To configure the Policy Manager server's Management port:

1. From the Administration > Server Manager > Server Configuration > System > Management Port section, click Configure. The Configure Management Port dialog opens.

Figure 2  Configure Management Port Dialog (IPv4)

2. Specify the Configure Management Port parameters for IPv4 as described in the following table:

 

Table 2: Configure Management Port Parameters (IPv4)

Parameter	Action/Description
Select IP Version	Select IPv4.
IP Address	Specify the IPv4 address is used to access the ClearPass Policy Manager server's management port. When a new hardware appliance is first powered on, it already shows an existing management IP address. This IP address is set during the manufacturing process, and is replaced when you enter your management IP address during appliance configuration.
Subnet Subnet is the logical division of an IP network. Mask	Specify the management interface subnet Subnet is the logical division of an IP network. mask for an IPv4 address.
Default Gateway Gateway is a network node that allows traffic to flow in and out of the network.	Specify the default gateway Gateway is a network node that allows traffic to flow in and out of the network. for the management interface. A default gateway Gateway is a network node that allows traffic to flow in and out of the network. serves as an access point or IP router that a networked device ‪uses to send information to a device in another network or the Internet.
Warning	Changing IP details might cause the system to lose network connectivity and require re-login. The Database Server Certificate may need to be updated. Save the Server Configuration page for changes to take effect.

3. Click Update.

Figure 3  Configure Management Port Dialog (IPv6)

4. Specify the Configure Management Port parameters for IPv6 as described in the following table:

 

Table 3: Configure Management Port Parameters (IPv6)

Parameter	Action/Description
Select IP Version	Select IPv6.
IPv6 Address/Mask	Specify the IPv6 address that is used to access the ClearPass Policy Manager server's management port. To configure the IPv6 address, specify the IPv6address with prefix length: < ipv6address\prefixlength > NOTE: IPv6 addresses don't require a netmask Netmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses. as they use Classless Inter-Domain Routing (CIDR Classless Inter-Domain Routing. CIDR is an IP standard for creating and allocating unique identifiers for networks and devices. The CIDR IP addressing scheme is used as a replacement for the older IP addressing scheme based on classes A, B, and C. With CIDR, a single IP address can be used to designate many unique IP addresses. A CIDR IP address ends with a slash followed by the IP network prefix, for example, 192.0.2.0/24.).
IPv6 Default Gateway Gateway is a network node that allows traffic to flow in and out of the network.	Specify the default gateway Gateway is a network node that allows traffic to flow in and out of the network. for the management interface. A default gateway Gateway is a network node that allows traffic to flow in and out of the network. serves as an access point or IP router a networked device ‪uses to send information to a device in another network or the Internet.
Warning	Changing IP details might cause the system to lose network connectivity and require re-login. The Database Server Certificate may need to be updated. Save the Server Configuration page for changes to take effect.

To configure the Policy Manager server's Data/External port:

1. From the Server Configuration > System > Data/External Port section, click Configure.

The Configure Data/External Port dialog opens.

Figure 4  Configure Data/External Port Dialog (IPv4)

2. Specify the Configure Data/External Port parameters for IPv4 as described in the following table:

 

Table 4: Configure Data/External Port Parameters (IPv4)

Parameter	Action/Description
Select IP Version	Select IPv4 .
IP Address	Specify the IPv4 address of the Policy Manager server's data interface.
Subnet Subnet is the logical division of an IP network. Mask	Specify the management interface subnet Subnet is the logical division of an IP network. mask for an IPv4 address.
Default Gateway Gateway is a network node that allows traffic to flow in and out of the network.	Specify the IPv4 address of the default gateway Gateway is a network node that allows traffic to flow in and out of the network. for the data interface.

3. Click Update.

Figure 5  Configure Data/External Port Dialog (IPv6)

4. Specify the Configure Data/External Port parameters for IPv6 as described in the following table:

 

Table 5: Configure Data/External Port Parameters (IPv6)

Parameter	Action/Description
Select IP Version	Select IPv6.
IPv6 Address/Mask	Specify the IPv6 address used to access the ClearPass Policy Manager server's data port. To configure the IPv6 address, specify the IPv6 address with prefix length: < ipv6address\prefixlength > NOTE: IPv6 addresses do not require a netmask Netmask is a 32-bit mask used for segregating IP address into subnets. Netmask defines the class and range of IP addresses., as they use Classless Inter-Domain Routing (CIDR Classless Inter-Domain Routing. CIDR is an IP standard for creating and allocating unique identifiers for networks and devices. The CIDR IP addressing scheme is used as a replacement for the older IP addressing scheme based on classes A, B, and C. With CIDR, a single IP address can be used to designate many unique IP addresses. A CIDR IP address ends with a slash followed by the IP network prefix, for example, 192.0.2.0/24.).
IPv6 Default Gateway Gateway is a network node that allows traffic to flow in and out of the network.	Specify the default gateway Gateway is a network node that allows traffic to flow in and out of the network. for the data/external interface. A default gateway Gateway is a network node that allows traffic to flow in and out of the network. serves as an access point or IP router that a networked device ‪uses to send information to a device in another network or the Internet.

