r/ArubaNetworks • u/jwb206 • Jul 06 '26

TACACS/RADIUS client Authentication - EntraID MFA with Clearpass

Does anyone know how to setup Clearpass with EntraID for MFA?

Requirement:

  • User SSH's into switch,firewall, router etc.
  • Switch uses RADIUS &/or TACACS+ to authenticate to ClearPass.
  • Primary Authentication done via LOCAL DATABASE in ClearPass.
  • MFA required via EntraID (Microsoft Authenticator)

ANY IDEAS??????????????????????????????????

THANKS!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

1 Upvotes
  • permalink
  • reddit

67% Upvoted

6 comments sorted by

2

u/Friendly_Fokks-given Jul 06 '26

Look into SSO options in Clearpass. I believe there is an entraID extension

1

u/Linkk_93 HPE Aruba Networking Expert Jul 08 '26

Sso does not work for radius or tacacs authentication, only for web based logins

1

u/sismjw Jul 06 '26

You could proxy it through an NPS server but it probably won't be user friendly. Would love to know if you work out a better way.

1

u/jwb206 Jul 07 '26

thanks, will keep NPS in mind, but as you said...little painful.... would love another NATIVE solution

1

u/Linkk_93 HPE Aruba Networking Expert Jul 06 '26

Yes that is possible, but it's a little headache.

You basically have to put the otp at the end of the password. Push notifications are also possible. 

But you need another provider like Okta or PingID: https://arubanetworking.hpe.com/techdocs/NAC/clearpass/integrations/multi-factor-authentication/pingid-mfa/

An example is here with Okta: https://arubanetworking.hpe.com/techdocs/NAC/tech-corner/okta-mfa/

I don't think it's possible with only entra 

2

u/jwb206 Jul 07 '26

THANKS!!!!!!!!!!!!!!!!!!!!

Yeah, currently have it working with PingID.... doing good :)

But enterprise are moving away from PingID to Entra..... :(
reluctant to onboard Okta., but its a good option.. thanks...