Security

 View Only
Back to discussions
Expand all | Collapse all

Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

This thread has been viewed 50 times

  • 1.  Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Nov 08, 2019 09:56 AM

    Hello all,

    in order to implement wired guest service, we currently try to initiate a CoA Port Bounce on a HPE Aruba 2930M Stack with WC.16.09.0004 installed. Clearpass is running in Version 6.8.3.110034 on C2000V platform.

     

    Troubleshooting done so far:

    - Both CPPM and Switch are running NTP.

    - Switchconfig was checked with this guide: http://h22208.www2.hpe.com/eginfolib/networking/docs/switches/WB/15-18/5998-8152_wb_2920_asg/content/ch06s04.html#s_Configuring_the_switch_to_access_a_RADIUS_server

    - Switch is added as NAD with vendor Hewlett-Packard-Enterprise
    - Standard-CoA-Port 3799 is used


    Switchconfig:

    radius-server host X.12 key XXX

    radius-server host X.12 dyn-authorization
    radius-server host X.12 time-window plus-or-minus-time-window
    radius-server host X.12 time-window 0

     

    Screenshots:

    error2.pngerror3.png

    Please help, why we are receiving the folling error message when trying to send a CoA:
    Radius [ArubaOS Switching - Bounce Switch Port] failed for client 48XXXfXX. Unsupported-Attribute.

    error.png

     



  • 2.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Nov 08, 2019 10:05 AM
    Are you using a VIP in ClearPass?

    Please confirm that the time matches between CPPM and the Switch

    Sent from Mail for Windows 10


  • 3.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Nov 08, 2019 10:28 AM

    Hello Victor,

    thanks for the immediate reply :)

     

    Actually the times match, because both devices are using NTP to synchronize against our AD-Servers.

    Here some screenshots:

    error4.png

    error8.pngerror7.png



  • 4.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Nov 08, 2019 10:32 AM
    Are you a VIP in ClearPass?



    Thank you

    Victor Fabian

    Pardon typos sent from Mobile


  • 5.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute
    Best Answer

    Posted Nov 08, 2019 12:27 PM

    This is a bug in 6.8.3. A hotfix will be released next week to address this issue. 

     

    A note was added to the download shortly after it was discovered and it is in the release notes: https://www.arubanetworks.com/techdocs/ClearPass/CP_ReleaseNotes_6.8.3/Default.htm#WhatsNew/KnownThisRls.htm#known_35984

    Screen Shot 2019-11-08 at 9.25.45 AM.png



  • 6.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Jun 14, 2024 10:48 AM

    Hi Cappalli,

    Have there been any reports of this issue returning in one of the recent updates? We experience the exact same behaviour in a new deployment where we have installed CPPM 6.12.2.302889 (latest patch). Default ArubaOS CoA (both bounce port and terminate session) to a 2530-8G or 24G fail with "Unsupported Attribute". Tested on multiple switches on different switch firmwares.

    Thx,

    Niels


    Original Message


  • 7.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Jun 24, 2024 11:38 AM

    I have not heard about that. Please open a TAC case, it's possible that there is a configuration issue, rather than a bug.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 8.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Jul 02, 2024 03:36 AM

    Hi Herman

    We got around to fixing the issue by updating our AOS switches to the latest firmware, in which the CoA RADIUS response was handled without any issues.

    Niels - Tricore


    Original Message


  • 9.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Nov 08, 2019 12:32 PM

    Hello Victor,

     

    No - we are not using VIP even though we have a Clearpass-Cluster. This is because we are not L2-Connected between the nodes.

    In the switch there are both CPPM-Nodes configured as radius hosts and we do the failover via the switch logic.

     

    We are currently doing some Wireshark and we can see, that CPPM is correctly sending the COA but the switch is returning the CoA-NAK:error11.png

     

    error10.PNG



  • 10.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Nov 08, 2019 01:04 PM
    Tim just indicated that there’s a bug in the version you are running

    Sent from Mail for Windows 10


  • 11.  RE: Clearpass CoA Bounce with ArubaOS Switch - Unsupported Attribute

    Posted Dec 09, 2024 12:41 PM

    Hi,

    We're facing same problem, meantime we saw that CoA option listed wrong on some HPE switches. Based on your screenshot i suspect Message Authenticator attribute.

    Could you verify that problem begin with 6.12?


    Original Message


Related Content