Security

Hi,

 

Let me present a Guest access scenario.

 

Company is using two separate subnets for Corporate (10.x.x.x) and Guest (172.x.x.x) users. ClearPass cluster is providing wireless 802.1X and Guest services. Management port is configured with IP in Corporate subnet, while Data port is configured with IP in Guest one.

 

WLAN infrastructure is pointing towards Captive Portal page on Guest subnet (https://10.x.x.x/<page_name>.php), and when user connects to Guest SSID CP page with self-registration is displayed. After entering and confirming required details, account info is displayed on the page.

 

My question is what happened after clicking on "Log In" button on the login page, and how are authentication/RADIUS packets flowing?

 

My guess is that when user (10.x.x.x) tries to log in, his request is sent to Management port (172.x.x.x) in the form of RADIUS request, processed by Policy Manager, and resulting acceptance/rejection returned back to a user.

 

So, questions are: a) is that authentication flow correct, or not, b) if correct, what is the purpose of Data port in Guest scenario, c) how would you design this more elegantly.

 

Thanks everyone in advance.

 

Cheers,

Alan

My guess is that when user (10.x.x.x) tries to log in, his request is sent to Management port (172.x.x.x) in the form of RADIUS request, processed by Policy Manager, and resulting acceptance/rejection returned back to a user.
This correct

One of the use cases is to place the data port in the DMZ to host the captive portal page (Guest , Onguard , Onboard) and that way the guest/quarantine user is not able to reach the internal(management port) interface of the ClearPass appliance

Thanks Victor,

 

Much appreciated. One last question, if DMZ doesn't exist in our scenario would removing Data port be good/bad/not making any difference?

 

I am asking this one as either we move imagined CP page on https://172.x.x.x/<page_name>.php, or not, there will be need for inter-VLAN (10. client to 172. port) traffic to exist (if not on port 80, then at least on 1812/1813), right?

 

 

Regards,

Alan

It really comes down to preference and use case.

But using just the ClearPass Mgmt port is not bad practice.

https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=20523

Thanks Troy, really good document, haven't read it before.

 

Regards,

Alan