To configure the Policy Manager server's DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. (Domain Name System) settings:

1. From the Server Configuration page > System tab > DNS Settings, click Configure.

The Configure DNS Setting dialog opens.

 

 

 

 

 

 

 

 

 

 

 

 

 

Figure 6  Configure DNS Settings Dialog

2. Specify the Configure DNS Settings parameters as described in the following table:

 

Table 6: Configure DNS Settings Parameters

Parameter	Action/Description
Primary	Specify the primary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. server for name look-up. You can specify an IPv4 or IPv6 address. NOTE: A DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. server can be primary for one domain and secondary for another. Only one DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. server should be configured as primary for a domain, but you can have any number of secondary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. servers.
Secondary	Specify one or more secondary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. servers for name look-up. You can specify an IPv4 or IPv6 address.
Tertiary	Optionally, in the rare event of both the primary and secondary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. servers going down, you can configure a tertiary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. server. You can specify an IPv4 or IPv6 address. NOTE: The recommended practice is to configure the primary and secondary DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. servers on separate machines, on separate Internet connections, and in separate geographic locations.
Number of attempts	Maximum number of DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. retry attempts. The supported range is 1-15 attempts, and the default is 2.
Timeout:	DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. timeout duration, in seconds. The supported range is 1-30 seconds, and the default is 5.
DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. Caching	If enabled, Policy Manager will cache DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. entries from the DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. server for the Time to live (TTL Time to Live. TTL or hop limit is a mechanism that sets limits for data expiry in a computer or network.) value for each entry, reducing the number of queries to the DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. server. This feature is enabled by default.

3. To save your changes, select Enable restart services for changes to take effect, then click Update. Note that you also have to save changes to the server configuration page to update your DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. settings.

You can join Policy Manager to an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. (AD) domain to authenticate users and computers that are members of an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain. If you join Policy Manager to an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain, it creates an account for the Policy Manager node in the Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. database. Users can then authenticate into the network using 802.1X 802.1X is an IEEE standard for port-based network access control designed to enhance 802.11 WLAN security. 802.1X provides an authentication framework that allows a user to be authenticated by a central authority. and EAP Extensible Authentication Protocol. An authentication protocol for wireless networks that extends the methods used by the PPP, a protocol often used when connecting a computer to the Internet. EAP can support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication.  methods, such as PEAP Protected Extensible Authentication Protocol. PEAP is a type of EAP communication that addresses security issues associated with clear text EAP transmissions by creating a secure channel encrypted and protected by TLS.-MSCHAPv2, with their own their own Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. credentials.

If you need to authenticate users belonging to multiple Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. forests or domains in your network, and there is no trust relationship between these entities, then you must join Policy Manager to each of these untrusted forests or domains.

Policy Manager is not required to join multiple domains belonging to the same Active Directory forest because a one-way trust relationship exists between those domains. In this case, Policy Manager can join the root domain.

Policy Manager can join or leave an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain by using the following two buttons in the Server Configuration page > System tab:

Join Domain: Click Join Domain to join this Policy Manager appliance to an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain.

Leave Domain: If the server is already part of multiple Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domains, click Leave Domain to disassociate this Policy Manager appliance from an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain.

For most use cases, if you have multiple nodes in the cluster, you must join each node to the same Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain. Always join to the domain controller that is physically closest to the Policy Manager server, otherwise authentication might fail or the performance might be impacted.

To join the selected Policy Manager server to an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain:

1. From the Server Configuration page > System tab > AD Domains, click Join AD Domain.

The Join AD Domain dialog opens:

