Security

Hi,

We have 1200 physical machines in our office, but more than half of the clients will be active during morning shifts from 9 am to 5 pm and the other half would be active during the night shift from 6 pm to 1 pm. So my concurrent connection is less than 700 as the access license is counted in 15 minutes, but I need 1200 onguard license as the license is counted for 24 hours. But when I pointed to this to partner, he told me that access license should be equal or greater than onguard license. Is this correct? as I need to buy double the access license than I need.

Check this link for more details on license usage

https://support.arubanetworks.com/Documentation/tabid/77/DMXModule/512/EntryId/33239/Default.aspx

Onguard license conusmed per devices so if you have 1200 devices you need 1200 onguard licenses and Access License is per session based and server checks for state of session every 15 minutes, if you are sure that only 700 devices will be active during any time interval than 1200 access license should be fine .

Guest users will also consume Access Licenses, if you have Guest users in your network then you need to consider this count aswell.

Hi,

Thank you for the reply, I have gone through the license guide but I didn't get a clear answer.

Why would I need 1200 access license since my concurrent session is less than 700? I had made note of guest and it is less than 700 including that.

But Aruba partner is saying my Ongurad license should be less than or equal access license. I can't order a 700 access license and 1200 Onguard license is that correct?

Hi,

Yes, Correct Onguard license conusmed per devices so if you have 1200 devices you need 1200 onguard licenses, however at the same time 1200 Onguard licenses are for per devices on which we install the Persistent agent or dissolvable agent.

OnGuard license consumption is based upon a per-endpoint model. For example, if the OnGuard persistent agent is to be
installed (persistent agent) or used (dissolvable agent) on five endpoints within a 24-hour period, five OnGuard licenses are
required At the same time, since we do dot1x we use the Access License for the Dot1x authentication with Onguard.

Access license consumption includes 802.1X Authentication, MAC Auth, TACACS, Guest, OnConnect, Security Exchange and Endpoint Profiling,

And You must need an accounting enabled on all of your NAD devices since once we receives the accounting stop we free the license from license pool for every 15 minutes, or else license will be consume for 24 hours and it get freed in next nightly maintenance. So make sure the Accounting is enabled on all the NAD devices in your networks which sending authentication requests to ClearPass.

Answering to your Query.

Yes, you can not order the 700 Access License's as well as 1200 Ongaurd licenses but both you can order only in manner of 100,500,1K, 2500, 5K, 10 on 1,3 and 5 year subscription.  

Minimum you have to purchase 1K Acess Licenses in your case. Either you purchase license permanently or yearly subscription ( 1, 3 & 5 years) at end of year you have to reniew your license suscription.

Hi,

Thank you for helping me. I understand about the licenses as you explained, but the query which is not answered is, is there any rule saying Onguard license should be less than or equal to access license?

In my case can I order access license 1K and Onguard license 1.2k ?

I have addressed your query in previous post

"Onguard license conusmed per devices so if you have 1200 devices you need 1200 onguard licenses "

In your case you need to purchase 1K Access License and 1200 OG.