Security

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues. 

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

just note that you can always configure VIPs on clearpass cluster and make use of all three nodes.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.
------------------------------

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

Hi Ariyap

VIP address configuration is not supported in the Azure and AWP distributions of ClearPass, only on traditional virtual servers and hardware.
Hence the need for the Azure load balancer in this case.

Unfortunately I don't have any experiance with ClearPass behind Azure load balancers. Only traditional servers with traditional load balancer, and this works very well with EAP-TLS.

------------------------------
Best Regards
Jonas Hammarbäck
ACCX #1335, ACMP, ACDP, ACNSP, ACEP
Aranya AB
------------------------------

Original Message:
Sent: Oct 03, 2022 12:44 AM
From: Ariya Parsamanesh
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

just note that you can always configure VIPs on clearpass cluster and make use of all three nodes.

------------------------------
Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba.

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

Hi Scott

Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

------------------------------
John-Egil Solberg |
ACMX | ACCX
------------------------------

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

Hey John-Egil,

I sure did and i've been meaning to update this post so thanks for the prompt. 

The issue was that the client certificate response from the AP was sent with a paylod size that exceeded the MTU causing IP level fragmentation. 

I was able to work with TAC to implement a fix in AOS 10 using API calls to change the group config. 

There is a command "dot1x eap-frag-mtu <IPMTU> which can be applied to the AP to reduce the size of the EAP response. I set this to 1100 and the EAP packets were fragmented within the RADIUS packets, rather than at the IP level, this allowed them to pass through the Azure load balancer no problem!

This setting is not available via Aruba Central GUI so i had to use API to push this to the group config. For this is used the Aruba central automation studio (Thanks Aaron!) which is here: https://central.wifidownunder.com/
Original Message:
Sent: Nov 08, 2022 04:50 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Scott

Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

Thanks for the quick reply Scott!

We're using a Controller-based solution with AOS 8.9 so it's not quite the same setup, but it's AOS so... After looking a fair bit around in the Controller GUI I found the setting! It's a global setting so will affect the entire controller/level you add the value on.

Authentication -> Advanced -> EAP Fragmentation IP MTU

Currently it's empty, and when I do "show dot1x eap-frag-mtu" it shows me nothing.

Will let you know how that works out for us :)

------------------------------
John-Egil Solberg |
ACMX | ACCX
------------------------------

Original Message:
Sent: Nov 08, 2022 02:35 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hey John-Egil,

I sure did and i've been meaning to update this post so thanks for the prompt.

The issue was that the client certificate response from the AP was sent with a paylod size that exceeded the MTU causing IP level fragmentation.

I was able to work with TAC to implement a fix in AOS 10 using API calls to change the group config.

There is a command "dot1x eap-frag-mtu <IPMTU> which can be applied to the AP to reduce the size of the EAP response. I set this to 1100 and the EAP packets were fragmented within the RADIUS packets, rather than at the IP level, this allowed them to pass through the Azure load balancer no problem!

This setting is not available via Aruba Central GUI so i had to use API to push this to the group config. For this is used the Aruba central automation studio (Thanks Aaron!) which is here: https://central.wifidownunder.com/
Original Message:
Sent: Nov 08, 2022 04:50 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Scott

Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

It worked!!

Now I just wonder if this is how it will be for everyone who implements Radius in Azure or if it's case-specific depending on what is handling the traffic en route to Azure. This customer has a site-to-site VPN to Azure.

------------------------------
John-Egil Solberg |
ACMX | ACCX
------------------------------

Original Message:
Sent: Nov 08, 2022 02:35 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hey John-Egil,

I sure did and i've been meaning to update this post so thanks for the prompt.

The issue was that the client certificate response from the AP was sent with a paylod size that exceeded the MTU causing IP level fragmentation.

I was able to work with TAC to implement a fix in AOS 10 using API calls to change the group config.

There is a command "dot1x eap-frag-mtu <IPMTU> which can be applied to the AP to reduce the size of the EAP response. I set this to 1100 and the EAP packets were fragmented within the RADIUS packets, rather than at the IP level, this allowed them to pass through the Azure load balancer no problem!

This setting is not available via Aruba Central GUI so i had to use API to push this to the group config. For this is used the Aruba central automation studio (Thanks Aaron!) which is here: https://central.wifidownunder.com/
Original Message:
Sent: Nov 08, 2022 04:50 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Scott

Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

great news! glad to hear it worked for you too!
Original Message:
Sent: Nov 09, 2022 07:20 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

It worked!!

