ClearPass Release Notes

Transcription

1 ClearPass Release Notes

2 Copyright Information Copyright 2016 Hewlett Packard Enterprise Development LP. Open Source Code This product includes code licensed under the GNU General Public License, the GNU Lesser General Public License, and/or certain other open source licenses. A complete machine-readable copy of the source code corresponding to such code is available upon request. This offer is valid to anyone in receipt of this information and shall expire three years following the date of the final distribution of this product version by Hewlett Packard Enterprise Company. To obtain such source code, send a check or money order in the amount of US $10.00 to: Hewlett Packard Enterprise Company Attn: General Counsel 3000 Hanover Street Palo Alto, CA USA ClearPass Policy Manager Release Notes June 2016

3 Contents About ClearPass Related Documents 9 Use of Cookies 9 Contacting Support 10 System Requirements for ClearPass End of Support 11 ClearPass 6.5 Milestones 11 Third-Party Vendor End-of-Support 11 Virtual Appliance Requirements 12 Supported Hypervisors 12 ESX/ESXi Requirements 12 CP-VA-500 (500 Virtual Appliance OVF) 12 CP-VA-5K (5K Virtual Appliance OVF) 12 CP-VA-25K (25K Virtual Appliance OVF) 13 CP-SW-EVAL (Evaluation OVF) 13 Hyper-V Requirements 13 CP-VA-500 (500 Virtual Appliance VHDX) 13 CP-VA-5K (5K Virtual Appliance VHDX) 13 CP-VA-25K (25K Virtual Appliance VHDX) 13 CP-SW-EVAL (Evaluation VHDX) 14 Supported Browsers 14 ClearPass OnGuard Unified Agent Requirements 14 Supported Antivirus Versions, OnGuard 14 OnGuard Dissolvable Agent Requirements 15 OnGuard Native Dissolvable Agent Version Information 15 OnGuard Java-Based Dissolvable Agent Version Information 17 ClearPass Onboard Requirements 18 Upgrade and Update Information 19 Upgrading to ClearPass 6.5 from 6.2.6, 6.3.6, or 6.4.x 19 Before You Upgrade 20 Sample Times Required for Upgrade 21 After You Upgrade 21 Restoring the Log DB Through the User Interface 21 ClearPass Release Notes Contents 3

4 Restoring the Log DB Through the CLI 22 Updating Within the Same Major Version 22 Installation Instructions Through the Software Updates Portal 23 Installation Instructions for an Offline Update 23 What s New in This Release 25 Release Overview 25 Important Changes 25 New Features and Enhancements in the Release 25 OnGuard 25 Policy Manager 26 Issues Resolved in the Release 27 CLI 27 Guest 27 Insight 27 Onboard 28 OnGuard 28 Policy Manager 29 New Known Issues in the Release 29 CLI 30 Dissolvable Agent 30 OnGuard 30 Policy Manager 31 Enhancements in Previous 6.5.x Releases 33 CLI 33 Features Added in Dissolvable Agent 33 Features Added in Endpoint Context Servers 34 Features Added in Features Added in Guest 37 Features Added in Features Added in Features Added in Features Added in Features Added in Features Added in Contents ClearPass Release Notes

5 Insight 39 Features Added in Onboard 40 Features Added in Features Added in OnGuard 42 Features Added in Features Added in Features Added in Features Added in Policy Manager 47 Features Added in Features Added in Features Added in Features Added in Features Added in Issues Fixed in Previous 6.5.x Releases 57 Fixed in Endpoint Context Servers 57 Guest 57 Onboard 58 OnGuard 58 Policy Manager 58 Fixed in CLI 61 Endpoint Context Servers 61 Guest 61 Insight 62 Onboard 62 OnGuard 62 Policy Manager 63 Fixed in CLI 64 Guest 64 Onboard 65 OnGuard 65 Policy Manager 65 ClearPass Release Notes Contents 5

6 Fixed in Dissolvable Agent 67 Endpoint Context Servers 67 Guest 67 Insight 68 Onboard 68 OnGuard 68 Policy Manager 69 Fixed in CLI 70 Endpoint Context Servers 70 Guest 71 Insight 71 Onboard 71 OnGuard 72 Policy Manager 72 QuickConnect 74 Fixed in Dissolvable Agent 74 Endpoint Context Servers 74 Guest 74 Insight 75 Onboard 75 OnGuard 75 Policy Manager 75 Fixed in AirGroup 77 CLI 77 Dissolvable Agent 78 Endpoint Context Servers 78 Guest 78 Insight 80 Onboard 81 OnGuard 82 Policy Manager 83 QuickConnect 86 6 Contents ClearPass Release Notes

7 Known Issues Identified in Previous Releases 87 Dissolvable Agent 87 Documentation 89 Guest 90 Insight 90 Onboard 91 OnGuard 91 Policy Manager 96 QuickConnect 100 ClearPass Release Notes Contents 7

