Security

Hi all,

Our Clearpass Policy server was setup by a 3rd party. It's two policy servers, let's call the A-NAC01 and A-NAC02

When I check the server configuration I see the following

Hostname A-NAC01
FQDN is blank

(Same for A-NAC02)

When I check the cert that devices check it is CN=A-NAC01

When I'm setting up a wired configuration, and specify the NAC server, should I just use A-NAC01? Is there an issue with how this is setup?

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

Thanks, this is really clear.

Just one further question if I may, the IP address in the SAN, does that point to the Virtual IP of that node? So we just have two nodes, publisher and subscriber so would it be

CN=NAC.Company.Loc
SAN=DNS:node1.domain.com,IP:Virtual IP of this node,DNS:node2.domain.com,IVirtual IP of this node,"

I'll need to check the GPO now and see what our 802.1x policy is pointing to.

Original Message:
Sent: Mar 31, 2023 02:00 PM
From: 802.zak
Subject: FQDN

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

------------------------------
Zak Chalupka
Principal Engineer - HPE Aruba
ACDX | ACMP | ACSP | ACCP
wifizak@hpe.com

Original Message:
Sent: Mar 31, 2023 01:30 PM
From: DaveG
Subject: FQDN

"the IP address in the SAN, does that point to the Virtual IP of that node?"

Dave, from a client perspective, the values listed in the SAN fields, whether IP addresses or DNS names, must match the destination the client is trying to reach. So if you have listed a VIP on your infrastructure config somewhere for a client to a make a connection to, then yes - add the VIP.

I'd list the VIPs (along with the FQDNs that match the VIP if any) but you really should list the unique IPs/FQDNs of the servers as well, because otherwise, you can't be sure which server you are accessing (via the web GUI for example). How can you be sure that another server hasn't taken ownership of that VIP?

I rarely use IPs in my certs, but if I have to (usually from customer demands), I'd submit a CSR that looks like this:

CN = clearpass.domain.name
## SAN ##
DNS.1 = clearpass.domain.name
DNS.2 = node1.domain.name
DNS.3 = node2.domain.name
IP.1 = 10.0.0.111 (node1 VIP)
IP.2 = 10.0.0.101 (node1 unique IP)
IP.1 = 10.0.0.112 (node2 VIP)
IP.2 = 10.0.0.102 (node2 unique IP)

Some browsers no longer check the CN field, so you should include the CN as a SAN entry to ensure 100% compatibility with all client devices.

------------------------------
Regards,

Brett V

Original Message:
Sent: Apr 01, 2023 09:07 AM
From: DaveG
Subject: FQDN

Thanks, this is really clear.

Just one further question if I may, the IP address in the SAN, does that point to the Virtual IP of that node? So we just have two nodes, publisher and subscriber so would it be

CN=NAC.Company.Loc
SAN=DNS:node1.domain.com,IP:Virtual IP of this node,DNS:node2.domain.com,IVirtual IP of this node,"

I'll need to check the GPO now and see what our 802.1x policy is pointing to.

Original Message:
Sent: Mar 31, 2023 02:00 PM
From: 802.zak
Subject: FQDN

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

------------------------------
Zak Chalupka
Principal Engineer - HPE Aruba
ACDX | ACMP | ACSP | ACCP
wifizak@hpe.com

Original Message:
Sent: Mar 31, 2023 01:30 PM
From: DaveG
Subject: FQDN

All, thank you so much.

Apologies for the multiple questions!

"the IP address in the SAN, does that point to the Virtual IP of that node?"

Dave, from a client perspective, the values listed in the SAN fields, whether IP addresses or DNS names, must match the destination the client is trying to reach. So if you have listed a VIP on your infrastructure config somewhere for a client to a make a connection to, then yes - add the VIP.

I'd list the VIPs (along with the FQDNs that match the VIP if any) but you really should list the unique IPs/FQDNs of the servers as well, because otherwise, you can't be sure which server you are accessing (via the web GUI for example). How can you be sure that another server hasn't taken ownership of that VIP?

I rarely use IPs in my certs, but if I have to (usually from customer demands), I'd submit a CSR that looks like this:

CN = clearpass.domain.name
## SAN ##
DNS.1 = clearpass.domain.name
DNS.2 = node1.domain.name
DNS.3 = node2.domain.name
IP.1 = 10.0.0.111 (node1 VIP)
IP.2 = 10.0.0.101 (node1 unique IP)
IP.1 = 10.0.0.112 (node2 VIP)
IP.2 = 10.0.0.102 (node2 unique IP)

Some browsers no longer check the CN field, so you should include the CN as a SAN entry to ensure 100% compatibility with all client devices.

