Security

 View Only
Back to discussions
Expand all | Collapse all

Clearpass Data Disk in Azure

This thread has been viewed 45 times

  • 1.  Clearpass Data Disk in Azure

    Posted Apr 14, 2025 11:25 AM

    Hello everyone,

    I have 2 questions for one of my clients who wishes to install a Clearpass server hosted on Azure.

    Here is the installation procedure: Creating the Azure Custom Storage Account and Virtual Appliance

    1. What is the purpose of the Data Disk?

    In the documentation, it asks us to create a Data Disk as follows:

    Create and Attach a New Disk: This setting is optional, as you do not need to create and attach a new disk at this time. You may choose to attach a disk when you are ready to move your VA from a test environment into production.

    This disk reminded me of the additional disk we usually add in VMware environments.

    However, this 1TB disk costs €200/month, and since the wording is a bit suggestive (optional and may), the client is challenging me on the necessity of this disk. The client also mentioned that in the documentation, we created a "Custom Storage Account," which is already a storage space...

    1. Do you have any feedback on the server model to use?

    We need to choose a server model, and here's what is stated in the documentation:

    Click this drop-down menu and select one of the following recommended sizes. Each of the recommended disk sizes corresponds with a ClearPass hardware appliance model.

    • The Standard_D2s_v3 - 2 vcpus, 8 GiB memory option corresponds to a ClearPass C1000 appliance.
    • The Standard_D4s_v3 - 4 vcpus, 16 GiB memory option corresponds to a ClearPass C2000 or C2010 appliance.
    • The Standard_D16s_v3 - 16 vcpus, 64 GiB memory option corresponds to a ClearPass C3000 or 3010 appliance.

    These servers are older generations (from an Azure perspective). Have you ever installed Clearpass with more recent versions, and does that work well?

    Thank you.



  • 2.  RE: Clearpass Data Disk in Azure

    Posted Apr 15, 2025 04:05 AM

    1 - The initial disk in the appliance is only 40GB. Just enough to get the basic appliance built with the initial settings. The second disk is added and then the command 'vmorph' is used to basically rebuild the server with the larger (and faster) disk to be the actual storage used for the appliance. The documentation talks about it "when it's ready for production" but I found this not very helpful as the first thing I wanted to do was upgrade the version and there was problems doing this before I added the extra disk.

    2 - I used the closest comparible server Standard D4s v3 which was available in our main regions. 




  • 3.  RE: Clearpass Data Disk in Azure
    Best Answer

    Posted Apr 15, 2025 06:31 AM

    I also run into the issue that the update of the system wasn't possible as we run out of disk trying to deploy the update. This was without any clear error messages that the disk was full.

    Also found out the hard way if you add the new big disk before running the initial setup, as you do with on prem VM's, the morph-vm command sometimes do not see the disk at all and sometimes see the disk but after running the morph-vm command you don't have a new larger disk. But the server says it's morphed to the new VM size. After this you can't run the command again to the same size, i.e. C2000V.

    The solution to this is to run the initial configuration, power off the server, add the disk, boot and run morph-vm. TAC also informed that there are some bugs that cause the mentioned issues. They are solved in later versions of 6.11 and 6.12 as I understood, but as you are not able to update from the initial image due to disk space that doesn't help much.



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------

    Original Message


  • 4.  RE: Clearpass Data Disk in Azure

    Posted Apr 15, 2025 11:10 AM

    Many thanks for your replies.

    I'll try to convince my customer with those informations




  • 5.  RE: Clearpass Data Disk in Azure

    Posted Apr 16, 2025 03:05 AM

    The additional disk is a must. Without that it is only a lab ClearPass and you cannot install patches due to space issues.

    It is important to attach the additional disk when the VM is powered off otherwise morph-vm will not see the disk. I recommend to make a backup/snapshot of the VM before the morph-vm command because if there is an error during morph-vm there is no way to roll back just to reinstall the server.




  • 6.  RE: Clearpass Data Disk in Azure

    Posted Apr 16, 2025 05:48 AM

    Thanks Itsvan.

    Another question. By default the data disk is a premium disk while the OS Disk is a standard if I remember well.

    Do you know if we must use a premium disk ?


    Original Message


  • 7.  RE: Clearpass Data Disk in Azure

    Posted Apr 16, 2025 08:13 AM

    You should follow the system requirements to remain supported. For performance, it's important to have fast disks that can handle many I/O operations per second (iops).

    If you configure lower class disks, you may run into performance issues, and TAC may refuse support if the issues you see can be related to underrated system specifications.

    It may work with normal disk, depending on your system load, but I would not take the risk. I've seen too many issues where customers decided that ClearPass could run with less disk/memory/CPU, and at some point the system became unstable.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 8.  RE: Clearpass Data Disk in Azure

    Posted Apr 17, 2025 04:10 AM

    We use the c3000 equivalent vm so premium SSD. I think from performance point of view the Azure VM is below the physical C3010 appliance, at least when I check the default parameters in server configuration I can see it can handle less sessions. The problem is that you cannot change disk later without reinstalling ClearPass.


    Original Message


  • 9.  RE: Clearpass Data Disk in Azure

    Posted Mar 03, 2026 04:50 AM

    Hi All,

    I need clarification regarding the Azure initial deployment guide.

    Is the guide assuming a completely blank Azure environment (specifically no existing Resource Groups or Storage Accounts)?

    The customer is questioning the purpose of the Storage Account. In the deployment page, the dropdown only asks which Resource Group to deploy into - there is no option to select a Storage Account.

    Also, a Storage Account can only be created after a Resource Group exists. Since the deployment UI does not reference or require selecting a Storage Account, the customer is asking why it was created in the first place.

    They are currently considering cleaning up what they believe to be unused components: the Storage Account.

    Please confirm whether the Storage Account is mandatory for this deployment and its specific purpose.

    Appreciate your urgent clarification.

    -------------------------------------------



  • 10.  RE: Clearpass Data Disk in Azure

    Posted Mar 03, 2026 10:30 AM

    I'm not an Azure expert, but the documentation states: 

    Before you create your ClearPass virtual appliance (VA) , you must create a custom storage account within the Azure portal. The ClearPass VA will not function correctly using a default storage account.

    I'd follow the guidance from that documentation, and if you get stuck or have doubts, it's best to work with TAC. I've seen quite some cases where engineers assumed that they were smarter than the documentation and could ignore the guidance, like smaller disks, thin provisioning, reducing CPU/memory, shared resources (no dedicated allocation) and get a working deployment for a while and then find out after some times things get unstable or see poor performance. For a production environment, I'd strongly recommend to follow the requirements en recommendations.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


  • 11.  RE: Clearpass Data Disk in Azure

    Posted Mar 04, 2026 04:32 AM

    Hi Herman,

    I raised TAC case for this. 5401413497. I was being "Know-it-all" in front of the customer by saying "maybe this guide is meant for the user that does not have Azure setup before" simply because we witnessed together that we could not map upstream the Storage Account to the VM (the option available is only to map upstream the Resource Group). Azure's Breadcrumb (navigation pane on top of their screen) is also bad, cannot rely on that, I cannot confirm if the VM is built under that Storage Account or elsewhere.

    -------------------------------------------

    Original Message


  • 12.  RE: Clearpass Data Disk in Azure

    Posted Mar 06, 2026 07:57 AM

    As mentioned, I'm not the expert on Azure hosted VMs and Storage Accounts, so hopefully you get somewhere with the TAC case. If so, please share the outcome so it can help others in the same situation.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


Related Content