8 8 Contents ClearPass Release Notes

9 Chapter 1 About ClearPass ClearPass is a cumulative patch release that introduces new features and provides fixes to previously outstanding issues. These release notes contain the following chapters: "System Requirements for ClearPass 6.5" on page 11 Provides important system requirements information for this release. "Upgrade and Update Information" on page 19 Provides considerations and instructions for version upgrades and patch updates. "What s New in This Release" on page 25 Describes new features and issues introduced in this release as well as issues fixed in this release. "Enhancements in Previous 6.5.x Releases" on page 33 Describes new features introduced in earlier 6.5 releases. "Issues Fixed in Previous 6.5.x Releases" on page 57 Lists issues fixed in earlier 6.5 releases. "Known Issues Identified in Previous Releases" on page 87 Lists currently existing issues identified in previous releases. Related Documents The following documents are part of the complete documentation set for the ClearPass platform: ClearPass Policy Manager 6.5 User Guide ClearPass Guest 6.5 User Guide ClearPass 6.5 Deployment Guide ClearPass Insight 6.5 User Guide ClearPass Policy Manager 6.5 Getting Started Guide ClearPass Policy Manager Configuration API Guide ClearPass Policy Model: An Introduction Tech Note: Installing or Upgrading ClearPass 6.5 on a Virtual Machine Tech Note: Upgrading to ClearPass 6.5 Tech Note: Cluster Upgrade Tool, ClearPass 6.5 Use of Cookies Cookies are small text files that are placed on a user s computer by Web sites the user visits. They are widely used in order to make Web sites work, or work more efficiently, as well as to provide information to the owners of a site. Session cookies are temporary cookies that last only for the duration of one user session. When a user registers or logs in via an Aruba captive portal, Aruba uses session cookies solely to remember between clicks who a guest or operator is. Aruba uses this information in a way that does not identify any userspecific information, and does not make any attempt to find out the identities of those using its ClearPass products. Aruba does not associate any data gathered by the cookie with any personally identifiable information (PII) from any source. Aruba uses session cookies only during the user s active session and does ClearPass Release Notes About ClearPass

10 not store any permanent cookies on a user s computer. Session cookies are deleted when the user closes the Web browser. Contacting Support Main Site Support Site Airheads Social Forums and Knowledge Base North American Telephone International Telephones Software Licensing Site End of Support information Security Incident Response Team (SIRT) arubanetworks.com support.arubanetworks.com community.arubanetworks.com (Toll Free) arubanetworks.com/support-services/contact-support/ licensing.arubanetworks.com arubanetworks.com/support-services/end-of-life-products/end-of-lifepolicy/ arubanetworks.com/support-services/security-bulletins/ 10 About ClearPass ClearPass Release Notes

11 Chapter 2 System Requirements for ClearPass 6.5 This chapter provides important system requirements information specific to this release. It should be read carefully before upgrading to ClearPass 6.5. This chapter provides the following information: "End of Support" on page 11 "Virtual Appliance Requirements" on page 12 "Supported Browsers" on page 14 "ClearPass OnGuard Unified Agent Requirements" on page 14 "ClearPass Onboard Requirements" on page 18 The IP address to access the licensing server clearpass.arubanetworks.com changed from to on September 27th, If you have any firewall protections allowing access, please be sure to update the IP address information accordingly. End of Support This section describes ClearPass and third-party systems, software, and features that are no longer supported or that are approaching their end-of-support date. ClearPass 6.5 Milestones Release Date: February 20, 2015 End of Development: August 20, 2016 End of Support: August 20, 2017 For more details on the Aruba End of Life policy, please refer to Third-Party Vendor End-of-Support Please be aware that the following vendors have officially stopped supporting their respective operating systems on the stated dates. Aruba will attempt to preserve compatibility with these legacy operating systems; however, recent versions of software agents (such as the ClearPass OnGuard Unified Agent) might not be able to provide the same level of functionality that they provide on newer operating systems. We will not provide any further bug fixes or feature enhancements related to supporting these operating systems. Our TAC organization will also not be able to service customer support requests related to clients running these operating systems. Customers should consider these operating systems as unsupported with ClearPass: Microsoft Corporation: Windows Server 2003 July 14, 2015 ClearPass Release Notes System Requirements for ClearPass

12 Windows XP April 8, 2014 Apple, Inc: Mac OS X 10.6 (Snow Leopard) February 26, 2014 Virtual Appliance Requirements Please carefully review all virtual appliance (VA) requirements, including functional IOP ratings, and verify that your system meets these requirements. These recommendations supersede earlier requirements that were published for ClearPass Policy Manager 6.x installations. Virtual appliance recommendations have been adjusted to align with the shipping ClearPass hardware appliance specifications. If you do not have the VA resources to support a full workload, then you should consider ordering the ClearPass Policy Manager hardware appliance. For VMware ESX/ESXi system requirements, see "ESX/ESXi Requirements " on page 12. For Microsoft Hyper-V system requirements, see "Hyper-V Requirements " on page 13. For complete information on installing and configuring either ESX or Hyper-V, see the Tech Note: Installing or Upgrading ClearPass 6.5 on a Virtual Machine. Cloning a virtual machine to facilitate a ClearPass deployment is not recommended or supported. Supported Hypervisors The following hypervisors are supported. Hypervisors that run on a client computer such as VMware Player are not supported. VMware ESX 4.0 (Recommended minimum version of software for CP-VA-500 and CP-VA-5K. It does not support greater than 8 virtual CPUs required for the CP-VA-25K.) VMware ESXi 5.0, 5.1, 5.5, 6.0, or higher Microsoft Hyper-V Server 2012 R2 Hyper-V on Microsoft Windows Server 2012 R2 ESX/ESXi Requirements CP-VA-500 (500 Virtual Appliance OVF) 2 Virtual CPUs 500 GB disk space 4 GB RAM 2 Gigabit virtual switched ports Functional IOP rating for a read/write profile for 4K random read/write = 75 CP-VA-5K (5K Virtual Appliance OVF) 8 Virtual CPUs Disk space: 500 GB disk space required for existing deployments (upgrading from 6.2.6, 6.3.6, or 6.4.x) 1000 GB disk space recommended for new deployments 8 GB RAM 12 System Requirements for ClearPass 6.5 ClearPass Release Notes

