Security

Many years ago, I setup a customer so that users could register with Clearpass, receive 10 mins of grace time, then self sponsor themselves, giving them full 24 hour access. There was an excellent guide on airheads for this and I'm sure it used the modify_expire field on the registration form to set the 10 min initial access then use the 'extend expiration' setting to give them the 24h access.

I've got a customer who has asked for this and for the life of me I can't see how to do this. The modify_expire field won't accept minutes as the variable, only hours. I wondereed if I could fix it by adding something to the Guest Management expiration options but that didn't work.

Any ideas how this is done these days? Is it possible to find all the old documents that used to be linked to on Airheads? It was written by one of the UK SEs so it must still exist somewhere?

Cheers

What exactly are you trying to achieve with this 10-minute grace period?

Do you just want the user to be able to connect to ClearPass?
The ClearPass server can be accessed from the Logon or Pre-authenticated Role, you don't need grace time for that.

Or should they have full network access during the first 10 minutes?
You can configure this in ClearPass, but during this grace period, there is no HTTP redirect to the ClearPass Captive Portal because the device would already have full access to the network.

Tell us a little more about your use case, and we'll be able to help you better.

Many years ago, I setup a customer so that users could register with Clearpass, receive 10 mins of grace time, then self sponsor themselves, giving them full 24 hour access. There was an excellent guide on airheads for this and I'm sure it used the modify_expire field on the registration form to set the 10 min initial access then use the 'extend expiration' setting to give them the 24h access.

I've got a customer who has asked for this and for the life of me I can't see how to do this. The modify_expire field won't accept minutes as the variable, only hours. I wondereed if I could fix it by adding something to the Guest Management expiration options but that didn't work.

Any ideas how this is done these days? Is it possible to find all the old documents that used to be linked to on Airheads? It was written by one of the UK SEs so it must still exist somewhere?

Cheers

The idea is someone connects to guest, creates an account using their email address, then gets 10 mins of network access to open the email and sponsor themselves through Clearpass. That then extends their account for 24 hours. Essentially, it's a way to validate an email adress.

I know you can do it, because I've done it for multiple customers in the past. I just can't remember what I did and the guide that was created by Michael Clarke no longer exists

Original Message:
Sent: Apr 15, 2026 06:31 AM
From: Lord
Subject: Clearpass Self Reg with 10 min grace period

What exactly are you trying to achieve with this 10-minute grace period?

Do you just want the user to be able to connect to ClearPass?
The ClearPass server can be accessed from the Logon or Pre-authenticated Role, you don't need grace time for that.

Or should they have full network access during the first 10 minutes?
You can configure this in ClearPass, but during this grace period, there is no HTTP redirect to the ClearPass Captive Portal because the device would already have full access to the network.

Tell us a little more about your use case, and we'll be able to help you better.

------------------------------
Regards,

Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution

Original Message:
Sent: Apr 14, 2026 08:36 AM
From: dave_m
Subject: Clearpass Self Reg with 10 min grace period

Many years ago, I setup a customer so that users could register with Clearpass, receive 10 mins of grace time, then self sponsor themselves, giving them full 24 hour access. There was an excellent guide on airheads for this and I'm sure it used the modify_expire field on the registration form to set the 10 min initial access then use the 'extend expiration' setting to give them the 24h access.

I've got a customer who has asked for this and for the life of me I can't see how to do this. The modify_expire field won't accept minutes as the variable, only hours. I wondereed if I could fix it by adding something to the Guest Management expiration options but that didn't work.

Any ideas how this is done these days? Is it possible to find all the old documents that used to be linked to on Airheads? It was written by one of the UK SEs so it must still exist somewhere?

Cheers

-------------------------------------------

Would this guide/article help you to get this set up?

------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.

Original Message:
Sent: Apr 15, 2026 09:28 AM
From: dave_m
Subject: Clearpass Self Reg with 10 min grace period

The idea is someone connects to guest, creates an account using their email address, then gets 10 mins of network access to open the email and sponsor themselves through Clearpass. That then extends their account for 24 hours. Essentially, it's a way to validate an email adress.

I know you can do it, because I've done it for multiple customers in the past. I just can't remember what I did and the guide that was created by Michael Clarke no longer exists

Original Message:
Sent: Apr 15, 2026 06:31 AM
From: Lord
Subject: Clearpass Self Reg with 10 min grace period

What exactly are you trying to achieve with this 10-minute grace period?

Do you just want the user to be able to connect to ClearPass?
The ClearPass server can be accessed from the Logon or Pre-authenticated Role, you don't need grace time for that.

Or should they have full network access during the first 10 minutes?
You can configure this in ClearPass, but during this grace period, there is no HTTP redirect to the ClearPass Captive Portal because the device would already have full access to the network.

Tell us a little more about your use case, and we'll be able to help you better.

------------------------------
Regards,

Waldemar
ACCX # 1377, ACEP, ACX - Network Security
If you find my answer useful, consider giving kudos and/or mark as solution

Original Message:
Sent: Apr 14, 2026 08:36 AM
From: dave_m
Subject: Clearpass Self Reg with 10 min grace period

Many years ago, I setup a customer so that users could register with Clearpass, receive 10 mins of grace time, then self sponsor themselves, giving them full 24 hour access. There was an excellent guide on airheads for this and I'm sure it used the modify_expire field on the registration form to set the 10 min initial access then use the 'extend expiration' setting to give them the 24h access.

I've got a customer who has asked for this and for the life of me I can't see how to do this. The modify_expire field won't accept minutes as the variable, only hours. I wondereed if I could fix it by adding something to the Guest Management expiration options but that didn't work.

Any ideas how this is done these days? Is it possible to find all the old documents that used to be linked to on Airheads? It was written by one of the UK SEs so it must still exist somewhere?

Cheers

-------------------------------------------