Now I just wonder if this is how it will be for everyone who implements Radius in Azure or if it's case-specific depending on what is handling the traffic en route to Azure. This customer has a site-to-site VPN to Azure.

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Nov 08, 2022 02:35 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hey John-Egil,

I sure did and i've been meaning to update this post so thanks for the prompt.

The issue was that the client certificate response from the AP was sent with a paylod size that exceeded the MTU causing IP level fragmentation.

I was able to work with TAC to implement a fix in AOS 10 using API calls to change the group config.

There is a command "dot1x eap-frag-mtu <IPMTU> which can be applied to the AP to reduce the size of the EAP response. I set this to 1100 and the EAP packets were fragmented within the RADIUS packets, rather than at the IP level, this allowed them to pass through the Azure load balancer no problem!

This setting is not available via Aruba Central GUI so i had to use API to push this to the group config. For this is used the Aruba central automation studio (Thanks Aaron!) which is here: https://central.wifidownunder.com/
Original Message:
Sent: Nov 08, 2022 04:50 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Scott

Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott

We have ClearPass in Azure and had the same issues.

Learned that RADIUS (UDP) is not WAN aware and Azure don't support UDP fragments.

The best solution is to move away from RADIUS and use RADSEC (Radius over TLS) to avoid this. RADSEC using TCP packages that are WAN aware.

You can also set "dot1x eap-frag-mtu <value>"on your switches and access points but thats more a workaround than fixing the protocol limitations.

------------------------------
Marcel Koedijk | MVP Expert 2022 | ACEP | ACMP | ACCP | ACDP | Ekahau ECSE | Not an HPE Employee | Opinions are my own
------------------------------

Original Message:
Sent: Nov 10, 2022 02:40 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

great news! glad to hear it worked for you too!
Original Message:
Sent: Nov 09, 2022 07:20 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

It worked!!

Now I just wonder if this is how it will be for everyone who implements Radius in Azure or if it's case-specific depending on what is handling the traffic en route to Azure. This customer has a site-to-site VPN to Azure.

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Nov 08, 2022 02:35 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hey John-Egil,

I sure did and i've been meaning to update this post so thanks for the prompt.

The issue was that the client certificate response from the AP was sent with a paylod size that exceeded the MTU causing IP level fragmentation.

I was able to work with TAC to implement a fix in AOS 10 using API calls to change the group config.

There is a command "dot1x eap-frag-mtu <IPMTU> which can be applied to the AP to reduce the size of the EAP response. I set this to 1100 and the EAP packets were fragmented within the RADIUS packets, rather than at the IP level, this allowed them to pass through the Azure load balancer no problem!

This setting is not available via Aruba Central GUI so i had to use API to push this to the group config. For this is used the Aruba central automation studio (Thanks Aaron!) which is here: https://central.wifidownunder.com/
Original Message:
Sent: Nov 08, 2022 04:50 AM
From: John Solberg
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Scott

Did you figure this out? We're not using loadbalancer, just a single CPPM deployed in Azure. EAP-TLS isn't going through, and we see the same as you. More googling points to fragmentation and thus Azure discards the traffic due to ddos prevention.

I'm looking at doing RADSEC to bypass this issue as it encapsulates the traffic within TLS, but if that is the case I would've hoped this was mentioned in a CPPM guide.. Changing MTU in the AP-GROUP isn't doing it..

------------------------------
John-Egil Solberg |
ACMX | ACCX

Original Message:
Sent: Oct 02, 2022 11:52 PM
From: Scott Doorey
Subject: ClearPass in Azure - Azure Load Balancer for RADIUS

Hi Airheads,

Just putting the call out to see if anybody has successfully deployed ClearPass into Azure using the standard Azure Load balancer to distribute RADIUS across servers?

I've got a client with a 3 node cluster in Azure. We're using AOS 10 so can only select 2 RADIUS servers for each WLAN so I have put the two primary DC servers behind an Azure Load Balancer and pointed the RADIUS to this as the primary authentication server.

Everything seems to work ok for MSCHAP based auth, however we're seeing timeouts for TLS which i suspect is related to fragmentation. Checked the load balancer config and ensure the session affinity is based on source IP Address so all requests from a single AP are consistently sent to the same backend server but still we're seeing issues.

PCAPS show the  EAP-TLS  server handshake complete (from clearpass end) but never see the client response.  I've found some articles online referencing UDP fragmentation being a problem in azure. Has anybody got any experience to share in this space?

Thanks in advance
Scott