Figure 7  Join AD Domain Dialog

2. Specify the Join AD Domain parameters as described in the following table.

Join AD Domain Parameters

Parameter	Action/Description
Domain Controller	Enter the Fully Qualified Domain Name (FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet.) of the domain controller, then press Tab. The following message is displayed: Trying to determine the NetBIOS name... Policy Manager searches for the NetBIOS Network Basic Input/Output System. A program that lets applications on different computers communicate within a LAN. name for the domain. Policy Manager displays a warning message if the domain controller is not the closest one. NOTE: You should always join to the domain controller that is physically the closest to the Policy Manager server, otherwise authentication might fail or the controller's performance might be impacted.
NetBIOS Network Basic Input/Output System. A program that lets applications on different computers communicate within a LAN. name	When you specify a valid domain controller, the NetBIOS Network Basic Input/Output System. A program that lets applications on different computers communicate within a LAN. name is automatically populated and it is not editable.
Domain Controller name conflict	Specify the action to take in the event of a domain controller name conflict. In some deployments (especially if there are multiple domain controllers, or if the domain name has been wrongly entered in the last step), the domain controller FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. returned by the DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. query can be different from what was entered. In this case, you can: Use specified Domain Controller: Continue to use the domain controller name that you entered. Use Domain Controller returned by DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. query: Use the domain controller name returned by the DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. query. Fail on conflict: Abort the Join Domain operation.
Use default domain admin user	Check this box to use the Administrator user name to join the domain. NOTE: In a production environment, it is likely that an Administrative username that has permissions to join machines to the domain would be used for the default domain admin user. In that case, 1) disable (that is, uncheck) the Use default domain admin user [Administrator] check box and 2) enter the Admin username and password in the fields provided.
Username	Enter the user ID of the domain administrator account. NOTE: This field is disabled if the Use default domain admin user check box is selected.
Password	Enter the password for the user account that will join Policy Manager with the domain (for related information, see Table 7, which displays the characters allowed and restricted for the Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. username and password).

 

Table 7: Active Directory Username and Password Characters Allowed and Not Allowed

Field	Characters Allowed	Not Allowed
Username	~ ! @ # $ % ^ * _ - + = { } , . \ ' " ? /	` & ( )
Password	! @ # $ % ^ & * ( ) _ - + = { } < , > . ? /	~ ` [ ] \ | ; : ' "

3. Click Save.

The Join AD Domain status screen opens. During the joining process, the screen displays the messages "Checking whether <name> domain controller is co-located with this ClearPass Policy Manager server." and then “Adding host to AD domain,” The screen displays status during the joining process.

When the joining process completes successfully, you see the message “Added host to the domain.”

If Policy Manager cannot identify the domain controller because Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. has not been configured with site information, this form displays the warning "Unable to identify which Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. site this Policy Manager server is located in. Authentications might fail or be impacted if the selected domain controller is not co-located."

If Policy Manager determines that you are not joining the closest domain controller, the form displays both a warning message and a Find Domain Controller button that you can use to find the closest domain controllers.

4. To display a list of available controllers, click the Find Domain Controller button .

You can then select a controller from the available list, or proceed with the domain controller you originally selected.

5. Click Close.

You return to the Server Configuration page, and it now shows that the Policy Manager server is joined to the domain.

Now that the Policy Manager server has joined the domain, the server can authenticate users with Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed..

After an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. Domain is added, the domain controller can be set up as a password server (as described in the next section).

After Policy Manager successfully joins an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain, you can configure a restricted list of domain controllers to be used for MSCHAP authentication. If this is not configured, then all available domain controllers obtained from DNS Domain Name System. A DNS server functions as a phone book for the intranet and Internet users. It converts human-readable computer host names into IP addresses and IP addresses into host names. It stores several records for a domain name such as an address 'A' record, name server (NS), and mail exchanger (MX) records. The Address 'A' record is the most important record that is stored in a DNS server, because it provides the required IP address for a network peripheral or element. will be included.

When an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. password server is updated in the domain server configuration, the RADIUS Remote Authentication Dial-In User Service. An Industry-standard network access protocol for remote authentication. It allows authentication, authorization, and accounting of remote users who want to access network resources.  service is automatically restarted.

To add an Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. password server:

1. Navigate to Administration > Server Manager > Server Configuration, then select the Policy Manager server of interest.

2. In the AD Domains section of the System page, click the Add Password Server icon: . 

This icon appears only after Policy Manager joins at least one Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. domain (see Figure 8).

Figure 8  Add Active Directory Password Server Icon

The Configure AD Password Servers dialog opens.

Figure 9  Active Directory Password Server Added

3. Specify the following:

Domain controller

NetBIOS Network Basic Input/Output System. A program that lets applications on different computers communicate within a LAN. name

Password servers: Enter IP Address or FQDN Fully Qualified Domain Name. FQDN is a complete domain name that identifies a computer or host on the Internet. of the Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. Domain Controller (ADDC) in the password servers text box, one entry per line.

4. To complete adding the Active Directory Microsoft Active Directory. The directory server that stores information about a variety of things, such as organizations, sites, systems, users, shares, and other network objects or components. It also provides authentication and authorization mechanisms, and a framework within which related services can be deployed. password servers, click Save.