Security

Good Morning,

We use a transparent web proxy, which relys on Clearpass sending its radius accounting packets through upon a wired or wireless device authenticating using 802.1x.

The accounting packet needs to contain the framed-ip-address.

My understanding is that the switch sends the IP address to clearpass using a DHCP helper on the aruba switch which is configured on each vlan.

This is working.

Occassionally, we get a radius authentication event in Clearpass, where the framed-ip-address is blank.  It only happens on wired 802.1x devices, which are connected to the aruba 2930F switch which has aaa port authentication configured.   I realise that this is probably a timing this, and that the device doesn't yet have an IP address at the point that the port is authenticated.

My question is, why does the interim accounting packet not send through to clearpass when the device eventually gets its IP address?

my switches 'radius accounting' is configured with:

You also need to configure  "client track ip" commands at global and VLAN level, (in reference to CX switches)

for AOS-S, i think the corresponding command is "ip client-tracker "

Good Morning,

We use a transparent web proxy, which relys on Clearpass sending its radius accounting packets through upon a wired or wireless device authenticating using 802.1x.

The accounting packet needs to contain the framed-ip-address.

My understanding is that the switch sends the IP address to clearpass using a DHCP helper on the aruba switch which is configured on each vlan.

This is working.

Occassionally, we get a radius authentication event in Clearpass, where the framed-ip-address is blank.  It only happens on wired 802.1x devices, which are connected to the aruba 2930F switch which has aaa port authentication configured.   I realise that this is probably a timing this, and that the device doesn't yet have an IP address at the point that the port is authenticated.

My question is, why does the interim accounting packet not send through to clearpass when the device eventually gets its IP address?

my switches 'radius accounting' is configured with:

Good Morning,

We use a transparent web proxy, which relys on Clearpass sending its radius accounting packets through upon a wired or wireless device authenticating using 802.1x.

The accounting packet needs to contain the framed-ip-address.

My understanding is that the switch sends the IP address to clearpass using a DHCP helper on the aruba switch which is configured on each vlan.

This is working.

Occassionally, we get a radius authentication event in Clearpass, where the framed-ip-address is blank.  It only happens on wired 802.1x devices, which are connected to the aruba 2930F switch which has aaa port authentication configured.   I realise that this is probably a timing this, and that the device doesn't yet have an IP address at the point that the port is authenticated.

My question is, why does the interim accounting packet not send through to clearpass when the device eventually gets its IP address?

my switches 'radius accounting' is configured with:

Good Morning,

We use a transparent web proxy, which relys on Clearpass sending its radius accounting packets through upon a wired or wireless device authenticating using 802.1x.

The accounting packet needs to contain the framed-ip-address.

My understanding is that the switch sends the IP address to clearpass using a DHCP helper on the aruba switch which is configured on each vlan.

This is working.

Occassionally, we get a radius authentication event in Clearpass, where the framed-ip-address is blank.  It only happens on wired 802.1x devices, which are connected to the aruba 2930F switch which has aaa port authentication configured.   I realise that this is probably a timing this, and that the device doesn't yet have an IP address at the point that the port is authenticated.

My question is, why does the interim accounting packet not send through to clearpass when the device eventually gets its IP address?

my switches 'radius accounting' is configured with: