Security

 View Only

  • 1.  ClearPass 6.11 Cluster Versioning

    Posted Apr 13, 2023 05:58 AM

    Hi all,

    Quick question about upgrading ClearPass to 6.11.x version:

    I didn't find anything about the ability to keep a Publisher in 6.10.x or 6.9.x with Subscribers in 6.11.x (or opposite).

    The objective is to minimize as much as possible the downtime for the production.

    Thanks !



  • 2.  RE: ClearPass 6.11 Cluster Versioning

    Posted Apr 13, 2023 06:13 AM

    Hi

    It's not possible to have Publisher and Subscribers in the same cluster running different major versions.
    But what I have done is to reinstall on of the servers with 6.11 and this will be the Publisher of the 6.11 cluster.
    After this you reinstall your other servers as subscribers to the the new 6.11 Publisher. When all servers are running 6.11, move the Publisher role to the preferred server.

    The two Publishers will of course do not sync any data between the servers, so minimizing the time between the first and last servers to avoid issues with configuration changes and guest users is important.

    If you have VIP addresses you can install the new 6.11 servers in parallell if running virtual and then just move the VIP addresses to the new servers.
    With physical servers it's a bit more complicated as you need to whipe the old installation. But VIP addresses will be a help in this case as well, you can verify the function of the 6.11 installation from test switches/AP's. Before moving the authentication traffic to the 6.11 server by moving the VIP address(es).
    I prefer to have one VIP for each server just to be able to do this type of actions.

    Depending on the environment it should be possible to do the migration to 6.11 with almost no downtime in the authentication service for the clients.



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP 2023, ACCX #1335, ACX-Network Security, Aruba SME, ACMP, ACDP , ACEP, ACSA
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------

    Original Message


  • 3.  RE: ClearPass 6.11 Cluster Versioning

    Posted Apr 13, 2023 08:11 AM

    Hi Jonas,

    Thanks for the feedback.

    Understood, I will try to work on this preparation steps a little bit more. I'm not really worried about the MAC-Auth or 802.1x cause it's done locally on the dedicated Clearpass of each region. But it's different for the Guest part (even if we can consider it with a lower criticality) for some reasons we have to make the effort to minimize the downtime.


    Original Message


Related Content