same issues.

    Learned that RADIUS (UDP) is not WAN aware and Azure don't support UDP fragments.

    The best solution is to move away from RADIUS and use RADSEC (Radius over TLS) to avoid this. RADSEC using TCP packages that are WAN aware.

    You can also set "dot1x eap-frag-mtu <value>"on your switches and access points but thats more a workaround than fixing the protocol limitations.

    ------------------------------
    Marcel Koedijk | MVP Expert 2022 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own
    ------------------------------