Security

I have looked at the current 6.8 release notes for Clearpass and on the VMware vSphere sizing requirements. I have relayed those to my customer. Our questions are: 

1. If his environment is not going over 500 concurrent sessions (300max) and is looking at Access and Onboarding features, why would he need 1000GB of disk space? That seems to be an incredible amount of space required for such a relatively small deployment. I have read other posts stating that quite a bit of that space is not even being used.

2. In the 6.5 release the CP-VA-500 specs mentioned only needing 500GB of space. Could we not use that spec for THIS 6.8 deployment?

3. What are the consquences of not allocating the 1000GB of space for the 6.8 release?

 

Thank you in advance

Clearpass hold two partitions, an primary partition (500GB) and an backup partition (500GB). Clearpass keep this two in sync, that is why 1TB storage is required and thicked provisioned strongly recommended. Please note that ClearPass is an security appliance, for that reasons the disks are encrypted and it will not possible to extend this disk later due the encryption. ClearPass is also a Major Core component in the infrastructure, your dont want this appliances run out of space. Thick provisioned is important to be sure your SAN is not over provisioned storage and run out of space, this can be a huge issue when happens and let your ClearPass appliance crash in production.

 

I agree it is al lot of space consuming but sadly it is required. If hardware resources is an issue, you have to look for an hardware appliance or extend your storage array.

 

You can underprovision at your own risk. If you are running low on resources and if the VM is under-provisioned you might be denied support.

 

Also, if you are still going ahead with it ensure you have enough alarms in place to notify you if the disk usage exceeds a threshold.

 

As mentioned above, since disk is encrypted you cannot increase it on the fly and you might have to reprovision the VM with the latest backup if you run out of disk space.

I'm in the process extending a Publisher-Only Installation (C2000V with only 200GB harddisk) with a Standby-Publisher (with 1000GB harddisk).

Is it possible to sync the Publisher correctly to the new Standby-Publisher/Subscriber, then do a failover to the Standby-Publisher and then reinstall the Publisher from scratch with the correct hardisk size and bring it back Online and resync it with the Standby-Publisher? Is it necessary to backup/restore the configuration in that case? Will there be a licensing issue for which we would need TAC? (Just to be prepared...)

Your ideas would be very helpful.

Manfred M.


Original Message:
Sent: Sep 05, 2019 03:16 AM
From: Arpit Bhatt
Subject: Clearpass 6.8 VM requirements/sizing

You can underprovision at your own risk. If you are running low on resources and if the VM is under-provisioned you might be denied support.

 

Also, if you are still going ahead with it ensure you have enough alarms in place to notify you if the disk usage exceeds a threshold.

 

As mentioned above, since disk is encrypted you cannot increase it on the fly and you might have to reprovision the VM with the latest backup if you run out of disk space.

1. Bring up the SUB, ensure it the same s/w level as the PUB.
2. Join it to the PUB to form a cluster 1 x PUB / 1 x SUB
3. Ensure the cluster is in sync  {can see if its in progress in Dashboard} 
4. You may want to set a VIP between the two nodes and point the NAD's to this RADIUS address, OR, add a second RADIUS server to the NAD's so there is fail-thru when the primary fails to reply {my preference}.
5. To be safe-take a backup
6. Take down the OLD-PUB 
7. Promote the SUB to be the PUB, all network activity continues either via RADIUS NAD fail-thru or VIP address now moved to new PUB {old SUB}
8. Blow away the old PUB and rebuild it
9. Re join to cluster

------------------------------
Danny Jump
"Passionate about CPPM"
------------------------------

Original Message:
Sent: Dec 03, 2020 12:44 PM
From: Manfred Mauler
Subject: Clearpass 6.8 VM requirements/sizing

I'm in the process extending a Publisher-Only Installation (C2000V with only 200GB harddisk) with a Standby-Publisher (with 1000GB harddisk).

Is it possible to sync the Publisher correctly to the new Standby-Publisher/Subscriber, then do a failover to the Standby-Publisher and then reinstall the Publisher from scratch with the correct hardisk size and bring it back Online and resync it with the Standby-Publisher? Is it necessary to backup/restore the configuration in that case? Will there be a licensing issue for which we would need TAC? (Just to be prepared...)

Your ideas would be very helpful.

Manfred M.


Original Message:
Sent: Sep 05, 2019 03:16 AM
From: Arpit Bhatt
Subject: Clearpass 6.8 VM requirements/sizing

You can underprovision at your own risk. If you are running low on resources and if the VM is under-provisioned you might be denied support.

 

Also, if you are still going ahead with it ensure you have enough alarms in place to notify you if the disk usage exceeds a threshold.

 

As mentioned above, since disk is encrypted you cannot increase it on the fly and you might have to reprovision the VM with the latest backup if you run out of disk space.

Thank you Danny for the quick and precise reply - will do this in that way next week - backup is of course a safety step - vip is already setup as it was always planned to add a Standby-Publisher when this installation goes productive.

