Wireless Access

Keep the sources you have. An Active Directory source is the same LDAP query as Generic LDAP plus the NetBIOS domain, and the join is only there for MSCHAPv2 and NTLM. The ClearPass 6.11 deployment guide says EAP-TLS doesn't need the join: https://arubanetworking.hpe.com/techdocs/ClearPass/6.11/PolicyManager/Content/Deploy/Active%20Directory/AD_auth_source_adding.htm. Your filters and role mappings keep working, so just leave the domain once Access Tracker shows nothing using MSCHAPv2.

Neither type stops at a secondary. Add Backup gives you Backup 1, Backup 2 and more, tried in the order you set whenever the server above is unreachable. The 6.11 LDAP and SQL sources section covers it: https://arubanetworking.hpe.com/techdocs/ClearPass/6.11/PolicyManager/Content/Deploy/LDAP%20&%20SQL%20Auth%20Sources/Intro_Ex_Auth_Sources.htm. The DC discovery you're thinking of comes from the join, not the LDAP lookups, so three or four DCs near the cluster is enough.

A VIP works too, but the certificate the F5 presents has to chain to your trust list and match the name ClearPass connects to.

Chris, did keeping the AD sources work out? Before you leave the domain, filter Access Tracker on the auth method for MSCHAPv2 over a full week, since a forgotten service account or an old laptop tends to turn up late. If that settled it, marking the reply as the solution helps the next person moving to EAP-TLS find it.

That's the right order. The join is only there so ClearPass can do NTLM for PEAP-MSCHAPv2, so as long as that SSID is on PEAP the servers have to stay in the domain. The 6.11 deployment guide's page on joining a domain explains why: https://arubanetworking.hpe.com/techdocs/ClearPass/6.11/PolicyManager/Content/Deploy/Active%20Directory/Joining_AD_domain.htm

Once the last users are on EAP-TLS, take EAP-PEAP off that SSID's service so nothing can quietly fall back to it. Then give Access Tracker a week with no MSCHAPv2 before you leave the domain. Each server joins on its own, so check the AD Domains list under Administration > Server Manager > Server Configuration > System on every node, not just the publisher.

Your AD over SSL sources don't change. They keep doing the group lookups for EAP-TLS with or without the join.