Security

 View Only

  • 1.  Need some feedback about migrating Clearpass

    Posted 23 days ago

    Hello,

    We are currently planning to migrate the Clearpass VM from VMware to Hyper-v and also we are forced to change the IP of Clearpass, and since we have OnGuard as well, i though about these steps, and i would appreciate your feedback on it:
    1- Create a new VM with a trial license in Hyper-v

    2- Join this VM to the cluster (I am doing this, so the OnGuard agents will receive the new IP address of the VM, am i correct ?)

    3- Promote the new VM with the Trial license to become publisher (Application licenses will be transferred to new VM)

    4- Declare the new VM IP in all the needed switches and access points

    5- Contact the support to migrate the license from old VM to new VM

    6- Shutdown/Delete the old VM

    Will the support approve the license transfer ?

    I am aware that we can convert and export the VM form VMware to Hyper-v, but i am afraid there will be any issues later, also we will need to reinstall OnGuard on all machines again.

    Thanks



  • 2.  RE: Need some feedback about migrating Clearpass
    Best Answer

    Posted 21 days ago

    If this is a single ClearPass appliance, I would spin a new VM, run on the built-in trial (think runs for 90 days without license), backup and restore config (certificates manually), then work with TAC to get the licenses migrated.

    Indeed, don't convert the VM images; new VM is easier and supported.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------



  • 3.  RE: Need some feedback about migrating Clearpass

    Posted 21 days ago

    Hello Herman,

    Thanks for the answer.

    one question please about the OnGuard, since we are tyring to avoid to reinstall all OnGuard agents on all machines because the IP address will also be changed.
    as far as i know, OnGuad clients will always contact the real IP of the Publisher, it will only contact Subscriber if the Publisher is down ? 
    So, if i join the new VM to the cluster and then promoted it to Publisher and shutdown the old VM, all OnGuard agents will automatically connect to the New VM, correct ?


    Original Message


  • 4.  RE: Need some feedback about migrating Clearpass

    Posted 20 days ago

    Please check the Onguard Cluster TechNote. Where Onguard will connect can be configured, and further customized with zones, such that a client will post the Onguard results to a ClearPass node that is local, or close by.

    You probably want OnGuard to connect to a fqdn, instead of the IP; then you can change DNS in order to let them connect again.

    With backup-restore you could consider an in-place replacement, leaving the IP address unchanged.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


Related Content