13 2 Gigabit virtual switched ports Functional IOP rating for a read/write profile for 4K random read/write = 105 CP-VA-25K (25K Virtual Appliance OVF) 24 Virtual CPUs Disk space: 1000 GB disk space required for existing deployments (upgrading from 6.2.6, 6.3.6, or 6.4.x) 1800 GB disk space recommended for new deployments 64 GB RAM 2 Gigabit virtual switched ports Functional IOP rating for a read/write profile for 4K random read/write = 350 CP-SW-EVAL (Evaluation OVF) 2 Virtual CPUs 80 GB disk space 4 GB RAM 2 Gigabit virtual switched ports An evaluation version can be upgraded to a later evaluation version in a manner similar to a production upgrade. Hyper-V Requirements CP-VA-500 (500 Virtual Appliance VHDX) 2 Virtual CPUs 500 GB disk space required 4 GB RAM 2 Gigabit virtual switched ports Functional IOP rating for a read/write profile for 4K random read/write = 75 CP-VA-5K (5K Virtual Appliance VHDX) 8 Virtual CPUs 1000 GB disk space required 8 GB RAM 2 Gigabit virtual switched ports Functional IOP rating for a read/write profile for 4K random read/write = 105 CP-VA-25K (25K Virtual Appliance VHDX) 24 Virtual CPUs 1800 GB disk space required 64 GB RAM 2 Gigabit virtual switched ports ClearPass Release Notes System Requirements for ClearPass

14 Functional IOP rating for a read/write profile for 4K random read/write = 350 CP-SW-EVAL (Evaluation VHDX) 2 Virtual CPUs 80 GB disk space required 4 GB RAM 2 Gigabit virtual switched ports An evaluation version can be upgraded to a later evaluation version in a manner similar to a production upgrade. Supported Browsers For the best user experience, we recommend you update your browser to the latest version available. Supported browsers for ClearPass are: Mozilla Firefox on Windows Vista, Windows 7, Windows 8.x, Windows 10, and Mac OS X Google Chrome for Mac OS X and Windows Apple Safari 3.x and later on Mac OS X Mobile Safari 5.x on ios Microsoft Internet Explorer 10 and later on Windows 7 and Windows 8.x Microsoft Edge on Windows 10 The Google Chrome browser no longer supports the Windows XP, Windows Vista, or Mac OS X 10.6, 10.7, or 10.8 operating systems. Chrome will still work on these platforms but will not receive updates or security fixes after April ClearPass OnGuard Unified Agent Requirements Be sure that your client system meets the following requirements before installing the ClearPass OnGuard Unified Agent: 1 GB RAM recommended, 512 MB RAM minimum 200 MB Disk Space Mac OS X: Version 10.7 or higher (64-bit only) Ubuntu: LTS and LTS Windows Vista, Windows 7, Windows 8.x Pro, Windows 10, and Windows Server 2008 are all supported with no service pack requirements. OnGuard does not support Windows 8.x RT or Windows 8.x Phone. Installing the Unified Agent will remove an existing VIA installation. To continue using VPN functionality, log in to ClearPass as the administrator, go to Administration > Agents and Software Updates > OnGuard Settings, and select Install and enable Aruba VPN component from the Installer Mode drop-down list. Supported Antivirus Versions, OnGuard For OnGuard to work properly, please whitelist the following executable files and installation folders in your antivirus 14 System Requirements for ClearPass 6.5 ClearPass Release Notes

15 products: ClearPassOnGuard.exe ClearPassAgentController.exe C:\Program Files (x86)\aruba Networks\ClearPassOnGuard\ C:\Program Files\Aruba Networks\ClearPassOnGuard\ In current laboratory tests for ClearPass 6.5.7, we use the following antivirus software for our validations. Due to the large number of products available, this list may change at any time: Avast AVG COMODO Kaspersky: IS-11 and above MacAfee Microsoft Forefront Endpoint Protection-2008 Microsoft Security Essentials Microsoft Windows Firewall Sophos: 9 and above Trend Micro Windows Defender Firewall Some third-party anti-malware products are not supported by ClearPass OnGuard. For a complete list of supported third-party products, in ClearPass go to Administration > Agents and Software Updates > OnGuard Settings, click the Help link, and then click the OnGuard Agent Support Charts link. OnGuard Dissolvable Agent Requirements This section provides version information for both the Native Dissolvable Agent and the Java-based Dissolvable Agent. For more information on the Dissolvable Agent, refer to the ClearPass Policy Manager online help. The Google Chrome browser stopped supporting updates on the Windows XP, Windows Vista, and Mac OS X 10.6, 10.7, or 10.8 operating systems. Chrome will still work on these platforms but will not receive updates or security fixes after April The ClearPass OnGuard Dissolvable Agent on these platforms using Chrome is only supported through Chrome version 48.x. (#34744) This section includes: "OnGuard Native Dissolvable Agent Version Information " on page 15 "OnGuard Java-Based Dissolvable Agent Version Information" on page 17 OnGuard Native Dissolvable Agent Version Information In current laboratory tests for ClearPass 6.5.7, the browser versions shown in Table 1 were verified for the ClearPass OnGuard Native Dissolvable Agents. There are considerations to be aware of with some browser versions. For more information, click the ID number next to the browser s name. The Native Dissolvable Agent is not currently supported with the Microsoft Edge browser. (#35374) ClearPass Release Notes System Requirements for ClearPass

