Security

We are pleased to announce the immediate availability of ClearPass 6.7.0!  In addition to bug fixes, this release also includes many new features that our Engineering and QA team have worked tirelessly to include.  A sample of the new and changed capabilities are:

 

• Simplified licensing
  • Decoupling licenses from hardware for better granularity
  • Concurrent license count vs. 7-day rolling averages for AAA
  • Guest functionality bundled as part of new Access licenses
  • Onboard license is now per-user
• Phase 2 of IPv6 support
• Opt-in option for signature downloads
• Insight custom report templates and alerting enhancements
• UI for managing ClearPass Extensions
• sFlow profiling collector
• UI for Downloadable Roles with ArubaOS-Switch
• Ubuntu 16.04 LTS support for Onboard and OnGuard
• Windows Server 2016 support for OnGuard
• Automatic policy conversion to OnGuard Plugin v2.0 policies
• Guest pages and forms translated completely for all supported languages and 3 new ones

A ClearPass 6.7 Upgrade Overview document has been posted in Aruba Support Center to help users during the upgrade process.  This guide helps with many of the potential upgrade paths customers may experience.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (attached).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.  MNP postings will occur shortly.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

Hi,

Can you confirm if a legacy CP-VA-5K automatically creates both the platform license and a 5000 access license during migration?

Are existing legacy guest licenses also added to the access license numbers?

Can legacy (onboard/onguard) licenses be installed on a new 6.7 installation or do they need to be manually converted by HPE support?

During the upgrade, the system will automatically create a platform activation key (PAK) for the virtual appliance.

 

It will also install temporary 6 month licenses for all features. You can convert your legacy 5K licenses (as well as Guest, Onboard and OnGuard licenses) to their new licenses on My Networking Portal.

In one of the webinars regarding ClearPass 6.7 the speaker mentioned sizing tools that was planned to be released.

Where can that type of tools be found?

 

Regards

Jonas Hammarbäck

The sizing and performance TechNote can be found on the support site with the others.

Missed Tim's reply before posting this question.  I'll convert my licenses via My Networking Portal.

 

I'm having a tough time understanding if I need to convert my licensing after upgrading to 6.7.  When I try to reapply the license key as an access license, it gives me an error that the license key is not valid.  Should it have been automatic?  If so, I'll open a case with TAC.  If there's a conversion process, please advise.

 

Thank you,

Josh Bugbee

During the upgrade, temporary licenses are installed. These are valid for 6 months. Sometime in that 6 month window, you need to convert your licenses. If you’re having issues with the self-service conversion in MNP, you can work with TAC.

As usual - I think of a question and you've already answered it.

Thanks!

We are pleased to announce the immediate availability of ClearPass 6.7.1!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Improved TACACS+ license consumption model
  • TACACS+ is no longer consumed using the session-based model introduced in ClearPass 6.7.0. With only 100 Access licenses, a customer can now use TACACS+ for an unlimited number of network devices and/or administrators. Just add appliances to scale up based upon demands.
• Ability to Rollback a Cumulative Patch
  • ClearPass now supports downgrades from major (pre-6.7 feature) and minor (NEW) releases, e.g. 6.7.1 -> 6.7.2 -> 6.7.1.
• Support for SNMP IPv6 targets
  • ClearPass can now send SNMP traps to IPv6 enabled trap receivers.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (attached).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

Best regards,

The ClearPass Team

Can someone clarify how the ClearPass Enterprise Licenses (flexibilty for Guest, OnBoard, and OnGuard)?

Will these be converted to only Access, split up, etc.?

Enterprise can be converted to any 6.7 license.

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.2. 

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

Guest

• Connection settings for SMS Global are updated.

 

OnGuard

• Support and Enhancements for Numerous updated and new 3^rd party OnGuard plugins, please review the Release Notes for details.

• Users can now configure a maximum timeout value for OnGuard remediation scripts to run.
• A new attribute in OnGuard Global Agent Settings lets you specify a VPN adapter (device) name and categorize the network interface as a VPN on macOS.
• ClearPass now supports standalone installations of VIA 3.x and of the OnGuard Agent.

