Security

last person joined: 14 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Severe performance issues after Clearpass Onguard deployment

This thread has been viewed 2 times

  • 1.  Severe performance issues after Clearpass Onguard deployment

    Posted Jan 29, 2015 11:27 AM

    Hello all,

     

    I'm new to Aruba and this community, so please excuse me if I sound naive or if I'm posting this at the wrong place :)

     

    We are using Aruba ClearPass NAC for our wired PCs for a few months now. We were running ClearPass OnGuard agent v6.3.1 on the systems for running posture checks. Our system build typically includes Symantec Endpoint Protection v12.1, Symantec DLP agent v11.x, Microsoft SCCM agent, Imprivata SSO Agent, Outlook, other Office applications, Microsoft Lync and few business applications.

     

    We recently updated ClearPass to v6.4.1 and Symantec DLP to v12.5, and we are facing serious performance issues ever since. End user experience is severely impacted, and the applications hang frequently. Since both the agent updates were rolled out around the same time (big mistake), we are not sure which one is actually causing these issues. We have tried to narrow this down by analyzing a sample set of systems, and we are seeing confusing results so far. While we observe these issues across a lot of the systems, there are systems working perfectly fine with previous DLP versions and new OnGuard versions, and vice versa. We are getting mixed observations from the desktop support engineers as well.

     

    In addition to ClearPassOnGuard.exe, I'm also seeing ClearPassAgentController.exe and Arubanetsvc.exe (ClearPass VPN service) running on some systems (in the task manager). Are these services required to be turned on all the time? How much memory do these services typically consume? Currently I see these services consuming an average 2-8 MB, 30-50 MB, 1 MB respectively.

     

    Are there any known issues with any of the above-mentioned software co-existing with ClearPass? Are they known of interfere with each other.

     

    Does anyone here seen any similar issues reported anywhere? How can we narrow down this problem? Looking forward to your thoughts and suggestions...

     

    Sorry about the long post :)

     

    Cheers,
    JR



  • 2.  RE: Severe performance issues after Clearpass Onguard deployment

    EMPLOYEE
    Posted Jan 29, 2015 12:11 PM
    How many items are you checking on the host? The more you check, the more resources it consumes. 


    Thanks, 
    Tim


  • 3.  RE: Severe performance issues after Clearpass Onguard deployment

    Posted Feb 02, 2015 02:50 AM

    Currently we are checking for 5 items viz. 

    • checking if AV is installed with the right version, and if real-time protection is on
    • checking if Anti-spyware is installed
    • checking if personal firewall is installed
    • checking if DLP agent service is running
    • checking if there are more than one network connection enabled at the same time

    Please also note that we were running these checks before we upgraded Onguard and DLP agent versions.

     



  • 4.  RE: Severe performance issues after Clearpass Onguard deployment

    Posted Feb 03, 2015 04:44 AM

    i would say contact Aruba support. they probably have a better idea of what normal memory and cpu usage for these process are and what could cause delays.



  • 5.  RE: Severe performance issues after Clearpass Onguard deployment

    Posted Feb 03, 2015 10:48 AM

    Are you using VIA?  The later versions of CPPM combined the VIA agent and the OnGuard agent. I would not include the VIA component if its not needed.