Security

Hello everyone, I would like to ask a question about the automatic deletion of endpoints in clearpass. There is a function created to inform the date on which the authentication will expire, however, the endpoint remains registered, and I have to manually delete the endpoint so that a customer can insert a new device. Is there any way to do this automatically?

Can you give some specifics, like what attribute are you talking about, what authentication flow is this for?

Hello everyone, I would like to ask a question about the automatic deletion of endpoints in clearpass. There is a function created to inform the date on which the authentication will expire, however, the endpoint remains registered, and I have to manually delete the endpoint so that a customer can insert a new device. Is there any way to do this automatically?

Thank you for your response.

The issue involves the MAC-Auth Expiry attribute within ClearPass. This attribute is automatically assigned to endpoints when a user registers a device. We created an expiration service intended to delete old or unused endpoints based on this attribute, but it is not functioning as expected.

Specifics:

• Attribute: MAC-Auth Expiry, which should indicate when an endpoint's MAC authentication has expired.
• Authentication Flow: This is part of a flow where users are limited to registering a maximum of 3 devices. When they attempt to register a new device, and they already have 3 registered, they receive an error due to this limitation. To mitigate this, we want to automatically delete endpoints with expired MAC-Auth based on the MAC-Auth Expiry attribute.

However, the deletion process is not working as intended, and the endpoints are not being removed. Additionally, when trying to implement a script via ClearPass Extensions to handle this, I encountered an internal server error (500) during the extension installation.

Let me know if you need further details or clarification.

Thank you!

Can you give some specifics, like what attribute are you talking about, what authentication flow is this for?

Hello everyone, I would like to ask a question about the automatic deletion of endpoints in clearpass. There is a function created to inform the date on which the authentication will expire, however, the endpoint remains registered, and I have to manually delete the endpoint so that a customer can insert a new device. Is there any way to do this automatically?

That's not how endpoint cleanup works.  You'll want to enable cleanup so that endpoints not seen for a specified amount of time are deleted, that way you prevent the growth of that table over months and years to a truly ridiculous size.

If you want to limit a user to a certain number of devices to be connected, then use a concurrent lookup method rather than the (old and very dated) canned method that is provided in the wizard.  There is already an "Active-Sessions" attribute available through the Insight auth source, I'm not a fan of that one because of the time period the query looks at.

My custom queries for an Aruba wireless environment, will pull the current number of sessions associated with a specific username:

These are used for three separate services: pre-auth, user auth, and MAC auth.

You're also going to probably want to make use of the simultaneous_use field on the guest user account so that you can make exceptions to the normal limit of devices.  That requires having the value available so that you can compare against how many sessions are currently active.

Examples for role mapping:

Thank you for your response.

The issue involves the MAC-Auth Expiry attribute within ClearPass. This attribute is automatically assigned to endpoints when a user registers a device. We created an expiration service intended to delete old or unused endpoints based on this attribute, but it is not functioning as expected.

Specifics:

• Attribute: MAC-Auth Expiry, which should indicate when an endpoint's MAC authentication has expired.
• Authentication Flow: This is part of a flow where users are limited to registering a maximum of 3 devices. When they attempt to register a new device, and they already have 3 registered, they receive an error due to this limitation. To mitigate this, we want to automatically delete endpoints with expired MAC-Auth based on the MAC-Auth Expiry attribute.

However, the deletion process is not working as intended, and the endpoints are not being removed. Additionally, when trying to implement a script via ClearPass Extensions to handle this, I encountered an internal server error (500) during the extension installation.

Let me know if you need further details or clarification.

Thank you!

Can you give some specifics, like what attribute are you talking about, what authentication flow is this for?

Hello everyone, I would like to ask a question about the automatic deletion of endpoints in clearpass. There is a function created to inform the date on which the authentication will expire, however, the endpoint remains registered, and I have to manually delete the endpoint so that a customer can insert a new device. Is there any way to do this automatically?

Hi,

Thank you for the detailed response. I have a quick question regarding the management of unused endpoints. If we implement the suggested approach using the custom queries and limit checks, what will happen to endpoints that are no longer in use? Will they be retained in the database indefinitely, or will they be automatically deleted after a certain period of inactivity?

Additionally, we currently have around 3000 endpoints registered in our database, and about half of them have not been used in over a month. However, they are not being automatically deleted. How can we configure ClearPass to automatically remove these stale endpoints to prevent the database from becoming cluttered?

Your guidance on this would be greatly appreciated.

Thanks in advance for your clarification!

That's not how endpoint cleanup works.  You'll want to enable cleanup so that endpoints not seen for a specified amount of time are deleted, that way you prevent the growth of that table over months and years to a truly ridiculous size.

If you want to limit a user to a certain number of devices to be connected, then use a concurrent lookup method rather than the (old and very dated) canned method that is provided in the wizard.  There is already an "Active-Sessions" attribute available through the Insight auth source, I'm not a fan of that one because of the time period the query looks at.

My custom queries for an Aruba wireless environment, will pull the current number of sessions associated with a specific username:

These are used for three separate services: pre-auth, user auth, and MAC auth.

You're also going to probably want to make use of the simultaneous_use field on the guest user account so that you can make exceptions to the normal limit of devices.  That requires having the value available so that you can compare against how many sessions are currently active.

Examples for role mapping:

Thank you for your response.

The issue involves the MAC-Auth Expiry attribute within ClearPass. This attribute is automatically assigned to endpoints when a user registers a device. We created an expiration service intended to delete old or unused endpoints based on this attribute, but it is not functioning as expected.

Specifics:

• Attribute: MAC-Auth Expiry, which should indicate when an endpoint's MAC authentication has expired.
• Authentication Flow: This is part of a flow where users are limited to registering a maximum of 3 devices. When they attempt to register a new device, and they already have 3 registered, they receive an error due to this limitation. To mitigate this, we want to automatically delete endpoints with expired MAC-Auth based on the MAC-Auth Expiry attribute.

However, the deletion process is not working as intended, and the endpoints are not being removed. Additionally, when trying to implement a script via ClearPass Extensions to handle this, I encountered an internal server error (500) during the extension installation.

Let me know if you need further details or clarification.

Thank you!

Can you give some specifics, like what attribute are you talking about, what authentication flow is this for?

Hello everyone, I would like to ask a question about the automatic deletion of endpoints in clearpass. There is a function created to inform the date on which the authentication will expire, however, the endpoint remains registered, and I have to manually delete the endpoint so that a customer can insert a new device. Is there any way to do this automatically?