------------------------------
Regards,

Brett V

Original Message:
Sent: Apr 01, 2023 09:07 AM
From: DaveG
Subject: FQDN

Thanks, this is really clear.

Just one further question if I may, the IP address in the SAN, does that point to the Virtual IP of that node? So we just have two nodes, publisher and subscriber so would it be

CN=NAC.Company.Loc
SAN=DNS:node1.domain.com,IP:Virtual IP of this node,DNS:node2.domain.com,IVirtual IP of this node,"

I'll need to check the GPO now and see what our 802.1x policy is pointing to.

Original Message:
Sent: Mar 31, 2023 02:00 PM
From: 802.zak
Subject: FQDN

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

------------------------------
Zak Chalupka
Principal Engineer - HPE Aruba
ACDX | ACMP | ACSP | ACCP
wifizak@hpe.com

Original Message:
Sent: Mar 31, 2023 01:30 PM
From: DaveG
Subject: FQDN

Hi, just one thing to add.

You need to list the IPs only if someone or something it's going to access clearpass using the IPs. If you are only going to use FQDNs to reach the Clearpass servers you just need the DNS entries on the SANs field as Brettv said.

I hope this helps

All, thank you so much.

Apologies for the multiple questions!

"the IP address in the SAN, does that point to the Virtual IP of that node?"

Dave, from a client perspective, the values listed in the SAN fields, whether IP addresses or DNS names, must match the destination the client is trying to reach. So if you have listed a VIP on your infrastructure config somewhere for a client to a make a connection to, then yes - add the VIP.

I'd list the VIPs (along with the FQDNs that match the VIP if any) but you really should list the unique IPs/FQDNs of the servers as well, because otherwise, you can't be sure which server you are accessing (via the web GUI for example). How can you be sure that another server hasn't taken ownership of that VIP?

I rarely use IPs in my certs, but if I have to (usually from customer demands), I'd submit a CSR that looks like this:

CN = clearpass.domain.name
## SAN ##
DNS.1 = clearpass.domain.name
DNS.2 = node1.domain.name
DNS.3 = node2.domain.name
IP.1 = 10.0.0.111 (node1 VIP)
IP.2 = 10.0.0.101 (node1 unique IP)
IP.1 = 10.0.0.112 (node2 VIP)
IP.2 = 10.0.0.102 (node2 unique IP)

Some browsers no longer check the CN field, so you should include the CN as a SAN entry to ensure 100% compatibility with all client devices.

------------------------------
Regards,

Brett V

Original Message:
Sent: Apr 01, 2023 09:07 AM
From: DaveG
Subject: FQDN

Thanks, this is really clear.

Just one further question if I may, the IP address in the SAN, does that point to the Virtual IP of that node? So we just have two nodes, publisher and subscriber so would it be

CN=NAC.Company.Loc
SAN=DNS:node1.domain.com,IP:Virtual IP of this node,DNS:node2.domain.com,IVirtual IP of this node,"

I'll need to check the GPO now and see what our 802.1x policy is pointing to.

Original Message:
Sent: Mar 31, 2023 02:00 PM
From: 802.zak
Subject: FQDN

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

------------------------------
Zak Chalupka
Principal Engineer - HPE Aruba
ACDX | ACMP | ACSP | ACCP
wifizak@hpe.com

Original Message:
Sent: Mar 31, 2023 01:30 PM
From: DaveG
Subject: FQDN

Thanks, but does that mean I need to add the nodes and IP on our standard DNS server?

 Or that as long as the cert is providing the three FQDNs, the clients will accept that? This is just for client/radius auth, not accessing via HTTP.

Hi, just one thing to add.

You need to list the IPs only if someone or something it's going to access clearpass using the IPs. If you are only going to use FQDNs to reach the Clearpass servers you just need the DNS entries on the SANs field as Brettv said.

I hope this helps

All, thank you so much.

Apologies for the multiple questions!

"the IP address in the SAN, does that point to the Virtual IP of that node?"

Dave, from a client perspective, the values listed in the SAN fields, whether IP addresses or DNS names, must match the destination the client is trying to reach. So if you have listed a VIP on your infrastructure config somewhere for a client to a make a connection to, then yes - add the VIP.

I'd list the VIPs (along with the FQDNs that match the VIP if any) but you really should list the unique IPs/FQDNs of the servers as well, because otherwise, you can't be sure which server you are accessing (via the web GUI for example). How can you be sure that another server hasn't taken ownership of that VIP?

