If you have really old ClearPass licenses, bought under the old license model (before 6.7) you need to do the following:
NOTE! The SKU's listed as migration licenses below are all listed with the End of Sale date July 31, 2025!
- Buy a new virtual appliance license (JZ399AAE)
- Buy a ClearPass migration license for the correct original server (NO Access licenses are included!) Just conversion to new SKU.
- CP-VA-500 to VM: Aruba ClearPass VA 500 Transfer LTU R9R49AAE
- CP-VA-5K to VM: Aruba ClearPass VA 5K Transfer LTUR 9R50AAE
- CP-VA-25K to VM: Aruba ClearPass VA 25K Transfer LTU R9R51AAE
- CP-HW-500 to VM: Aruba ClearPass VA 500 Transfer LTU S0V37AAE
- CP-VA-5K to VM: Aruba ClearPass VA 5K Transfer LTU S0V38AAE
- CP-VA-25K to VM: Aruba ClearPass VA 25K Transfer LTUR S0V39AAE
- CP-HW-500 to new HW: Aruba ClearPass VA 500 Transfer LTU S0V40AAE
- CP-VA-5K to new HW: Aruba ClearPass VA 5K Transfer LTU S0V41AAE
- CP-VA-25K to new HW: Aruba ClearPass VA 25K Transfer LTUR S0V42AAE
- Support for the above license SKU's
- In the Networking Support Portal perform the Replace LSN procedure on the license page for ClearPass NL
The last step is a key to map the new license serial numbers provided with the new SKU to the actual license keys you already have.
Navigate to the ClearPass NL license page and click the Replace LSN button above the licenses to the right.
Fill in the requested information
Jeff, as you are not running hardware servers the following information doesn't apply for you. It's just additional information if someone else reads the thread and have an issue with a PAK for a hardware server.
It's possible to get the correct PAK from the licensing pages on the Networking Support Portal.
Click the drop down menu and select ClearPass NL PAK
In the following form, submit your hardware serial number.
Hopefully you will get the correct PAK.
Otherwise TAC has solved this several times for me. I have requested the correct PAK for a specific hardware serial number and got the license key from them.
------------------------------
Best Regards
Jonas Hammarbäck
MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
------------------------------
Original Message:
Sent: Mar 26, 2025 08:26 AM
From: johnstonj@rowan.edu
Subject: Clearpass 6.11 backup size
First - thanks all for the responses!!! I love how quickly answers to questions can be found on here and when I can't find the answer in previous posts, the users on here jump right in. This forum is more useful than just about any other one I've been a part of.
Carson - yup. At the time my mind was on on the fact that licenses could only be on a single server at a time. I completely overlooked the 90 day grace period and should have done it that way. Then I would have found this issue before I went live with 6.11. Next time (if there is one - I'm old enough that I may be retired before I need to move to new VMs again LOL).
Jonas - you hit the nail on the head with this "When PAK licenses was converted legacy format to 6.8+ format, some hardware licenses was converted to VM PAK. If this is the case the correct PAK must be requested". That's exactly what is biting me in the back side. We have valid licenses but when they were converted for 6.9 years ago they were the VM PAK. That worked fine on our old system, but doesn't work on 6.11. Unfortunately, the TAC licensing team can't just convert them. There is a nominal fee to convert the licenses and they are all new licenses so TAC can't just bypass it either. This was missed by everyone (me, our supplier, HPe sales rep, TAC).
Even tho we still have the old 6.9 VMs in place (shutdown and with different IPs on them, but I could fire them up and make the changes very quickly), we have decided to stay on 6.11.1 until the new support contract is ready. It should only be a couple of days - everyone knows the importance of this and are pushing it thru. Assuming it hasn't changed (and nothing in the release notes indicates it has, I won't need to restore from backup after, that is only for disaster recovery. As it stands, the only bug that is hurting us is CP52562,CP53011 - "Corrected an issue where the ClearPass REST API did not correctly process OAuth2 tokens. Post-Authentication is now enhanced to accept access tokens that include special characters." and that is resolved in 6.9. I believe that is what is keeping our JAMF extension from working (Jamf uses Oauth2 to get the token) and I have a temp workaround in place.
Thanks again all!!!
------------------------------
Jeff Johnston
------------------------------
Original Message:
Sent: Mar 26, 2025 05:51 AM
From: jonas.hammarback
Subject: Clearpass 6.11 backup size
As mentioned in other answers you can have your normal PAK licenses installed in the new 6.11 servers. I would update the 6.11 servers the first thing before trying to restore the backup from the old 6.9 environment.
