Security

 View Only
  • 1.  Clearpass Data Disk in Azure

    Posted Apr 14, 2025 11:25 AM

    Hello everyone,

    I have 2 questions for one of my clients who wishes to install a Clearpass server hosted on Azure.

    Here is the installation procedure: Creating the Azure Custom Storage Account and Virtual Appliance

    1. What is the purpose of the Data Disk?

    In the documentation, it asks us to create a Data Disk as follows:

    Create and Attach a New Disk: This setting is optional, as you do not need to create and attach a new disk at this time. You may choose to attach a disk when you are ready to move your VA from a test environment into production.

    This disk reminded me of the additional disk we usually add in VMware environments.

    However, this 1TB disk costs €200/month, and since the wording is a bit suggestive (optional and may), the client is challenging me on the necessity of this disk. The client also mentioned that in the documentation, we created a "Custom Storage Account," which is already a storage space...

    1. Do you have any feedback on the server model to use?

    We need to choose a server model, and here's what is stated in the documentation:

    Click this drop-down menu and select one of the following recommended sizes. Each of the recommended disk sizes corresponds with a ClearPass hardware appliance model.

    • The Standard_D2s_v3 - 2 vcpus, 8 GiB memory option corresponds to a ClearPass C1000 appliance.
    • The Standard_D4s_v3 - 4 vcpus, 16 GiB memory option corresponds to a ClearPass C2000 or C2010 appliance.
    • The Standard_D16s_v3 - 16 vcpus, 64 GiB memory option corresponds to a ClearPass C3000 or 3010 appliance.

    These servers are older generations (from an Azure perspective). Have you ever installed Clearpass with more recent versions, and does that work well?

    Thank you.



  • 2.  RE: Clearpass Data Disk in Azure

    Posted Apr 15, 2025 04:05 AM

    1 - The initial disk in the appliance is only 40GB. Just enough to get the basic appliance built with the initial settings. The second disk is added and then the command 'vmorph' is used to basically rebuild the server with the larger (and faster) disk to be the actual storage used for the appliance. The documentation talks about it "when it's ready for production" but I found this not very helpful as the first thing I wanted to do was upgrade the version and there was problems doing this before I added the extra disk.

    2 - I used the closest comparible server Standard D4s v3 which was available in our main regions. 




  • 3.  RE: Clearpass Data Disk in Azure
    Best Answer

    Posted Apr 15, 2025 06:31 AM

    I also run into the issue that the update of the system wasn't possible as we run out of disk trying to deploy the update. This was without any clear error messages that the disk was full.

    Also found out the hard way if you add the new big disk before running the initial setup, as you do with on prem VM's, the morph-vm command sometimes do not see the disk at all and sometimes see the disk but after running the morph-vm command you don't have a new larger disk. But the server says it's morphed to the new VM size. After this you can't run the command again to the same size, i.e. C2000V.

    The solution to this is to run the initial configuration, power off the server, add the disk, boot and run morph-vm. TAC also informed that there are some bugs that cause the mentioned issues. They are solved in later versions of 6.11 and 6.12 as I understood, but as you are not able to update from the initial image due to disk space that doesn't help much.



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------



  • 4.  RE: Clearpass Data Disk in Azure

    Posted Apr 15, 2025 11:10 AM

    Many thanks for your replies.

    I'll try to convince my customer with those informations




  • 5.  RE: Clearpass Data Disk in Azure

    Posted Apr 16, 2025 03:05 AM

    The additional disk is a must. Without that it is only a lab ClearPass and you cannot install patches due to space issues.

    It is important to attach the additional disk when the VM is powered off otherwise morph-vm will not see the disk. I recommend to make a backup/snapshot of the VM before the morph-vm command because if there is an error during morph-vm there is no way to roll back just to reinstall the server.




  • 6.  RE: Clearpass Data Disk in Azure

    Posted Apr 16, 2025 05:48 AM

    Thanks Itsvan.

    Another question. By default the data disk is a premium disk while the OS Disk is a standard if I remember well.

    Do you know if we must use a premium disk ?




  • 7.  RE: Clearpass Data Disk in Azure

    Posted Apr 16, 2025 08:13 AM

    You should follow the system requirements to remain supported. For performance, it's important to have fast disks that can handle many I/O operations per second (iops).

    If you configure lower class disks, you may run into performance issues, and TAC may refuse support if the issues you see can be related to underrated system specifications.

    It may work with normal disk, depending on your system load, but I would not take the risk. I've seen too many issues where customers decided that ClearPass could run with less disk/memory/CPU, and at some point the system became unstable.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 8.  RE: Clearpass Data Disk in Azure

    Posted Apr 17, 2025 04:10 AM

    We use the c3000 equivalent vm so premium SSD. I think from performance point of view the Azure VM is below the physical C3010 appliance, at least when I check the default parameters in server configuration I can see it can handle less sessions. The problem is that you cannot change disk later without reinstalling ClearPass.