ClearPass Deployment and Licensing
Deployment models
ClearPass can be deployed as a hardware appliance, a virtual appliance (VMware, Hyper-V, KVM), or in supported cloud environments. Candidates should know the publisher/subscriber cluster model: one publisher owns the configuration database and license; subscribers replicate config and can serve authentication. A standalone node acts as its own publisher. Clusters improve scale and resilience; a VIP can front multiple nodes for load balancing.
Licensing
ClearPass licensing is capacity-based. The key concept is the Access license, which is consumed by endpoints (unique MAC addresses) that authenticate. Licenses are counted per unique endpoint, not per request. There are also module licenses for OnGuard, Onboard, Guest, and Insight. Traps: (1) licenses are pooled at the cluster/publisher level, not per node; (2) an endpoint that authenticates repeatedly consumes one license; (3) expired or exceeded licenses cause authentication failures for new endpoints.
Sizing and placement
Place ClearPass where it can reach the RADIUS clients (NADs) and the identity sources (AD, LDAP). Consider latency to AD and the number of NADs. For high availability, deploy at least two nodes and ensure NADs have both configured as RADIUS servers with failover.
Traps in questions
- Confusing capacity (endpoint count) with throughput (requests per second).
- Assuming each node needs its own license - it does not; it's cluster-wide.
- Forgetting that OnGuard/Onboard require separate module licenses beyond the base Access license.
- Believing subscribers can be promoted without proper cluster configuration.
Rule of thumb
Size by unique endpoints for licensing and by peak authentications per second for hardware. Always deploy a second node for HA and configure NAD failover to both.
Worked example
A customer has 5,000 devices and expects 200 auths/second at peak. They need Access licenses for ~5,000 endpoints (with headroom), a two-node cluster (publisher + subscriber) for HA, and module licenses only if OnGuard/Onboard are used.