Security

 View Only
  • 1.  OnGuard - Health check interval

    Posted Dec 18, 2025 09:30 AM
    ClearPass 6.12.6
    APs 10.7.2.1
     
    Having an issue with the regularity of the OnGuard health check interval and successful returning of roles from ClearPass to Aruba Central over wireless.
     
    The health check appears to occur every 3mins consistently, which in itself works fine. ClearPass returns an Aruba-User-Role to the wireless e.g. OnGuard-Healthy, Quarantine etc. Which also works, I can see the role being correctly returned by ClearPass in the access tracker.  
     
    However, Aruba Central does not appear to pick up the role fast enough, before the agent bounces again (3mins) and leaves the client without a role assigned. If I alter the OnGuard agent settings to OnGuard Health Check Interval (in hours) = 1 then Aruba Central picks up the role correctly. But this interval is too long if a client was in the Quarantined role, for example. You also cannot use the 'Retry' button on the agent to trigger a manual health check either, as this does not generate an entry in the access tracker. The role only seems to update in Central after around 5-6mins, but 3mins is too soon. 
     
    The roles are quite essential to the functionality - as I need to be able to apply ACLs/VLANs/redirects for quarantined devices using roles.
     
    I cannot see anywhere a 3min/ 180sec interval is set in the agent or in cluster wide parameters.
     
    I've seen suggestions of adding an agent-session limit enforcement to the health check service, which I have done, but does not take effect. The agent will still run a health check within 3mins. 
     
    This is not an issue with wired devices as the role appears within the port-access client list on my CX switch almost immediately. 


    -------------------------------------------


  • 2.  RE: OnGuard - Health check interval

    Posted Dec 18, 2025 05:54 PM
    Edited by chulcher Dec 18, 2025 05:58 PM

    The health check interval should probably be set no lower than 4 hours in production.  The agent will constantly check the posture requirements and if a change is seen a notification will be sent to ClearPass and then the posture change Dynamic Authorization can take place.

    The health check interval is telling the agent what the minimum amount of time can be before a full report is sent to ClearPass.  You basically want the health check interval to be within the authentication cache period so that you'll have a current posture status available should a reauthentication be necessary.  I think the last one I setup was 8 hours on the health check interval (based on getting at least two checks per workday) and a cache period of 12 hours.  That plus tagging the endpoint record with the last known posture and a timestamp allows for policy that creates a grace period to handle weekends and holidays.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 3.  RE: OnGuard - Health check interval

    Posted Dec 19, 2025 07:16 AM

    @chulcher thanks for that. 

    Strangely I'm now having the opposite problem. I have configured the global agent settings health check = 1 hour and I'm still getting an agent health check every 3mins. I've also tried to add an agent enforcement of the same to force the 1 hour health check interval. 

    Could you explain how/why that the check is running so frequently despite the global agent settings, please? 

    Agent only checks for Win11 and Trelix AV at present. 

    -------------------------------------------



  • 4.  RE: OnGuard - Health check interval

    Posted Dec 22, 2025 11:17 AM

    I would recommend opening a case with TAC for troubleshooting.



    ------------------------------
    Carson Hulcher, ACEX#110
    ------------------------------



  • 5.  RE: OnGuard - Health check interval

    Posted Jan 28, 2026 08:16 AM

    Have you check whether TCP port 6658 is opened from the agent's IP to the Clearpass IP? Usually when the heartbeat fails you might tend to get a webauth.

    -------------------------------------------