 

Policy Manager

• The policy server will now time out if the AD/LDAP source fails to send a response to an authorization query after ten seconds.
• ClearPass 6.7.2 includes support for a new Post-Auth v2 function to improve performance and scaling for post-authentication events when inter-operating with third-party systems.
• A new cluster-wide parameter, Content Security Policy (CSP) , is added.  When this parameter is enabled, it helps reduce cross-site scripting (XSS) risks in browsers by declaring which dynamic resources can be loaded via an HTTP Header.
• ClearPass supports new secured cipher suites using Active Directory as an authentication source.

 

QuickConnect

• Onboard QuickConnect packages for Windows provisioning are now signed by Aruba.  

This patch also addresses the Shibboleth SAML vulnerability described in ARUBA-PSA-2018-003 for CVE-2018-0489.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes.

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.3!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Updated AirWatch attributes in endpoint database
• LocationGroupID
• LocationGroupName
• OnGuard Dissolvable Agent authentication support
• Identify username through web login
• OnGuard automatic signature rollback
• Configurable TACACS+ authentication timeout for MFA workflows
• Disable ClearPass Machine account password expiry in AD
• New admin privilege for use with Aruba Downloadable Role Enforcement
• Limits permissions to those needed for downloadable roles only

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (attached).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.4 !  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

Policy Manager

• ClearPass7.4 delivers Phase1 of RadSec support. Phase1 includes NAS <-> ClearPass. In a subsequent release, Phase2 will add support for RadSec between ClearPass and other RADIUS Servers.
• Failure Alerting for an Auth Source, provides system alerting when an auth-server defined in an auth-source is no longer reachable/useable.

 

Security Exchange

• Expanded Airwatch and MobileIron to expose additional endpoint context.
• For Airwatch – IMEI Number
• For MobileIron – Endpoint Compliance

 

OnGuard

• The release adds support for when OnGuard is running in health-only-mode {user-mode only}, to pass a Username, previously only a mac-address was supported Multiple username formats are supported, please take the time to read the TOI for more information.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (now posted online only) (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.4/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

After upgracding to 6.7.0 all i see is the option to upgrade into 6.7.4, i noticed that was recently realesed.

 

What is the recomended patch to go to 6.7.x ? or should i stay in 6.7.0 ?

 

I am running 4 - 25K appliances on a major Healthcare enviroment using (wireless auth, Onboard, GuestNet, Tacacs, Radius and so on)

 

Thanks,

 

AP

I'm running 6.7.3 in production and 6.7.4 on a dev cluster that services our building. Did have a funny when upgrading from 6.7.3 to 6.7.4 the master publisher at one level thought the secondary node was down but everything else kept working. Had to unbind the secondary and rebind it but that could have been me.

 

There are quite a few fixes in the .234 releases which fixed issues for us.

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.5!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Certificate based OnGuard user authentication
  • User identity certificates may be used to authenticate users. Internal or smart card (PIV or CAC) certificates can be selected.
• VMware vShpere Hypervisor (ESXi) 6.5 U2 and ESXi 6.7 have now been validated with ClearPass 6.7.0 and higher.

 

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes.

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

Hello,

I am running a standalone C1000V (500 Virtual Appliance OVF)  version  6.6.10.106403 . My issue is that upgrading to 6.7 requires 1 TB of disk space. This seems rather large considering our requirements are small and we are only running at 15% with the current load on 6.6 . What is the life cyle plan for 6.6? Will Aruba continue to support 6.6 ? I  am having trouble justifying such a large space for a resource that is currently under utilized in our org. The release notes for 6.6 do not indicate a lifecycle or planned obsolecence so am I to think that it will be supported in the future?

I would appreciate your input.

 

ClearPass 6.6.X goes end of support in April 2019.

https://www.arubanetworks.com/support-services/end-of-life/#ClearPassSoftware

So what are you using clearpass for in your institution? There are a lot of changes in 6.7 that make rolling out "stuff other than just sending back an Access-Accept"  a lot easier and feature rich. Just depends on your usage

 

Also there are a batch of security fixes in there.