The really poooor download performance of large files is also another bug solved in later 6.11 versions. It has been present as long as I can remember, but it was solved about a year ago.
The support agreement check in 6.11 has caused me a lot of gray hairs! For the update to work as intended the following must be true:
- For physical server PAK license for the serial number it's installed on.
When PAK licenses was converted legacy format to 6.8+ format, some hardware licenses was converted to VM PAK. If this is the case the correct PAK must be requested - Active support agreement for all PAK licenses in the cluster
- The support agreement(s) must be added to the Contracts section of Networking Support Portal
- The account requesting an update token in ClearPass GUI must belong to the same Networking support portal customer account
- Under some conditions, there are or have been, a nightly replication job in the backend of the Networking support portal that update the bindings between serial numbers and contract. This may delay the ability to download support updates even if the contract has been added. Waiting to next day may solve this.
There are also some other sources of issues if the download fails that I have seen in contact with my customers, mostly related to hardware servers:
- By mistake install a PAK for another hardware serial number. It's really easy to do as the older ASP site didn't displayed the serial number for hardware PAK's
- The original server was replaced in an RMA, the new hardware serial number has not been added to the support contract for the customer in the backend systems
------------------------------
Best Regards
Jonas Hammarbäck
MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
Original Message:
Sent: Mar 25, 2025 12:21 PM
From: johnstonj@rowan.edu
Subject: Clearpass 6.11 backup size
Thanks - that's the plan but there are issues holding up the update (the backup size was one of them LOL). We were upgrading from 6.9.x to 6.11. The first step was to go to 6.11.1 and restore the 6.9 backup (which we did). Then we found out there was an issue with our license support so we couldn't download the patch or perform a cluster update (we paid for support but in the newer support model, the 25k licenses are de-coupled from the VM and are now a separate sku. So that broke our ability to download and update. We have people from all sides trying to clear this up. We had an emergency where a bug in the code caused some of our systems to fail (the bug was fixed in 6.11.9) so we wanted to perform an emergency manual update with TAC. But the size of the backup that is needed made this prohibitive (it would have taken 5 hours to download the backup and 5 more to upload when complete and I was not comfortable with the possibility of a 10+ hour down time for a dot release update. TAC could not get anything working so I am back to waiting on the support issue to get corrected. (I have a manual workaround but it is not sustainable)
Hopefully this gets resolved in a day or 2.
------------------------------
Jeff Johnston
Original Message:
Sent: Mar 25, 2025 11:41 AM
From: jonas.hammarback
Subject: Clearpass 6.11 backup size
Hi Jeff
Please update to the latest patch 6.11.11 to solve the issue with the large backups. Somewhere around 6.11.3 to 6.11.5 if I recall correct, a bug was fixed that caused the really large backups in early 6.11 versions.
Check the release notes for the exact version.
------------------------------
Best Regards
Jonas Hammarbäck
MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
Aranya AB
If you find my answer useful, consider giving kudos and/or mark as solution
Original Message:
Sent: Mar 25, 2025 11:34 AM
From: johnstonj@rowan.edu
Subject: Clearpass 6.11 backup size
Thanks Carson
I need to back up the subscribers for 2 reasons - we have extensions running on them that are not running on the publisher so in the even of a catastrophe I would need to restore those, and we have some session data going specifically to certain machines and I haven't had the best of luck restoring just the publisher and getting all of the session data.
But I guess my bigger question is what changed in clearpass. I took a backup of my 6.9.12 publisher and it was ~3Gb. Restored that backup to the 6.11.1 publisher and immediately took a backup and it was over 9Gb. It is a 3x-4x growth in size. And since the only way to manually offload the backup is via the GUI, it's SLOW. Downloading other files or the same size from different machines on the same subnet doesn't take long at all. Downloading this takes 4.5+ hours.
------------------------------
Jeff Johnston
Original Message:
Sent: Mar 25, 2025 11:18 AM
From: chulcher
Subject: Clearpass 6.11 backup size
Backups of the subscribers is fairly useless, usually easier to just reconfigure and join to the cluster.
Also, 9 GB for a backup on an appliance that has 900 GB of space on the active partition isn't bad at all. If the size is a concern, then you might open a case with TAC to determine where the change is occurring and make sure that something that shouldn't be is getting copied.
------------------------------
Carson Hulcher, ACEX#110