Security

Hi!

I'm having a problem with the configuration of Onboarding.
Everything looks fine in the beginning the Onboard Pre-Auth and the Onboard Authorization is sucessfull when I'm looking at the Access Tracker.

I can download and start the QC App (tried it with Windows 8.1 and Windows 10) but the Onboarding Application stops with an error (HTTP Status Code 500)

The Support/Aplication logs says:
Fatal Application Error: Call to undefined method NwaMdpsUserDevice::GetUsername():

Client:    172.23.24.79:39376
Script:    /guest/mdps_qc_enroll.php
Function:  NwaPhpFatalErrorHandler
Arguments: array (
)
Details:   array (
  'type' => 1,
  'message' => 'Call to undefined method NwaMdpsUserDevice::GetUsername()',
  'file' => '/opt/amigopod/www/_include/NwaCore/NwaMdpsUserDevice.class.php',
  'line' => 275,
)

The Quick Connect Client Log:

Client Log
==========
2016-05-02 15:52:55,130 [main] DEBUG Quick1X.QuickConnectDlg - Starting configuration.
2016-05-02 15:52:55,131 [main] DEBUG changelog - Starting configuration for secure network connections.
2016-05-02 15:52:55,131 [main] DEBUG Quick1X.Util - Attempting operating system detection.
2016-05-02 15:52:55,131 [main] DEBUG Quick1X.Util - running Windows Enterprise Version
2016-05-02 15:52:55,131 [main] DEBUG Quick1X.Util - Detected operating system higher than Windows XP
2016-05-02 15:52:55,131 [main] DEBUG Quick1X.WlanApi - Initializing wlan api.
2016-05-02 15:52:55,131 [main] DEBUG Quick1X.Config - Initing configuration.
2016-05-02 15:52:55,131 [main] DEBUG Quick1X.Config - QuickConnect Mode isonboard
2016-05-02 15:52:55,814 [main] DEBUG Quick1X.QuickConnectDlg - Calling javascript method : updateWorkingDirectory
2016-05-02 15:52:59,389 [main] DEBUG Quick1X.QuickConnectDlg - Calling javascript method : updateQcMode
2016-05-02 15:52:59,415 [main] DEBUG Quick1X.QuickConnectDlg - Processing configure
2016-05-02 15:52:59,415 [null] DEBUG Quick1X.QuickConnectDlg - Processsing configure task
2016-05-02 15:52:59,415 [null] DEBUG Quick1X.QuickConnectDlg - Fetching the configuration and certificate from the Onboard Server
2016-05-02 15:52:59,415 [null] DEBUG Quick1X.QuickConnectDlg - Initing device info
2016-05-02 15:52:59,416 [null] DEBUG Quick1X.DeviceInfo - Starting interface detection
2016-05-02 15:52:59,416 [null] DEBUG Quick1X.Util - Running config task as logged in user
2016-05-02 15:52:59,727 [null] DEBUG Quick1X.Util - Exit code from execed process 0
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Intel(R) 82579LM Gigabit Network Connection
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :6
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Interface state    :1
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Trying to filter :Intel(R) 82579LM Gigabit Network Connection
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Trying to filter (Unicode) :Intel(R) 82579LM Gigabit Network Connection
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Adapter GUID:79AD5D81-5D79-46D0-BB98-C7924EE41A95
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Description: Intel(R) 82579LM Gigabit Network Connection
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - Name: LAN-Verbindung
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - State: CONNECTED
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - DHCP : Enabled
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - DNS Registration: Enabled
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - DNS by DHCP: Enabled
2016-05-02 15:52:59,738 [null] DEBUG Quick1X.DeviceInfo - MAC Address: D4:BE:D9:3A:03:64
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Interface type : Wired
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Fortinet virtual adapter
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :6
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Interface state    :2
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Trying to filter :Fortinet virtual adapter
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Trying to filter (Unicode) :Fortinet virtual adapter
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Adapter GUID:D761A6A4-73F6-44FA-AC26-61FEDFC7C1E9
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Description: Fortinet virtual adapter
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - Name: LAN-Verbindung 2
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - State: DISCONNECTED
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - DHCP : Enabled
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - DNS Registration: Enabled
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - DNS by DHCP: Enabled
2016-05-02 15:52:59,742 [null] DEBUG Quick1X.DeviceInfo - MAC Address: 00:09:0F:FE:00:01
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface type : Wired
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Bluetooth-Gerät (PAN)
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :6
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface state    :2
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Trying to filter :Bluetooth-Gerät (PAN)
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Discarding interface : Bluetooth-Gerät (PAN)
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Software Loopback Interface 1
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :24
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface state    :1
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Intel(R) Centrino(R) Ultimate-N 6300 AGN
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :71
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface state    :1
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Trying to filter :Intel(R) Centrino(R) Ultimate-N 6300 AGN
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Trying to filter (Unicode) :Intel(R) Centrino(R) Ultimate-N 6300 AGN
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Adapter GUID:64860ACC-91DE-4669-86E7-6D9DFE17EC09
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Description: Intel(R) Centrino(R) Ultimate-N 6300 AGN
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Name: WiFi intern
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - State: CONNECTED
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - DHCP : Enabled
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - DNS Registration: Enabled
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - DNS by DHCP: Enabled
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - MAC Address: 24:77:03:A2:B3:B0
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface type : Wireless
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Von Microsoft gehosteter, virtueller Netzwerkadapter
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :71
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Interface state    :2
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Trying to filter :Von Microsoft gehosteter, virtueller Netzwerkadapter
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Discarding interface : Von Microsoft gehosteter, virtueller Netzwerkadapter
2016-05-02 15:52:59,743 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Virtueller Microsoft-Adapter für direktes WiFi
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :71
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Interface state    :2
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Trying to filter :Virtueller Microsoft-Adapter für direktes WiFi
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Discarding interface : Virtueller Microsoft-Adapter für direktes WiFi
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Checking interface :Dell Wireless 5560 HSPA+ Mobile Broadband Mini-Card Network Adapter
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Interface Type     :243
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.DeviceInfo - Interface state    :2
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.QuickConnectDlg - Downloading device credentials from the Onboard server - http://10.1.1.9/guest/mdps_qc_enroll.php
2016-05-02 15:52:59,744 [null] DEBUG Quick1X.QuickConnectDlg - Checking whether bypass proxy is false or true
2016-05-02 15:52:59,745 [null] DEBUG Quick1X.QuickConnectDlg - Bypass proxy is false
2016-05-02 15:52:59,745 [null] DEBUG Quick1X.QuickConnectDlg - Onboard server Host Name 10.1.1.9
2016-05-02 15:52:59,745 [null] DEBUG Quick1X.QuickConnectDlg - Onboard server URL Path /guest/mdps_qc_enroll.php
2016-05-02 15:52:59,745 [null] DEBUG Quick1X.QuickConnectDlg - Detected Windows version - Windows 8.1
2016-05-02 15:53:00,194 [null] ERROR Quick1X.QuickConnectDlg - Received error HTTP Status code - 500
2016-05-02 15:53:00,194 [null] DEBUG Quick1X.Util - Running config task as logged in user

