Security

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

Where are you located? We are in the US. Last July, we moved our users from a PEAP-MSCHAPv2 SSID to eduroam & TLS. We use ClearPass & AOS 8 wireless, but we use a third-party cloud provider for personal device onboarding & EAP-TLS certificate PKI.

We started with CPPM 6.9.x and are moving to 6.12.x. We currently use AD for authorization but will be moving to Entra ID. Have you joined the Eduroam Admins mailing list?

If you send me a PM we can exchange email addresses & we can likely help you through the details as best we know.

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

Here is my concern also :

1. Is clearpass local database supported by eduroam as identity store or do I need an microsoft AD, LDAP Server etc. ?
2. Do I need to have clearpass both end from the school FLR so the server will communicate properly ?

Where are you located? We are in the US. Last July, we moved our users from a PEAP-MSCHAPv2 SSID to eduroam & TLS. We use ClearPass & AOS 8 wireless, but we use a third-party cloud provider for personal device onboarding & EAP-TLS certificate PKI.

We started with CPPM 6.9.x and are moving to 6.12.x. We currently use AD for authorization but will be moving to Entra ID. Have you joined the Eduroam Admins mailing list?

If you send me a PM we can exchange email addresses & we can likely help you through the details as best we know.

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

I'm confused how a non-corporate owned device would get the EAP-TLS certificate.  Would the user have to do something manually to load it or can this be an automated process?  We're a university so we have a combination of corporate and non-corporate devices connecting to our Eduroam network.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

I'm confused how a non-corporate owned device would get the EAP-TLS certificate.  Would the user have to do something manually to load it or can this be an automated process?  We're a university so we have a combination of corporate and non-corporate devices connecting to our Eduroam network.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.

For eduroam, you may have a look at 'geteduroam', which is used in parts of Europe, but may be open to other parts of the world as well. It has facilities for onboarding end-user devices with EAP-TLS and issueing client certificates as part of that process. It's similar to ClearPass Onboard, or the tool Bruce is referring to, but specific for (and by) eduroam/higher education. 

I'm confused how a non-corporate owned device would get the EAP-TLS certificate.  Would the user have to do something manually to load it or can this be an automated process?  We're a university so we have a combination of corporate and non-corporate devices connecting to our Eduroam network.

I know there are many customers using ClearPass for eduroam (or govroam, or publicroam which are similar mechanisms). For RADIUS proxy, I would not rely too much on policy simulation. Do you see in Access Tracker the correct service matched? Do you see the same with an actual request through a wireless SSID eduroam?

Did you register/authorized your ClearPass with the public IP (or NAT) with your federation partner/national eduroam? If the source IP or shared secret doesn't match, the FLR may just drop your incoming requests.

Access Tracker may provide more information (Alert tab, show logs). Also, you could run a packet capture on ClearPass (via Server Manager, Collect Logs) or an upstream device to see if there is a RADIUS packet going out (and maybe coming back).

Your authentication seems that the RADIUS service does not respond, which may be service classification, RADIUS shared secrets, firewall, routing, etc.

Working with your Aruba partner or Aruba TAC may be useful as well, to step by step find where in the process the issue may be and from there troubleshoot more specifically. Eduroam proxy is quite common and should just work if you 'follow the rules' (in ClearPass, routing, firewalls, with your national provider).

Hello Everyone, 

I just want to ask if anyone of you already setup a Eduroam with Clearpass ? it seems that there is no valid documentation for clearpass integration . I just read the documentation from Giant https://archive.geant.org/projects/gn3/geant/services/cbp/Documents/cbp-79_guide_to_configuring_eduroam_using_the_aruba_wireless_controller_and_clearpass.pdf but it seems not updated. if anyone already implement it and you have a step by step guide , may I ask for your guidance. as of now im having trouble in communicating between the FLR server still figuring out why it wont able to reach the FLR (Federal Level Radius server )server and it gives me a radius authentication failed error.