Hi
One of the news in ClearPass 6.11 is the option to configure multiple TACACS+ server addresses instead of just one.
The TACACS+ server must send the correct attributes back to ClearPass, compare with the standard enforcement profiles for administrative login i.e. [TACACS Super Admin].
If you have custom admin privileges you have to return the matching names.
Yes, local authentication is still working. In the use case where I have utilized this it has been good. As a service provider I send authentications back to uor ClearPass, but sometimes local technicians within the customer network must be able to authenticate as well to get a read only role in ClearPass.
But I agree, it could be an option at least to not allow local authentication as long as the TACACS server is available
I have only tested to utilize this to other ClearPass servers and not with 2FA/MFA scenarios.
For Admin logon with smart card I have integrated with ADFS or utilized ClearPass as the IdP for SAML authentication.
If you have smart card this may be the easiest way to get 2FA/MFA.
------------------------------
Best Regards
Jonas Hammarbäck
MVP 2023, ACCX #1335, ACMP, ACDP, ACP-Network Security, ACEP, ACSA
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------
Original Message:
Sent: Jan 18, 2023 06:00 AM
From: dannybosman
Subject: clearpass admin access with TACACS authentication
Hi
we need to authenticate the admin access to clearpass via TACACS+ (external) server. Today we use an external LDAP / AD server, which works fine, but this implementation does not support (in our setup) 2FA/MFA . So the tacacs server is integrated with a 2FA solution (gemalto), used by many other network devices (switches, router, airwave, AOS8 etc)
We found the tacacs configuration in "server configuration" - "cluster wide parameters"
a few questions
- only 1 tacacs server is supported? (really ?) No redundant setup possible (we have multiple independant tacacs server - no VIP)
- what additional configuration is needed, i assume some changes on the services for admin access ? But how exactly? I couldn't find an e2e explanation on airheads
- the local admin always keeps working, even if the tacacs server is responding. This is a weird solution, as it is possible to bypass normal authentication any time (a standard behavior would be when the tacacs server is responding, the local admin accounts can't be used, as implemented in many other products)
- what other solutions are possible for 2FA/MFA (admin access to clearpass). i.e. integration with AAD possible ? Any practical reference document ?
I know - a lot of questions - so many thanks for your support !
------------------------------
Danny Bosman
KBC Group - Belgium
------------------------------