------------------------------
Manfred M.
Innovation Expert
Innsbruck/Austria
------------------------------

Original Message:
Sent: Dec 03, 2020 02:25 PM
From: Danny Jump
Subject: Clearpass 6.8 VM requirements/sizing

1. Bring up the SUB, ensure it the same s/w level as the PUB.
2. Join it to the PUB to form a cluster 1 x PUB / 1 x SUB
3. Ensure the cluster is in sync  {can see if its in progress in Dashboard} 
4. You may want to set a VIP between the two nodes and point the NAD's to this RADIUS address, OR, add a second RADIUS server to the NAD's so there is fail-thru when the primary fails to reply {my preference}.
5. To be safe-take a backup
6. Take down the OLD-PUB 
7. Promote the SUB to be the PUB, all network activity continues either via RADIUS NAD fail-thru or VIP address now moved to new PUB {old SUB}
8. Blow away the old PUB and rebuild it
9. Re join to cluster

------------------------------
Danny Jump
"Passionate about CPPM"

Original Message:
Sent: Dec 03, 2020 12:44 PM
From: Manfred Mauler
Subject: Clearpass 6.8 VM requirements/sizing

I'm in the process extending a Publisher-Only Installation (C2000V with only 200GB harddisk) with a Standby-Publisher (with 1000GB harddisk).

Is it possible to sync the Publisher correctly to the new Standby-Publisher/Subscriber, then do a failover to the Standby-Publisher and then reinstall the Publisher from scratch with the correct hardisk size and bring it back Online and resync it with the Standby-Publisher? Is it necessary to backup/restore the configuration in that case? Will there be a licensing issue for which we would need TAC? (Just to be prepared...)

Your ideas would be very helpful.

Manfred M.


Original Message:
Sent: Sep 05, 2019 03:16 AM
From: Arpit Bhatt
Subject: Clearpass 6.8 VM requirements/sizing

You can underprovision at your own risk. If you are running low on resources and if the VM is under-provisioned you might be denied support.

 

Also, if you are still going ahead with it ensure you have enough alarms in place to notify you if the disk usage exceeds a threshold.

 

As mentioned above, since disk is encrypted you cannot increase it on the fly and you might have to reprovision the VM with the latest backup if you run out of disk space.

Danny is right! I did the same kind of migrations many times. When re-install the appliance you can re-install the PAK licences, but you can run into an issue to activate them. Everything will work fine but work with TAC to re-activate your licenses.

If you upgrade from 6.7.x early to 6.8.x you possible don't have the Platform Licence Key (PAK) in your asp.arubanetworks.com (looks like a certificate instead of a key). Work with TAC on forehand get the PAK key if you don't have it. You need this PAK key to access your new installad appliance.

The Access, Onboard, Onguard licences wil are floated in the Cluster and moves to your new publischer, so you would not have any issues with this licences, just the PAK can be a nasty one sometimes.

If you are a Aruba Partner you can also create trial licenses for temporally use when run into some issues. 

------------------------------
Marcel Koedijk | MVP Expert 2020 | ACMP | ACCP | Ekahau ECSE
------------------------------

Original Message:
Sent: Dec 03, 2020 02:58 PM
From: Manfred Mauler
Subject: Clearpass 6.8 VM requirements/sizing

Thank you Danny for the quick and precise reply - will do this in that way next week - backup is of course a safety step - vip is already setup as it was always planned to add a Standby-Publisher when this installation goes productive.

------------------------------
Manfred M.
Innovation Expert
Innsbruck/Austria

Original Message:
Sent: Dec 03, 2020 02:25 PM
From: Danny Jump
Subject: Clearpass 6.8 VM requirements/sizing

1. Bring up the SUB, ensure it the same s/w level as the PUB.
2. Join it to the PUB to form a cluster 1 x PUB / 1 x SUB
3. Ensure the cluster is in sync  {can see if its in progress in Dashboard} 
4. You may want to set a VIP between the two nodes and point the NAD's to this RADIUS address, OR, add a second RADIUS server to the NAD's so there is fail-thru when the primary fails to reply {my preference}.
5. To be safe-take a backup
6. Take down the OLD-PUB 
7. Promote the SUB to be the PUB, all network activity continues either via RADIUS NAD fail-thru or VIP address now moved to new PUB {old SUB}
8. Blow away the old PUB and rebuild it
9. Re join to cluster

------------------------------
Danny Jump
"Passionate about CPPM"

Original Message:
Sent: Dec 03, 2020 12:44 PM
From: Manfred Mauler
Subject: Clearpass 6.8 VM requirements/sizing

I'm in the process extending a Publisher-Only Installation (C2000V with only 200GB harddisk) with a Standby-Publisher (with 1000GB harddisk).

Is it possible to sync the Publisher correctly to the new Standby-Publisher/Subscriber, then do a failover to the Standby-Publisher and then reinstall the Publisher from scratch with the correct hardisk size and bring it back Online and resync it with the Standby-Publisher? Is it necessary to backup/restore the configuration in that case? Will there be a licensing issue for which we would need TAC? (Just to be prepared...)

Your ideas would be very helpful.

Manfred M.


Original Message:
Sent: Sep 05, 2019 03:16 AM
From: Arpit Bhatt
Subject: Clearpass 6.8 VM requirements/sizing

You can underprovision at your own risk. If you are running low on resources and if the VM is under-provisioned you might be denied support.

 

Also, if you are still going ahead with it ensure you have enough alarms in place to notify you if the disk usage exceeds a threshold.

 

As mentioned above, since disk is encrypted you cannot increase it on the fly and you might have to reprovision the VM with the latest backup if you run out of disk space.