ClearPass Policy Manager Version: 6.6.0.81015

Any Ideas?

With kind regards

Manfred

Please work with your partner or Aruba TAC to get this investigated. I have seen similar error in early ClearPass 6.6 beta versions after the upgrade, and recreated the Onboarding profiles (Network, Provisioning etc), with apparently the same settings, and then it worked for me. Unfortunately, that made it impossible to report and fix.

So you can try recreating your Onboarding settings, and it will probably fix your issue.

Hi!

Many thanks for your comment regarding this case.

We started with the Onboarding config after the CPPM Upgrade (6.5 to 6.6) from scratch.

For now I had to find a workaround and do it without Onboarding and Quick Connect.

I will investigate  this in my own lab first and come back to the customer installation after that.

I will start a support ticket if the condition still exists.

Just have to find a timeslot to do it...

With regards

Manfred

I have the same issue on my newly updated 6.6. It looks like a DB issue. Could you solve it?

Regards

Manuel

Hi Manuel,

I could not fix the issue until today - my workaround is "not using Onboarding"...

I'm not really happy with this fact. In the moment my customer even prefers the workaround solution without Onboarding because there are not so many clients. (but he pays the License for using it...)

This workaround sounds bad - but I recently was too busy so that I could not create a support case which would be necessary I think.

I definitly will post a solution if I find one.

Regards

Manfred

Can you please check that you didn't hit the following documented issue in the release-notes:

Symptom: Onboard enrollment fails if a device limit is set.
Scenario: Attempting to enroll a device when a device limit is configured in Provisioning Settings fails
with the error “Fatal Application Error: Call to undefined method....”
Workaround: If you use this functionality, postpone upgrading to 6.6.0 until the next patch is available.

Another workaround would be to remove the device limit for now.. till 6.6.1 is available.

If it seems to be another issue and anyone opened a TAC case for that, please let me know the case number in a direct-message.

Just upgraded to clearpass 6.6, I can confirm that this is a issue and that the workaround is to remove the onboard device limit