16 Table 1: Native Dissolvable Agent Latest Supported Browser Versions for This Release Operating System Browser Linux - Ubuntu bit LTS Firefox 47.x LInux - Ubuntu bit LTS Firefox 47.x (#28398) Linux - Ubuntu bit LTS Firefox 47.x Linux - Ubuntu bit LTS Firefox 47.x Mac OS X Safari 9.x Firefox 46.x (#29609) Chrome 51.x (#24518, #24986) Mac OS X Safari 10.x (#29609) Firefox 48.x Chrome 52.x (#24518, #24986) Mac OS X 10.9 Safari 9.x Firefox 47.x (#28398, #29609) Chrome 51.x (#24518, #24986) Mac OS X 10.8 Safari 6.x (#28398) Firefox 45.x Chrome 49.x (#24986) Mac OS X 10.7 Safari 5.x (#28398) Firefox 47.x Windows bit Chrome 51.x (#24518, #24986) Firefox 47.x Internet Explorer 11.x Windows bit Chrome 51.x (#24518, #24986) Firefox 47.x Internet Explorer 11.x (#25827) Windows bit Chrome 51.x (#24986) Firefox 47.x Internet Explorer 11.x 16 System Requirements for ClearPass 6.5 ClearPass Release Notes

17 Table 1: Native Dissolvable Agent Latest Supported Browser Versions for This Release (Continued) Operating System Browser Windows bit Chrome 52.x Firefox 48.x Internet Explorer 11.x Windows 8 64-bit Chrome 52.x (#24986) Firefox 47.x Internet Explorer 10.x Windows 8 32-bit Chrome 51.x (#24986) Firefox 46.x Internet Explorer 10.x Windows 7 64-bit Chrome 51.x (#24518, #24986) Firefox 47.x Internet Explorer 11.x (#25827) Windows 7 32-bit Chrome 51.x (#24518, #24986) Firefox 47.x Internet Explorer 11.x Windows bit Chrome 49.x (#24986) Firefox 48.x Internet Explorer 8.x (#24766) Windows Vista Chrome 49.x (#24986) Firefox 48.x (#29186) Internet Explorer 9.x (#29186) OnGuard Java-Based Dissolvable Agent Version Information In current laboratory tests for ClearPass 6.5.7, the browser and Java versions shown in Table 2 were verified for the ClearPass OnGuard Java-based Dissolvable Agent. There are considerations to be aware of with some browser versions. For information, click the ID number next to the browser s name. The latest Java version is required in order to perform health checks. There is an issue with the Chrome browser in this release. Please see #28737 in "Known Issues Identified in Previous Releases" on page 87 for a description and workaround. ClearPass Release Notes System Requirements for ClearPass

18 Table 2: Java-Based Dissolvable Agent Latest Supported Browser and Java Versions for This Release Operating System Browser Java Version Linux - CentOS Firefox JRE 1.8 Update 66 Linux - RedHat Firefox JRE 1.8 Update 66 Linux - Suse Firefox JRE 1.8 Update 65 Linux - Ubuntu Firefox JRE 1.8 Update 51 Mac OS X Safari 9.x (#20191) JRE 1.8 Update 101 Firefox 46.x (#27871) JRE 1.8 Update 101 Mac OS X Firefox 48.x (#27871) JRE 1.8 Update 101 Mac OS X Safari 9.x (#20191) JRE 1.8 Update 101 Firefox 47.x JRE 1.8 Update 101 Mac OS X 10.8 Safari 6.x JRE 1.8 Update 101 Firefox 47.x (#20191) JRE 1.8 Update 101 Windows bit Internet Explorer 11.x (#7165) JRE 1.8 Update 101 Windows bit Firefox 48.x (#7165) JRE 1.8 Update 101 Internet Explorer 11.x (#7165) JRE 1.8 Update 101 Windows bit Internet Explorer 11.x JRE 1.8 Update 101 Windows bit Firefox 48.x JRE 1.8 Update 101 Internet Explorer 11.x JRE 1.8 Update 101 Windows 8 64-bit Internet Explorer 10.x (#7165) JRE 1.8 Update 101 Windows 8 32-bit Internet Explorer 10.x JRE 1.8 Update 101 Windows 7 64-bit Internet Explorer 11.x JRE 1.8 Update 101 Windows 7 32-bit Internet Explorer 11.x JRE 1.8 Update 101 Windows bit Internet Explorer 7.x (#7165) JRE 1.8 Update 101 Windows Vista Internet Explorer 9.x (#7165) JRE 1.8 Update 101 ClearPass Onboard Requirements Onboard does not support Windows 8.x RT or Windows 8.x Phone. 18 System Requirements for ClearPass 6.5 ClearPass Release Notes

