Controllerless Networks

Hi there,

Currently facing an issue where some clients will receive a role from ClearPass (aruba-user-role VSA), apply it but after some minutes get into the SSID role.

There is no activity on ClearPass other than Accounting-Stop and Accounting-Start (with a new session-id) when this happens. No Access-Req is present.

1. Client connects; ClearPass answers with aruba-usr-vsa = user-role; IAP shows role = user-role for the client
2. Then, after some minutes, client role becomes equal to the SSID name
3. Disconnecting the client (trashcan icon in client list) forces a new reauth and the role gets again equal to user-role
4. But then again after some minutes ir reverts back to SSID name

Any idea what can be the issue here?

Thanks

Hi there,

Currently facing an issue where some clients will receive a role from ClearPass (aruba-user-role VSA), apply it but after some minutes get into the SSID role.

There is no activity on ClearPass other than Accounting-Stop and Accounting-Start (with a new session-id) when this happens. No Access-Req is present.

1. Client connects; ClearPass answers with aruba-usr-vsa = user-role; IAP shows role = user-role for the client
2. Then, after some minutes, client role becomes equal to the SSID name
3. Disconnecting the client (trashcan icon in client list) forces a new reauth and the role gets again equal to user-role
4. But then again after some minutes ir reverts back to SSID name

Any idea what can be the issue here?

Thanks

Could it be that you have Role Assignment in your SSID configuration? It may be that there is a role assignment that for specific device types changes the role, that may happen in the middle of the session. I would make sure there are no VLAN Assignment Rules and no Role Assignment Rules to start with. Then just use the Aruba VSAs: Aruba-User-Role and Aruba-User-VLAN, which are both applied even if there are no assignment rules.

Hi there,

Currently facing an issue where some clients will receive a role from ClearPass (aruba-user-role VSA), apply it but after some minutes get into the SSID role.

There is no activity on ClearPass other than Accounting-Stop and Accounting-Start (with a new session-id) when this happens. No Access-Req is present.

1. Client connects; ClearPass answers with aruba-usr-vsa = user-role; IAP shows role = user-role for the client
2. Then, after some minutes, client role becomes equal to the SSID name
3. Disconnecting the client (trashcan icon in client list) forces a new reauth and the role gets again equal to user-role
4. But then again after some minutes ir reverts back to SSID name

Any idea what can be the issue here?

Thanks

Hi,

Unfortunately not.

Whatever option I chose for "role assignment", it always show the same behaviour.

Could it be that you have Role Assignment in your SSID configuration? It may be that there is a role assignment that for specific device types changes the role, that may happen in the middle of the session. I would make sure there are no VLAN Assignment Rules and no Role Assignment Rules to start with. Then just use the Aruba VSAs: Aruba-User-Role and Aruba-User-VLAN, which are both applied even if there are no assignment rules.

Hi there,

Currently facing an issue where some clients will receive a role from ClearPass (aruba-user-role VSA), apply it but after some minutes get into the SSID role.

There is no activity on ClearPass other than Accounting-Stop and Accounting-Start (with a new session-id) when this happens. No Access-Req is present.

1. Client connects; ClearPass answers with aruba-usr-vsa = user-role; IAP shows role = user-role for the client
2. Then, after some minutes, client role becomes equal to the SSID name
3. Disconnecting the client (trashcan icon in client list) forces a new reauth and the role gets again equal to user-role
4. But then again after some minutes ir reverts back to SSID name

Any idea what can be the issue here?

Thanks

Are you doing anything with a CoA that could be causing the issue?

Open a case with TAC, if the issue is consistently repeatable then setting up a debug session to figure out where the change is happening pretty easily.

Hi,

Unfortunately not.

Whatever option I chose for "role assignment", it always show the same behaviour.

Could it be that you have Role Assignment in your SSID configuration? It may be that there is a role assignment that for specific device types changes the role, that may happen in the middle of the session. I would make sure there are no VLAN Assignment Rules and no Role Assignment Rules to start with. Then just use the Aruba VSAs: Aruba-User-Role and Aruba-User-VLAN, which are both applied even if there are no assignment rules.

Hi there,

Currently facing an issue where some clients will receive a role from ClearPass (aruba-user-role VSA), apply it but after some minutes get into the SSID role.

There is no activity on ClearPass other than Accounting-Stop and Accounting-Start (with a new session-id) when this happens. No Access-Req is present.

1. Client connects; ClearPass answers with aruba-usr-vsa = user-role; IAP shows role = user-role for the client
2. Then, after some minutes, client role becomes equal to the SSID name
3. Disconnecting the client (trashcan icon in client list) forces a new reauth and the role gets again equal to user-role
4. But then again after some minutes ir reverts back to SSID name

Any idea what can be the issue here?

Thanks

No CoAs involved.

Currently in contact with TAC, but still no solution was provided.

Are you doing anything with a CoA that could be causing the issue?

Open a case with TAC, if the issue is consistently repeatable then setting up a debug session to figure out where the change is happening pretty easily.

Hi,

Unfortunately not.

Whatever option I chose for "role assignment", it always show the same behaviour.

Could it be that you have Role Assignment in your SSID configuration? It may be that there is a role assignment that for specific device types changes the role, that may happen in the middle of the session. I would make sure there are no VLAN Assignment Rules and no Role Assignment Rules to start with. Then just use the Aruba VSAs: Aruba-User-Role and Aruba-User-VLAN, which are both applied even if there are no assignment rules.

Hi there,

Currently facing an issue where some clients will receive a role from ClearPass (aruba-user-role VSA), apply it but after some minutes get into the SSID role.

There is no activity on ClearPass other than Accounting-Stop and Accounting-Start (with a new session-id) when this happens. No Access-Req is present.

1. Client connects; ClearPass answers with aruba-usr-vsa = user-role; IAP shows role = user-role for the client
2. Then, after some minutes, client role becomes equal to the SSID name
3. Disconnecting the client (trashcan icon in client list) forces a new reauth and the role gets again equal to user-role
4. But then again after some minutes ir reverts back to SSID name

Any idea what can be the issue here?

Thanks