 

Also don't forget the change in license model so you don;t have to buy more VMs to increase a cluster license count, but of you're only running a 500 then guess that doesn't matter.

 

Really does depend on what you're using it for. 

 

I know you're supposed to use 1TB thick provisoned ... you're only really using 50% of that as the disk has 2 partitions.

Just checked with our systems people,  We started out using thin provisioned .. was a plan to thick provision it but apparently didn;t quite happen. On NetApps using NFS datastore there (possibly) isn't a thick provisioning option.

 

A

 

 

Hello Aruba,

 

the Cleanup Intervals Maximum inactive time has been removed, so if i want remove automatically the inactive endpoints from the Database how can i do that if this feature has been removed.

 

Kind regards,

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.8!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Endpoint Context Servers - Lazy Handler polling frequency reduced to one (1) minute
• Platform – Added interface specific OIDs to SNMP polling

• OnGuard – Automatically exclude Apple macOS non-encryptable partitions (recovery and VM) from “All Drive” encryption checks

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.8/Default.htm).

 

The update images have been posted to the support site (Aruba Support site), MNP, and the ASP software updates portals. 

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.9!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Support for changing the TACACS+ port to something other than 49
• Support for AOS-S DUR netdestination and netservice commands in AOS-S 16.06
• JAMF endpoint context servers can now use the Group Name attribute

As always, please take note of the “Changes of Behaviors” section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.9/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.  Posting to MNP and ASP will complete shortly.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.10! In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

- Endpoint Context Servers – Added support to parse additional JAMF attributes ‘mobile_device_group’ in to ClearPass Endpoint Database.

- Platform – Added support for Policy Manager running on VMware ESXi 6.7 Update1 and Update2.

- Platform – Added support for Policy Manager running on Microsoft Hyper-V Server 2019.

- OnGuard – Extensive updated list of supported OnGuard products, check release notes for details.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.10/Default.htm).

 

The update images have been posted to the support site (Aruba Support site), MNP, and the ASP software updates portals.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

The release notes say Clearpass 6.7 can use a SPAN port for profiling. Can this SPAN port be used with ESXi installs? In the documentation I can only see reference to SPAN ports for Hyper-V.

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.6 !  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

Display IPv6 Address in RADIUS Accounting

• Adding the ability to display a list of the Framed-IPv6-Addresses in the Network Details section of an Access-Tracker session.

 

Improved the performance for quicker LDAP lookups

• For customer with large AD and deep nested groups, this feature speeds up the performance of LDAP queries lookups.

 

In OnGuard, we’ve introduce a new option to exclude certain drives from disk encryption checks when All Drives is selected.

• Allows recovery drives on different macOS releases to be excluded easily.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.6/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

 

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.7!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Improved license activations to address a number of customer complaints
• OnGuard enhancements
  • Allows the Anti-Virus DAT file format to be specified when posture includes minimum versions of actual files checked. Example dd-mm-yy rev xx or yyy-mmm-dd.
  • Ability to disable bouncing a macOS VPN interface after waking to improve compatibility with certain VPN clients

 

Special Note:  Although not related to 6.7.7, this release announcement will also serve as notification that KVM Hypervisor support is fully restored. Upgrades are available immediately.  The install image will be posted shortly.  For optimum performance a minimum version of CentOS 7.5 is required. 

 

Ubuntu 16.04 LTS is now the minimum supported version for Onboard

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.7/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.  Posting to MNP and ASP will complete shortly.

 

A big thanks and congratulations to the ClearPass Engineering and QA teams for reaching this milestone & to the TechPubs team for their work on the Release Notes and manuals!

 

Best regards,

The ClearPass Team

The Release Notes are no longer available as PDF?

The RN for patches 0-5 all contain a link that purports to offer a PDF version, but all it does is take the browser back to the same folder that has only the HTML version.

 

I find it easier to use the PDF version - is there any possibility that it could be provided for (at least) 6.7 patch 7?

The user guides and release notes are only available in HTML format.

Hi everyone

 

when will Clearpass permit network devices to be configured with IPv6 addresses? is there a roadmap for this subject?

 

best regards

Jessian

Hi – roadmap cannot be discussed here. I would recommend reaching out to your Aruba account team.