I rarely use IPs in my certs, but if I have to (usually from customer demands), I'd submit a CSR that looks like this:

CN = clearpass.domain.name
## SAN ##
DNS.1 = clearpass.domain.name
DNS.2 = node1.domain.name
DNS.3 = node2.domain.name
IP.1 = 10.0.0.111 (node1 VIP)
IP.2 = 10.0.0.101 (node1 unique IP)
IP.1 = 10.0.0.112 (node2 VIP)
IP.2 = 10.0.0.102 (node2 unique IP)

Some browsers no longer check the CN field, so you should include the CN as a SAN entry to ensure 100% compatibility with all client devices.

------------------------------
Regards,

Brett V

Original Message:
Sent: Apr 01, 2023 09:07 AM
From: DaveG
Subject: FQDN

Thanks, this is really clear.

Just one further question if I may, the IP address in the SAN, does that point to the Virtual IP of that node? So we just have two nodes, publisher and subscriber so would it be

CN=NAC.Company.Loc
SAN=DNS:node1.domain.com,IP:Virtual IP of this node,DNS:node2.domain.com,IVirtual IP of this node,"

I'll need to check the GPO now and see what our 802.1x policy is pointing to.

Original Message:
Sent: Mar 31, 2023 02:00 PM
From: 802.zak
Subject: FQDN

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

------------------------------
Zak Chalupka
Principal Engineer - HPE Aruba
ACDX | ACMP | ACSP | ACCP
wifizak@hpe.com

Original Message:
Sent: Mar 31, 2023 01:30 PM
From: DaveG
Subject: FQDN

Thanks, but does that mean I need to add the nodes and IP on our standard DNS server?

 Or that as long as the cert is providing the three FQDNs, the clients will accept that? This is just for client/radius auth, not accessing via HTTP.

Hi, just one thing to add.

You need to list the IPs only if someone or something it's going to access clearpass using the IPs. If you are only going to use FQDNs to reach the Clearpass servers you just need the DNS entries on the SANs field as Brettv said.

I hope this helps

All, thank you so much.

Apologies for the multiple questions!

"the IP address in the SAN, does that point to the Virtual IP of that node?"

Dave, from a client perspective, the values listed in the SAN fields, whether IP addresses or DNS names, must match the destination the client is trying to reach. So if you have listed a VIP on your infrastructure config somewhere for a client to a make a connection to, then yes - add the VIP.

I'd list the VIPs (along with the FQDNs that match the VIP if any) but you really should list the unique IPs/FQDNs of the servers as well, because otherwise, you can't be sure which server you are accessing (via the web GUI for example). How can you be sure that another server hasn't taken ownership of that VIP?

I rarely use IPs in my certs, but if I have to (usually from customer demands), I'd submit a CSR that looks like this:

CN = clearpass.domain.name
## SAN ##
DNS.1 = clearpass.domain.name
DNS.2 = node1.domain.name
DNS.3 = node2.domain.name
IP.1 = 10.0.0.111 (node1 VIP)
IP.2 = 10.0.0.101 (node1 unique IP)
IP.1 = 10.0.0.112 (node2 VIP)
IP.2 = 10.0.0.102 (node2 unique IP)

Some browsers no longer check the CN field, so you should include the CN as a SAN entry to ensure 100% compatibility with all client devices.

------------------------------
Regards,

Brett V

Original Message:
Sent: Apr 01, 2023 09:07 AM
From: DaveG
Subject: FQDN

Thanks, this is really clear.

Just one further question if I may, the IP address in the SAN, does that point to the Virtual IP of that node? So we just have two nodes, publisher and subscriber so would it be

CN=NAC.Company.Loc
SAN=DNS:node1.domain.com,IP:Virtual IP of this node,DNS:node2.domain.com,IVirtual IP of this node,"

I'll need to check the GPO now and see what our 802.1x policy is pointing to.

Original Message:
Sent: Mar 31, 2023 02:00 PM
From: 802.zak
Subject: FQDN

For Context, it is generally best practice for the nodes to share a CERT.
The CN will be a FQDN representing both nodes i.e. "clearpass.domain.com"
Then you will add SANs to the CERT to represent each individual node i.e. "DNS:node1.domain.com,IP:10.0.0.11,DNS:node2.domain.com,IP:10.0.0.12"

------------------------------
Zak Chalupka
Principal Engineer - HPE Aruba
ACDX | ACMP | ACSP | ACCP
wifizak@hpe.com

Original Message:
Sent: Mar 31, 2023 01:30 PM
From: DaveG
Subject: FQDN