Security

 View Only
Expand all | Collapse all

Clearpass licenses keys when upgrading to 6.11

This thread has been viewed 25 times
  • 1.  Clearpass licenses keys when upgrading to 6.11

    Posted Nov 03, 2023 05:38 AM
    Hello,
     
    During the preparation of the upgrade of a Clearpass cluster (HW appliances) from 6.10 to 6.11 I have hit a protential problem
    with the licenses keys.
     
    If the servers were deploy originally on version 6.7 or lower the licenses keys are on the old format
     
    (sample:  MH6K-OFJ55P-UMJ6-EFBNWK-YYYYYY-PKPP-OOEWPG-XXXXXXX-TRTF-L3WSBQ)
     
    Those licenses keys cannot be installed on 6.10 or later as the accepted format is now "certificate like"
     
    Sample:
    -----BEGIN CLEARPASS PLATFORM LICENSE KEY-----
    XXXXXXXXXXXXXXXXXYYYYYYYYYYYYYYYYYYYYYYCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
    38f1WnzZdsB77U9rCpimsFEjBvHDFttg2gWiqhIrRFufdvCUn82wZs8Z6P7e5dC+Y0SZdRxpUR0b
    aYe+TSvqW8vHziVFT+bhvryT67nhy1hSQtNy3vpG3wVN9lKFGQPY0rAmSsuagE1MyFM9QkHvOagv
    eaDDZbC1LoID+JaSSAE0V1BgTu24SjAy1VSQFXYAjufFZG3XFwBOq9gVPBzClDW5yWqymWTSZQf9
    0C2mC3PTCqVxij7GBXWsg2Ph1F8JP6YHzUvT+XHK5unSqyjABaEsGLlkXYuhEqvUeQliWx+4iThE
    Vbz4k162k3wWYBCrwJCx1VXPbR4o3ktN0h9xWVP17jq4xZr1q9Lf9YLuzCN2B5wBG/RGApGajzPK
    sDIe+U2vGwjpDv8JTsSkA8+5y2Yeb4JbgXV2Q5pDY7YWVNeYsvdgFhl38NEQQk29mGqyGyJsUA7l
    C7yrtGfxh90d37QwuYJp7r+iIsLLI94WZIbeaCqgKDuVRbaNt2N1RlSF/gFhVPW4ySzSrY/rZi0g
    nxUmCWemsdUPD++t2EWrGTQcnG9qODL4v+QWrHnPvsrojI4lCoTqpWFFlz5HmtT2cm0pLwPUqZ2p
    RD2unrCXT+Ex6qLmLrUAAAD//w==
    -----END CLEARPASS PLATFORM LICENSE KEY-----
     
    That's mean the licenses keys MUST be converted to the "6.8 or later" format before the 6.11 migration
     
    I have found a page on ASP portal "HOME > LICENSE MANAGEMENT > LICENSES > CLEARPASS NL CONVERSIONS" that propose the option
    "Convert ClearPass licenses 6.7 to ClearPass licensing 6.8 & later".
     
    I have tried with a few of my customer ASP accounts to do this conversion but I could never see, on this page, the 6.7 keys to be converted
    (always empty).
     
    Has anybody successfully converted the 6.7 keys to the new format via ASP portal ?
     
    Actually I am working with TAC to get the licenses key converted but it takes a long time (be aware of that when planning 6.11 migration)
     
    As we will all have to migrate our many customers CPPM to 6.11 by May 2024 it should be possible to convert the old key format to the new
    via ASP without having to open a TAC case for each installation.
     
    Kind regards
    Christian Chautems


  • 2.  RE: Clearpass licenses keys when upgrading to 6.11

    Posted Nov 03, 2023 08:00 AM

    Hi Christian

    Yes, I have converted a lot of 6.7 licenses to 6.8+ through the ASP site. To be able to convert the license I think, you have to have a valid support agreement bound to the the license (serial number).

    This is also something that you need to have to be able to update ClearPass after the installation of 6.11. But you do not only need to have a valid support agreement, you also need to register both the support agreement and the associated serial numbers under Device & Contract Management in ASP to get the validation to work.

    In some cases I have had issues with the support agreement after RMA of the initial hardware, as the support contract hasn't been updated with the serial number of the replecement unit.

    Thus I always import the support agreement in ASP and all my serial numbers, must be under the same organization as the account creating a token in ClearPass, and verify that the serial numbers are listed under the support agreement and that the agreement is valid.



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP 2023, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACDP , ACEP, ACSA
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------



  • 3.  RE: Clearpass licenses keys when upgrading to 6.11

    Posted Nov 03, 2023 10:15 AM

    Thanks for the update Jonas,

    Strange we had SW & HW maintenance contracts (SAID) added to ASP but on the conversion page nothing was displayed.

    TAC has provided the migrated Application Licenses keys but had problem with the Platform Keys (HW appliance).

    While waiting for TAC I have done some investigations on my side I have found that I could register the HW serial numbers on the 
    "HOME>LICENSE MANAGEMENT>LICENSES>CLEARPASS NL – PAK"

    Now I have everything for my migration on Saturday

    Kind regards

    Christian Chautems

    Network Architect
    CCIE #1310 / ACCP / RCSP-W