19 Chapter 3 Upgrade and Update Information This chapter provides instructions for upgrading or updating your ClearPass appliance. The term upgrade refers to moving from one major release version to another for example, from 6.4.x to The term update refers to applying a patch release within the same major version for example, from to This chapter includes the following sections: "Upgrading to ClearPass 6.5 from 6.2.6, 6.3.6, or 6.4.x" on page 19 "Updating Within the Same Major Version" on page 22 Upgrading to ClearPass 6.5 from 6.2.6, 6.3.6, or 6.4.x An upgrade is the process of moving from one major release version to another for example, from 6.4.x to This section describes accessing upgrade images, considerations to be aware of, and instructions for restoring the log database after the upgrade (optional). You can upgrade to ClearPass 6.5 from ClearPass 6.2.6, 6.3.6, or 6.4.x. Before you proceed with the upgrade, we recommend that you apply the latest available patch updates to your current release. For information on the patch update procedure, see "Updating Within the Same Major Version" on page 22. Upgrading to 6.5 from prior releases is not applicable to Hyper-V, since support for Hyper-V was introduced in 6.5. For 6.4.x upgrades through the Software Updates portal in Policy Manager, or through clearpass.arubanetworks.com, upgrade is supported for any 6.4.x version. For 6.4.x upgrades through the CLI, there are two options: If you are on or later, you can upgrade directly to 6.5 through the CLI. If you are on or 6.4.1, you must first download and install the CLI updates patch. At support.arubanetworks.com, go to Download Software > ClearPass > Policy Manager > Archives > > Patches and select the patch for CLI install (CPPM-x86_ cli-dersupport-patch). After you have installed the patch, update to or higher. You can then upgrade to 6.5 through the CLI. For 6.3.x, upgrade is only supported from the latest cumulative patch. You must update to before upgrading to 6.5. For 6.2.x, upgrade is only supported from the latest cumulative patch. You must update to before upgrading to 6.5. For 6.1.x, direct upgrades are not supported. Customers on 6.1.x must intermediately upgrade to 6.2.6, 6.3.6, or 6.4.x first before upgrading to 6.5. For appliance upgrades from 5.2.0, you must upgrade to 6.2.6, 6.3.6, or 6.4.x before upgrading to 6.5. Upgrade images are available within ClearPass Policy Manager from the Software Updates portal at Administration > Agents and Software Updates > Software Updates. Upgrade images are also available for download on the Support site under ClearPass > Policy Manager. ClearPass Release Notes Upgrade and Update Information 19

20 If you are upgrading from 6.4.0, the Software Updates portal incorrectly shows a warning during upgrade asking for two hard drives. This message can be ignored. (#27736) MySQL is supported in ClearPass 6.0.x and greater. Aruba does not ship drivers for MySQL by default. Customers who require MySQL can contact Aruba support to get the required patch. Users should be aware that this patch does not persist across upgrades, so customers using MySQL should contact support before they upgrade. Before You Upgrade Before you begin the upgrade process, please review the following important items: Plan downtime accordingly. Upgrades can take longer (several hours) depending on the size of your configuration database. A large number of audit records (hundreds of thousands) due to MDM integration can significantly increase upgrade times. Refer to the sample times shown in Table 3 under "Sample Times Required for Upgrade" on page 21. Review the ESX/ESXi disk requirements. These are described in "Virtual Appliance Requirements" on page 12 of the System Requirements for ClearPass 6.5 chapter. Any log settings that were modified prior to the upgrade are not retained, and are reset to the default. The administrator should configure any custom log settings again after the upgrade. Log Database and Access Tracker records are not restored as part of the upgrade. If required, you can manually restore them after the upgrade. For more information, please review "After You Upgrade" on page 21. Before initiating the upgrade process in ClearPass, we recommend you set the Auto Backup Configuration Options to Off (if it was set to other values such as Config or Config Session). The reason for disabling this setting is to avoid interference between the Auto Backup process and the Migration process. To change this setting: Navigate to Administration > Cluster Wide Parameters > General > Auto Backup Configuration Options = Off. If you have a custom authentication source configured to use the session log database, additional steps are required after upgrade. You have such an authentication source configured if you have a source of type Generic SQL DB in ClearPass Policy Manager > Configuration > Sources with server name localhost or and with the database name tipslogdb. In such cases, manually restoring the session log database is required after the upgrade completes (see "After You Upgrade" on page 21). Please contact Customer Support for configuration recommendations to move away from using the session log database as an authentication source. MySQL is supported in ClearPass 6.0.x and greater. Aruba does not ship drivers for MySQL by default. Customers who require MySQL can contact Aruba support to get the required patch. Users should be aware that this patch does not persist across upgrades, so customers using MySQL should contact support before they upgrade. VA only: If you have two disks already loaded with previous ClearPass versions for example, 6.2 on SCSI 0:1 and 6.3 on SCSI 0:2 then drop the inactive disk before upgrading. You must then add a newer disk based on the 6.5 disk requirements. Earlier releases used separate disks to store the current and previous ClearPass release; newer releases use just a single drive to store both installations. For current requirements, see "Virtual Appliance Requirements" on page 12. Never remove SCSI 0:0 20 Upgrade and Update Information ClearPass Release Notes

21 Sample Times Required for Upgrade To help you estimate how much time the upgrade might take, Table 1 shows representative numbers for upgrade times under test conditions. Remember that the figures here are only examples. The actual time required for your upgrade depends on several factors: Your hardware or virtual appliance model. In the case of VA installations, upgrade times vary significantly based on the IOPS performance of your VA infrastructure. The size of the configuration database to be migrated. For Insight nodes, the size of the Insight database. For subscriber nodes, the bandwidth and latency of the network link between the subscriber and the publisher. Table 3: Sample Times Required for Upgrade Hardware Model Config DB Size Insight DB Size Publisher Upgrade Time Subscriber Upgrade Time Insight Restoration Time in Publisher OR Subscriber CP MB 5 GB 50 minutes 50 minutes 20 minutes 200 MB 5 GB 60 minutes 60 minutes 20 minutes CP-5K 100 MB 5 GB 50 minutes 50 minutes 15 minutes 200 MB 5 GB 60 minutes 60 minutes 15 minutes CP-25K 200 MB 5 GB 30 minutes 30 minutes 15 minutes 500 MB 10 GB 40 minutes 40 minutes 20 minutes After You Upgrade To reduce downtime, the default upgrade behavior will now back up Log Database and Access Tracker records but will not restore them as part of the upgrade. If required, you can manually restore them after the upgrade through either the application or the CLI. The session log database contains: Access Tracker and Accounting records Event Viewer ClearPass Guest Application Log The Insight database is not part of the session log database, and will be migrated as part of the upgrade. Restoring the Log DB Through the User Interface To restore the Log DB after upgrade through the UI, restore from the auto-generated upgrade-backup.tar.gz file (available at Administration > Server Manager > Local Shared Folders). The restoration process could take several hours, depending on the size of your session log database. All services are accessible and will handle requests during the restoration, but there will be a performance impact while the restoration is in progress. We recommend that you perform this operation during a planned change window. ClearPass Release Notes Upgrade and Update Information 21

