AAA, NAC, Guest Access & BYOD

Introduction : This article provides alternate steps to install patch or upgrade Clearpass server in 6.x version.

Environment : Version tested 6.0.1 to 6.4.1

Configuration Steps :

Below are the different steps to install the patch or perform an upgrade:


To manually download the patch or upgrade image from Aruba Support site and installing it form GUI:
 

• Login to http://support.arubanetworks.com/default.aspx

• Under Download software-> Clearpass-> Policy Manager-> Current Version/Archives-> Patch/Upgrade download the appropriate image file. 

Note: Clearpass version prior to 6.1.3 or 6.2.0 download the 'Unsigned' patch. Version later it is mandate to download the signed patch in-order to upload it to Clearpass. 

• Upload the signed/unsigned patch to Clearpass via GUI (under Administration-> Agent and Software Updates-> Software Updates) using the 'Import Updates' option. 

• Once uploaded, in latest Clearpass version we will get the option to install from the GUI. Click on install button to proceed installation.

• In older version of Clearpass, we have to perform the upgrade or patch installation from the CLI once uploaded the file to Clearpass. Below is the command to perform the upgrade from CLI

To perform a patch installation: 

• Try opening http://clearpass.arubanetworks.com/cppm/patches/ (for patches) or http://clearpass.arubanetworks.com/cppm/firmware/ (for upgrade images) and provide the username and password as valid subscription key. 
• Copy the file name of the patch which you would like to install. (eg:- CPPM-x86_64-20140820-clearpass-6.3-updates-5-63-patch.bin for Clearpass 6.3-Patch 5, CPPM-x86_64-6.4.0.66263-upgrade.bin  for 6.4.0 upgrade image and CPPM-x86_64-20140820-clearpass-6.3-updates-5-63-patch.bin for 6.4-Patch 1). 
• From the CLI of Clearpass perform the below command to download and install the patch. 

To perform a patch installation: 

• The above command should download the file directly form the public server and install the patch.
  
  
  Verification :

Once the patch is installed, perform a restart from GUI (under Administration-> Server Manager-> Server Configuration-> select the server and click Reboot)

Alternative issue command '#system restart' to initiate a reboot. 

Note: Allow enough time for the server to migrate the DB at the back-end once rebooted. Manually restarting the server or initiating another re-boot would cause the server to crash. Server upgrade process can be determined by trying to login to Clearpass using SSH. If the server upgrade process is running, an warning message should appear before entering the password. 

Troubleshooting :

common upgrade/patch error: 

You are not signed up for live updates; enter your Subscription ID and save.

• No valid subscription key is installed on the server. Please verify the license email sent form Aruba for the subscription key or contact Support with the license installed on the server to get the subscription key.

Error fetching firmware updates list from Webservice; check Event Viewer for details.

or 
 

No route to host
Check Subscription ID, Network Connectivity, http_proxy credentials.
Click on 'Check Status Now' after correcting the configuration.

• Server is unable to reach Clearpass.arubanetworks.com web server to download the patches. From the Clearpass CLI verify whether the Clearpass server is able to reach the public server using '#network [ping | nslookup | tracerout Clearpass.arubanetworks.com'.
• Verify any proxy configuration under Administration-> Server Configuration-> click on the appropriate server-> Service Parameters-> Clearpass System Services-> HTTP Proxy settings. 

Your subscription has expired, so you can no longer receive updates. Please contact your reseller to renew your subscription.
Check Subscription ID, Network Connectivity, http_proxy credentials.
Click on 'Check Status Now' after correcting the configuration.

• Contact support to verify whether the provides subscription key is valid. 

Download is stuck or interrupted. Please run Check Status Now and retry. 

• Connection is interrupted before Clearpass downloads the file.  Try to click on 'Check Status' button again to initiate the download. If Clearpass is unable to complete the download, try using the CLI based upgrade. 

Upload file is invalid: does not have the meta file or unrecognized ype or does not have a valid signature. 

• Verify whether the uploaded file has a valid extension. Signed file should have an extension as '.zip.signed' and unsigned http://community.arubanetworks.com/t5/AAA-NAC-Guest-Access-BYOD/How-to-Upgrade-CPPM-Cluster-nodes-with-High-Availability/ta-p/175400file should contain '.bin' as file extension.