Hi,

I use ClearPass Policy Manager 6.7.4 on C2000V platform now, but I don´t knew if this version is recommended after the last versions anounced,

Can you tell me if I'm in the right version or should I update?

 

Regards,

Generally speaking, you should try to run the latest releases.

Thanks for your answer!
But ... Do we always have to install the latest version? To what extent is it reliable?

 

Thanks in advance,

 

Regards,

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.11!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

  

• OnGuard – Additional improvements to “All Drives” encryption checks on macOS systems.  Encryption checks improved to account for Extensible Firmware Interface (EFI) and Preboot partitions.

 

• OnGuard – Enhanced feature to support the latest MacBook with T2 security chip. 
• A new Status Check option allows validation of FileVault status in addition to the actual encryption state.  T2 enabled systems always use drive encryption, this allows for validation that the FileVault process is also configured correctly.

  

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.11/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.  Posting to MNP and ASP will complete shortly.

 

A big thanks and congratulations to the ClearPass Engineering, ClearPass QA and TechPubs teams for reaching this milestone!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.12!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• OnGuard
• "Adds official support for macOS Catalina (10.15)" and "improves Linux support for Trend Micro Deep Security Agent".

• Policy Manager
• Includes enhancement to edit services simultaneously in multiple tabs on a web browser.

A summary deck on the above features is posted HERE.  Make sure to bookmark that link as we update presentations related to 6.7. on that site.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.12/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.  Posting to MNP and ASP will complete shortly.

 

A big thanks and congratulations to the ClearPass Engineering, ClearPass QA and TechPubs teams for reaching this milestone!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass Policy Manager 6.7 / 6.8 Hotfix for Brazil DST changes.  Brazil has decided to not observe Daylight Savings Time this year.  This change requires a hotfix on all 6.7 or 6.8 systems to ensure that the clock is properly corrected to indicate the accurate time.

 

Unlike previous hotfixes, this hotfix can be installed on 6.7 or 6.8 systems so there is only one patch for all supported versions.

 

This patch is only required for customers operating servers in Brazil configured to use local time. 

 

There is a Known Issue with this patch is that the time zone on the publisher will reset to US Pacific time on cluster after the reboot.  This can be reset and the time restarted.  Subscriber and stand-alone nodes are not impacted.

 

The hotfix image has been posted to the support site (Aruba Support site). Posting to MNP and ASP will complete shortly.

 

A big thanks and congratulations to the ClearPass Engineering, and ClearPass QA teams for reaching this milestone!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.13!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• Policy Manager
• When Policy Manager is configured to use a SAML IdP for authentication through the UI, the logout logic will now include forceAuthn="true" in the subsequent SAML authentication request. If supported by the IdP, this will require the user to re-authenticate.

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.13/Default.htm).

 

The update images have been posted to the support site (Aruba Support site) and the software updates portal.  Posting to MNP and ASP will complete shortly.

 

A big thanks and congratulations to the ClearPass Engineering, ClearPass QA and TechPubs teams for reaching this milestone!

 

Best regards,

The ClearPass Team

Hello All,

 

We are pleased to announce the immediate availability of ClearPass 6.7.14!  In addition to bug fixes, this release also includes several new features that our Engineering and QA team have worked tirelessly to include:

 

• OnGuard
• OnGuard Agent Support Charts now display the supported minor version of the product and operating system in addition to the major version.

 

• Policy Manager
• ClearPass Policy Manager Virtual Appliance deployments are now supported on VMware vSphere Hypervisor (ESXi) 7.0.

 

As always, please take note of the ‘Changes of Behaviors’ section of the release notes (https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.7.14/Default.htm).

 

The update images have been posted to the support site (Aruba Support Portal) and the software updates portal. 

 

Please note that this release marks the End of Development on the 6.7.x version.  As noted on https://www.arubanetworks.com/support-services/end-of-life/#ClearPassSoftware the 6.7 release will reach end of life on 4 June 2021

 

A big thanks and congratulations to the ClearPass Engineering, ClearPass QA and TechPubs teams for reaching this milestone!

 

Best regards,

The ClearPass Team