22 The restoration process will continue in the background even if the UI is closed or the session times out. A Restore complete event is logged in the Event Viewer when the restoration is complete. This process needs to be repeated on each server in the cluster that should retain the session log database. 1. Go to Administration > Server Manager > Server Configuration and click Restore for the server. 2. In the Restore Policy Manager Database window, select the File is on server option, and select the upgrade-backup.tar.gz file. 3. Also select the following options: Restore CPPM session log data (if it exists on the backup) Ignore version mismatch and attempt data migration Do not back up the existing databases before this operation 4. Uncheck the Restore CPPM configuration data option. 5. Click Start. Restoring the Log DB Through the CLI To restore the Log Database after the upgrade process is complete, use the restore command. Go to Administration > Server Manager > Local Shared Folders and download the upgrade-backup.tar.gz file. Host the file at an scp or http location accessible from the ClearPass appliance and execute the command restore <location/upgrade-backup.tar.gz> -l i b. The restoration process could take several hours depending on the size of your session log database. All services are accessible and handling requests during the restoration, but there will be a performance impact while the restoration is in progress. We recommend that you perform this operation during a planned change window. The restoration process will abort if the CLI session is closed or times out. We recommend that you initiate the restoration from the User Interface, especially if you have a large number of Access Tracker and Accounting records. This process needs to be repeated on each server in the cluster that should retain the session log database. The restore command syntax is as follows: Usage: restore user@hostname:/<backup-filename> [-l] [-i] [-b] [-c] [-r] [-n -N] [-s] restore [-i] [-b] [-c] [-e] [-n -N] [-s] restore <backup-filename> [-l] [-i] [-b] [-c] [-r] [-n -N] [-s] -b -- do not backup current config before restore -c -- restore CPPM configuration data -l -- restore CPPM session log data as well if it exists in the backup -r -- restore Insight data as well if it exists in the backup -i -- ignore version mismatch and attempt data migration -n -- retain local node config like certificates etc. after restore (default) -N -- do not retain local node config after restore -s -- restore cluster server/node entries from backup. The node entries will be in disabled state on restore Updating Within the Same Major Version An update is the process of applying a minor patch release within the same major version for example, from to Updates are available from the Software Updates portal in ClearPass Policy Manager. This 22 Upgrade and Update Information ClearPass Release Notes

23 section describes how to install a patch update either through the Software Updates portal or as an offline update. When you install the patch on a cluster, update the publisher first before applying the update on subscriber nodes. During a patch update, the log database is retained. No extra steps are needed to retain the session log history during a patch update. Installation Instructions Through the Software Updates Portal If access is allowed to clearpass.arubanetworks.com, ClearPass appliances will show the latest patches on the Software Updates portal: 1. In ClearPass Policy Manager, go to Administration > Agents and Software Updates > Software Updates. 2. In the Firmware and Patch Updates area, find the latest patch and click the Download button in its row. 3. After the patch is downloaded, click Install. 4. When the installation is complete, if the status on the Software Updates portal is shown as Needs Restart, click the Reboot button to restart ClearPass. After the restart, the status for the patch is shown as Installed. Installation Instructions for an Offline Update If you do not have access to clearpass.arubanetworks.com and you need to do an offline update, you may download the signed patch from the Support site, upload it to the ClearPass appliance, and then install it through the user interface: 1. Download the appropriate patch update from the Support site (support.arubanetworks.com). 2. Open ClearPass Policy Manager and go to Administration > Agents and Software Updates > Software Updates. 3. At the bottom of the Firmware and Patch Updates area, click Import Updates. 4. Browse to the downloaded patch file and then click Import. 5. When the import is complete, click Install. 6. When the installation is complete, if the status on the Software Updates portal is shown as Needs Restart, click the Reboot button to restart ClearPass. After the restart, the status for the patch is shown as Installed. ClearPass Release Notes Upgrade and Update Information 23

24 24 Upgrade and Update Information ClearPass Release Notes

25 Chapter 4 What s New in This Release This chapter provides a summary of the new features and changes in the ClearPass release. This chapter contains the following sections: "Release Overview" on page 25 "New Features and Enhancements in the Release" on page 25 "Issues Resolved in the Release" on page 27 "New Known Issues in the Release" on page 29 Release Overview ClearPass is a cumulative patch release that introduces new features and provides fixes for known issues. The cumulative patch is available in ClearPass Policy Manager under Administration > Agents and Software Updates > Software Updates. Important Changes Users should be aware of the following important changes in ClearPass behaviors and resources: if you plan to install the ClearPass cumulative update patch on top of a version through the CLI using the system update command, you must first install the ClearPass Hotfix Patch for CVE hotfix patch. This issue is specific to updates on top of ClearPass and through the CLI. It is not an issue for updates on top of other 6.5.x versions, nor for updates through the Software Updates portal. For more information, see #35422 under "New Known Issues in the Release" on page 29. OpenSSL has been upgraded to 1.0.1t in this release and no longer supports Diffie-Hellman parameters shorter than 1024 bit. This may impact 3rd party applications that have not updated their software to protect against the Logjam vulnerability. New Features and Enhancements in the Release The following new features were introduced in the ClearPass release. For a list of features introduced in previous 6.5.x releases, see "Enhancements in Previous 6.5.x Releases" on page 33. This section includes: "OnGuard" on page 25 "Policy Manager" on page 26 OnGuard The following new features are introduced in OnGuard in the release. Support was added for the following products: (#34590) Avast Free Antivirus 12.x (Windows) Avast Internet Security 12.x (Windows) ClearPass Release Notes What s New in This Release 25

