Security

Upcoming community maintenance Oct. 27th through Oct. 29th
For more info click here
Reply
Highlighted
Occasional Contributor I

Can ClearPass send a disconnect request when the guest user expired?

Hi everyone:

      I have a question about the Guest user.

I regist a guest user throught the web page, and the expired time is about 1 hour. After 1 hour, the user can not login again. It will reject the authentication. I want to know, if the Clearpass can send a DM (disconnect request) message by radius packet to the NAS when the guest user become to expired status? If it's ok, how to do the configuration?


Accepted Solutions
Highlighted
MVP Expert

Re: Can ClearPass send a disconnect request when the guest user expired?

Hi,

 

Yes, its Radius Disconnect message.ClearPass should be configured as RFC 3576 server on the controller and Accounting should also be enabled on the controller. Need to enable insight in clearpass aswell.

Regards,

Pavan

If my post address your query, give kudos:)


Pavan Arshewar | ACCP

If my post address your queries, give kudos and accept as solution!
NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.

View solution in original post


All Replies
Highlighted
MVP Expert

Re: Can ClearPass send a disconnect request when the guest user expired?

Yes, it will send de-auth radius packet. I have attached CPPM and Aruba wireless integration guide, which proivde basic guest regestration configuration.

 

Regards

Pavan

If my post address your query, give kudos:)


Pavan Arshewar | ACCP

If my post address your queries, give kudos and accept as solution!
NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.
Highlighted
Contributor I

Re: Can ClearPass send a disconnect request when the guest user expired?

update your enforcement policy with Radius CoA disconnect when the the account expires.

 

 

 

 Aruba Wireless ACMP/ ClearPass ACCP Professional

Give Kudo give helpful

Highlighted
Occasional Contributor I

Re: Can ClearPass send a disconnect request when the guest user expired?

Hello

    what's the meaning of de-auth radius packet.

Is that the packet in RFC3576 , Disconnect Message ?

 

2.1. Disconnect Messages (DM)

A Disconnect-Request packet is sent by the RADIUS server in order to
terminate a user session on a NAS and discard all associated session
context. The Disconnect-Request packet is sent to UDP port 3799, and
identifies the NAS as well as the user session to be terminated by
inclusion of the identification attributes described in Section 3.

Chiba, et al. Informational [Page 5]
RFC 3576 Dynamic Authorization Extensions to RADIUS July 2003

+----------+ Disconnect-Request +----------+
| | <-------------------- | |
| NAS | | RADIUS |
| | Disconnect-Response | Server |
| | ---------------------> | |
+----------+ +----------+

Highlighted
MVP Expert

Re: Can ClearPass send a disconnect request when the guest user expired?

Hi,

 

Yes, its Radius Disconnect message.ClearPass should be configured as RFC 3576 server on the controller and Accounting should also be enabled on the controller. Need to enable insight in clearpass aswell.

Regards,

Pavan

If my post address your query, give kudos:)


Pavan Arshewar | ACCP

If my post address your queries, give kudos and accept as solution!
NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.

View solution in original post

Highlighted
Contributor II

Re: Can ClearPass send a disconnect request when the guest user expired?

Ciao,

who can explain why I need to enable insight in clearpass in order to make works CoA?

Thanks

Highlighted
Moderator

Re: Can ClearPass send a disconnect request when the guest user expired?

Insight is not required for RADIUS Dynamic Authorization.



If this response is more than 1 year old, it may no longer be accurate. Please consult official Aruba documentation, TAC or your Aruba SE.

| Aruba Alumni | @timcappalli | timcappalli.me |

Highlighted
Frequent Contributor II

Re: Can ClearPass send a disconnect request when the guest user expired?

Hi,

 

"update your enforcement policy with Radius CoA disconnect when the the account expires."

 

how would you do that?

ACMX, ACDX, ACCP, MASE
Highlighted

Re: Can ClearPass send a disconnect request when the guest user expired?

Use the Guest template (Configuration >> Start Here) to create a guest service.

This will generate the necessary enforcements and you are in need of the enforcement named "xxxxx Guest Do Expire", this enforcement will take care of sending radius disconnect message to the NAS when it is applied during guest user authentication.

 

Note: The above enforcement takes guest expiration action based on the do_expire value associated to the guest account.

You need to navigate to ClearPass Guest >> Configuration >> Guest Manager >> Expire Action and set it to either "Delete and logout at specified time" or "Disable and logout at specified time".

 

The above config is global, you can modify this value in individual forms using the filed name "do_expire".


Thanks,
Saravanan

Did something you read in the Community solve a problem for you? If so, click "Accept as Solution" in the post.
NOTE: Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba or Hewlett Packard Enterprise.

Highlighted
Regular Contributor I

Re: Can ClearPass send a disconnect request when the guest user expired?

hello, 

I have a similar issue, I'm providing guest access with self-registration for a large number of users, 

results under "manage account" are different, sometimes the guest user get deleted and CoA sent to the controller once expired, in parallel, you may find another guest user remain with the expired status in Guest DB and no action triggered (delete + CoA)

any idea? 

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: