Security

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

Counts all active sessions that show activity within the last two days.

My version of the query looks at the last updated column and counts all sessions that aren't the current.

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

Thank you for this, after we apply the configuration, it works fine based on our preference. what does this mean in query ? AND updated_at > now() - interval '12 minutes' 

Counts all active sessions that show activity within the last two days.

My version of the query looks at the last updated column and counts all sessions that aren't the current.

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

Counts all active sessions that show activity within the last two days.

My version of the query looks at the last updated column and counts all sessions that aren't the current.

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

Hi do you have a working configuration sample with this? 

Counts all active sessions that show activity within the last two days.

My version of the query looks at the last updated column and counts all sessions that aren't the current.

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

For this to work, you must be running ClearPass version 6.12 or later. ClearPass versions 6.10 and earlier use only the UserDB/TipsDB databases.Starting with ClearPass 6.12, AppExternal is now supported, which allows the use of custom database queries.

Original Message:
Sent: Dec 09, 2024 08:22 AM
From: Alex
Subject: CLEARPASS ACTIVE SESSION LIMIT

Hi do you have a working configuration sample with this? 

Original Message:
Sent: Nov 21, 2024 11:45 AM
From: chulcher
Subject: CLEARPASS ACTIVE SESSION LIMIT

Counts all active sessions that show activity within the last two days.

My version of the query looks at the last updated column and counts all sessions that aren't the current.

------------------------------
Carson Hulcher, ACEX#110


Original Message:
Sent: Nov 21, 2024 11:17 AM
From: ajorigenes17
Subject: CLEARPASS ACTIVE SESSION LIMIT

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

I probably created these queries on ClearPass 6.8 and 6.9, but no guarantees that they'd work on older versions as there were some security changes/cleanup done that made many of the custom queries non-functional for a bit.

------------------------------
Carson Hulcher, ACEX#110
------------------------------


Original Message:
Sent: Jan 06, 2026 02:04 AM
From: ajorigenes17
Subject: CLEARPASS ACTIVE SESSION LIMIT

For this to work, you must be running ClearPass version 6.12 or later. ClearPass versions 6.10 and earlier use only the UserDB/TipsDB databases.Starting with ClearPass 6.12, AppExternal is now supported, which allows the use of custom database queries.

Original Message:
Sent: Dec 09, 2024 08:22 AM
From: Alex
Subject: CLEARPASS ACTIVE SESSION LIMIT

Hi do you have a working configuration sample with this? 

Original Message:
Sent: Nov 21, 2024 11:45 AM
From: chulcher
Subject: CLEARPASS ACTIVE SESSION LIMIT

Counts all active sessions that show activity within the last two days.

My version of the query looks at the last updated column and counts all sessions that aren't the current.

------------------------------
Carson Hulcher, ACEX#110


Original Message:
Sent: Nov 21, 2024 11:17 AM
From: ajorigenes17
Subject: CLEARPASS ACTIVE SESSION LIMIT

And also what is the purpose of this query?

 AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

Original Message:
Sent: Nov 21, 2024 09:50 AM
From: chulcher
Subject: CLEARPASS ACTIVE SESSION LIMIT

You can see this by looking at the query for the filter.

SELECT COUNT(*) AS active_count FROM radius_acct WHERE (username = '%{Authentication:Username}' OR calling_station_id = '%{Connection:Client-Mac-Address-NoDelim}') AND start_time >=  NOW() - INTERVAL '2 day' AND  end_time is NULL;

The query counts all currently active sessions associated with the username or the active MAC address.

To prevent what you are seeing you would want to create a new filter with a query that only counts the current username + MAC address combination once.  Or you could look at enabling 802.11r to prevent the full reauthentication on roam.

------------------------------
Carson Hulcher, ACEX#110