26 HP Drive Encryption 8.x (Windows) Support was enhanced for the following products: Kaspersky Anti-Virus 16.x (Windows) Kaspersky Internet Security 16.x (Windows) Kaspersky Total Security 16.x (Windows) McAfee Host Intrusion Prevention 8.x (Windows) System Center Endpoint Protection (Windows 10) A Host:OSName attribute is added to the service rules to allow selecting a WebAuth service based on OS name. Specific OS versions can now be specified or excluded. To use this feature, go to Configuration > Services > Add. In the Service Rule area of the Service tab, select and configure the Host:OSName attribute. (#34407) Policy Manager The following new features are introduced in Policy Manager in the release. SSL ciphersuite versions are now updated. The updated ciphersuites match those in AOS, and are consistent between FIPS and non-fips deployments. Currently supported ciphersuites are listed below; all others are disabled. For information about a ciphersuite s definition, refer to its corresponding RFC. (#35119) The following ciphersuites are supported: TLS_RSA_WITH_AES_128_CBC_SHA (RFC 3268) TLS_RSA_WITH_AES_256_CBC_SHA (RFC 3268) TLS_RSA_WITH_AES_128_CBC_SHA256 (RFC 5246) TLS_RSA_WITH_AES_256_CBC_SHA256 (RFC 5246) TLS_DHE_RSA_WITH_AES_128_CBC_SHA (RFC 3268) TLS_DHE_RSA_WITH_AES_256_CBC_SHA (RFC 3268) TLS_DHE_RSA_WITH_AES_128_CBC_ SHA256 (RFC 5246) TLS_DHE_RSA_WITH_AES_256_CBC_ SHA256 (RFC 5246) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (RFC 4492) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (RFC 4492) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (RFC 5289) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (RFC 5289) TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (RFC 4492) TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (RFC 4492) TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (RFC 5289) TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (RFC 5289) TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (RFC 5289) TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (RFC 5289) 26 What s New in This Release ClearPass Release Notes

27 Issues Resolved in the Release The following issues have been fixed in the ClearPass release. For a list of issues fixed in previous 6.5.x releases, see "Issues Fixed in Previous 6.5.x Releases" on page 57. This section includes: "CLI" on page 27 "Guest" on page 27 "Insight" on page 27 "Onboard " on page 28 "OnGuard" on page 28 "Policy Manager" on page 29 CLI Table 4: CLI Issues Fixed in #35165 CLI logs sometimes grew too large, causing a CP-HW-500 server to crash. Pre-checks are now added to prevent this scenario. Guest Table 5: Guest Issues Fixed in #34173 #34641 The PHP version is now updated to This includes fixes for CVE , CVE , CVE , CVE , CVE , and CVE #35640 Corrected an issue where expired guest accounts passed pre-authentication if the Local - match a local account option was selected for the Pre-Auth Check field. Attempting to log in to an expired account now displays the appropriate error message about the account expiration. Insight Table 6: Insight Issues Fixed in #35203 Corrected an issue where the Insight module did not open if port 80 was blocked by the firewall. #34651 If a Dashboard report was configured with an option selected for Device Family or License Type and if the same report was reopened and saved again, the selected option was changed to Computer for Device Family and to Policy Manager for License Type. ClearPass Release Notes What s New in This Release 27

28 Onboard Table 7: Onboard Issues Fixed in #35044 Devices running Windows 8 or higher could not connect to the secure SSID after onboarding if the TLS client certificate private key was configured to be generated by Onboard. OnGuard Table 8: OnGuard Issues Fixed in #27602 The OnGuard Unified Agent failed to return health-check data over a VPN tunnel if the agent was installed on a client that ran MAC OS X and that used Kaspersky AntiVirus software. #33874 On a device with Webroot AntiVirus 9.x installed, the ClearPass OnGuard Unified Agent performed health checks every three minutes. #34041 Corrected an issue where ClearPass could not select the correct WebAuth service based on the Host:OSType attribute. This applied to the Persistent and native Dissolvable agents only; this attribute is not applicable to the Java-based Dissolvable Agent. #34119 On Mac OS X, if a VPN was connected when the ClearPass OnGuard Unified Agent was uninstalled, the VPN interface was not removed and the client remained connected to the VPN interface. #34357 The Windows OnGuard Unified Agent failed to read the Windows Hotfix list, and displayed a WBEM_E_ SHUTTING_DOWN (0x error or a ) error. #34593 The spelling of ClearPass Agent Controller Service is now corrected in the Windows OnGuard Unified Agent logs. #35144 The ClearPass OnGuard Unified Agent checked for Windows updates every hour even if the Windows Security Health Validator at Configuration > Posture > Posture Policies > Posture Plugins was not configured. #35146 On Windows 8, the ClearPass OnGuard Unified Agent sometimes took a long time to collect health information. #35187 The Windows OnGuard Unified Agent did not prompt for a password if a wrong password was entered or if authentication failed. 28 What s New in This Release ClearPass Release Notes

