Controllerless Networks

Reply
Occasional Contributor I

Clearpass Guest: Unique-device-count attribute

Hi

 

I'm having trouble understanding the "unique-device-count" attribute in Clearpass.

 

Basically in our Guest enforcement policy, our first condition is:
(Authorization:[Endpoints Repository]: Unique-Device-Count GREATER_THAN 3)

 

When a Guest user registers via CWP they must specifiy an employee and employee email address. This request is then sent to the employee who clicks on the link and confirms or rejects the guest request.

If the guest account is confirmed then the "Login" button on the Guest user splash page highlights orange and they can click this to continue with Internet access.

 

I have tested and this has worked in the past for me with no issues. However, after trying today I keep getting a "Login Error. Please Retry" message.


From looking at the Access Tracker I can see that my request has been rejected (under Input > Authorization Attributes) due to my Unique-Device-Count being 4 (greater than 3).

Is there a method whereby I can clear/wipe the Unique-Device-Count attribute? I have tried deleting my account from 'Guest > Manage Accounts' list to no avail.

 

Thanks
Paul

Guru Elite

Re: Clearpass Gust: Unique-device-count attribute

You'd need to clear the attribute from the endpoints database. If you're not using that feature, remove the post auth update and rules from your enforcement policies.


Tim Cappalli | Aruba Security
@timcappalli | timcappalli.me | ACMX #367 / ACCX #480
Occasional Contributor I

Re: Clearpass Gust: Unique-device-count attribute

Hi Tim

 

Thank you for your quick reply.

 

When you say "if we are not using this feature", is this an additional license or is this built into Clearpass somewhere? Currently I have the following Clearpass options:

ClearPass Policy Manager

ClearPass Guest

Clearpass Onboard

ClearPass Insight

 

Can I view and/or maniputlate the Endpoints Database within one of these options?

 

Thanks

Paul

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: