Security

Hello

After upgrade to Clearpass 6.8 (patch 1) problems have started occuring. Im getting a lot of profiling conflicts that are accumulating and the mangement IP is reported to be unstable.

TAC said there where error in the profiling logs, but concluded that the management IP probably was a duplicate IP or spoof. Solution to the profilng conflicts would be to deny the units. I dont see this as a solution since a lot of unit are being classified wrong.

I have not seen this problems before, does anyone have any solution or has seen this before ?

Im only relaying the DHCP reguests straight to CPPM.

Hi Jon and Forum,

i do face the same or similar issue since upgrading to 6.8.1.

I do see "Profiler unstable" messages every now and then in the event log and also do receive several endpoints profiled wrong if they are behind a VOIP Phone. Windows Clients for instance do get profiled as VOIP Phone, too.

Any ideas?

Im continuing or escalating the TAC case, this is probably a bug that happens in the patch 1 upgrade. 

Update on this thread:

Aruba TAC has filed a defect or bug with 6.8.1 release. At least on our installation. 

Under tests today, windows PC'es, Apple and Android units where profiled wrong.

I will update this thread again when more information is available.

TAC has collected information and logged a defect with the installation. Dont know exactly what that means. Of course everything is taking a long time and out network is degraded and people are thrown into wrong networks because of profiling errors.

We will need to fire up backup of the 6.8.0 version soon.

Thanks for keeping us updated Jon.

Finally.

After alot of testing with Aruba TAC a high priority defect has been logged. There is and error with profiling in the patch 1 relased for 6.8.0.

One hostname is comming up in the DB with several MAC's and false positive "profile conflicts" are appearing. Also wrong profiling is happening. 

A fix should be on the way shortly TAC says. 

A litte suprised over the severity of this and that its not been picked up before release.

A Hotfix has been released promising to adress the issues.

Currently i am installing/testing.

I have installed the patch, and I havent gotten the "unstable profiler IP" yes, but units are still been flagged with "profile conflicts".

Seems like the "hotfix" resolves alot of issues with profiling. We have an endpoint base with 25000+ devices and there is alot of cleanup to do regarding devices that have been detected as conflicted during the bug period.

Will learn from this and wait before I upgrade next time (-:

So this issue is fixed? Is updating to 6.8.1 safe now?

Where can I find the hotfix mentioned in this thread? Latest update I can find is still 6.8.1.109777 from 2019/06/19.

Edit: Found the hotfix in the ASP.