29 Policy Manager Table 9: Policy Manager Issues Fixed in #33415 The NETBIOS name was not appended in the user ID updates sent to Palo Alto Networks (PANW) if UserPrincipleName was used to authenticate the user and modified using the RADIUS username enforcement profile. #33601 Updating usernames through a policy did not update them properly in the Multi-Master Cache, which caused Change of Authorization (CoA) to fail with HPE ArubaOS-Switches running The policy server now posts the updated username to the Multi-Master Cache, and the value is properly sent in the CoA request. #33931 At Configuration > Network > Device Groups, adding a new device to a group s list caused existing devices to be deleted from that device group. #33965 Session Log syslog filters (if configured) caused high consumption of CPU and system resources. Query generation is now optimized to fix this issue. Users should be aware that some attributes or rows might be missed if tables are not updated. #33995 A particular TLS version could not be specified for an Active Directory (AD) connection. In environments where recent versions are required, this sometimes caused a connection failure during AD-over-SSL handshakes if the ClearPass appliance was configured to use a lower TLS version than the LDAP server required. ClearPass now supports TLS 1.2 in AD-over-SSL connections. #34241 The OpenSSL version is now upgraded to 1.0.1t. This includes fixes for CVE , CVE , CVE , CVE , CVE , and CVE #34842 Corrected an issue where a memory leak was triggered when a RADIUS server configuration was reloaded. #34994 #35201 Exceeding the default threshold values for CPU load averages caused the monitoring server to trigger System Error SNMP alerts. The default settings for the CPU load-average service parameters are now dynamic based on the number of CPU cores. This ensures that alerts are based on appropriate thresholds for each system's CPU usage limits. #35070 Support for TLS/SSL static key cipher algorithms is now removed. #35063 Authentication failures occurred if the RADIUS server or policy server processes reached the maximum allowed number of open files, especially if a large number of authentication or authorization sources were configured (65+). The max open file handlers limit (ulimit -n) is now increased to 100,000 for RADIUS server and policy server processes. #35065 The Apache Struts version is now upgraded to GA. #35108 Support for DES and IDEA cipher suites is now removed. #35260 JQuery libraries are now updated to for Policy Manager and 2.14 for Insight. New Known Issues in the Release The following known issues were identified in the ClearPass release. For a list of known issues identified in previous releases, see "Known Issues Identified in Previous Releases" on page 87. This section includes: "CLI" on page 30 "Dissolvable Agent" on page 30 ClearPass Release Notes What s New in This Release 29

30 "OnGuard" on page 30 "Policy Manager" on page 31 CLI Table 10: CLI Known Issues in #35422 #34393 Symptom: The ClearPass cumulative update patch fails to install on top of through the CLI command system update. Scenario: This issue is specific to updates on top of ClearPass and through the CLI. It is not an issue for updates on top of other 6.5.x versions, nor for updates through the Software Updates portal. Workaround: At Administration > Agents and Software Updates > Software Updates, first download and install the ClearPass Hotfix Patch for CVE This hotfix patch includes a fix for the system update CLI command. After the hotfix patch is installed, the CLI can be used to install the cumulative update patch on top of Dissolvable Agent Table 11: Dissolvable Agent Known Issues in #35374 Symptom: The Native Dissolvable Agent is not supported on the Microsoft Edge browser. Scenario: The Microsoft Edge browser is not able to detect whether the Native Dissolvable Agent is installed or not, and displays a message to download the agent even if the agent is already installed. Workaround: Use the Firefox, Chrome, or Internet Explorer browsers instead. #35590 Symptom/Scenario: The ClearPass 6.5.x Native Dissolvable Agent does not support downgrades from 6.6.x to 6.5.x. Workaround: If you are downgrading from 6.6.x to 6.5.x, you must first uninstall the 6.6.x Native Dissolvable Agent before you install the 6.5.x Native Dissolvable Agent. OnGuard Table 12: OnGuard Known Issues in #34225 Symptom: ClearPass OnGuard fails to establish a VPN connection if the Mac VIA application is installed on the system before OnGuard is installed. Scenario: This is only an issue in OnGuard versions below 6.6 (the issue is fixed in OnGuard 6.6). Workaround: For OnGuard versions below 6.6, run the following command to register OnGuard with the VPN plugin: scutil --nc enablevpn com.arubanetworks.aruba-via.vpnplugin <path of ClearPassOnGuard.app> The path for the OnGuard application will vary according to the original equipment manufacturer (OEM), as follows: Aruba: /Applications/Aruba Networks/ClearPassOnGuard.app DELL: /Applications/Dell Networking/ClearPassOnGuard.app ALU: /Applications/Alcatel-Lucent Networks/ClearPassOnGuard.app 30 What s New in This Release ClearPass Release Notes

31 Policy Manager Table 13: Policy Manager Known Issues in #35407 Symptom: Updating the DNS server through the user interface at Administration > Server Manager > Server Configuration displays the error message Error in processing request. Please retry. Scenario: The configuration is actually correctly updated, so the error message can be ignored. This only occurs for updates through the user interface; it does not occur for updates through the CLI. Workaround: To verify that the update was successful and to view the updated DNS server configuration, you can refresh the page or navigate away from the page and return to it. To avoid this issue, we recommend upgrading to ClearPass #35603 Symptom: A new root certificate for the Activate server cannot be validated. Scenario: Certificate validation fails if the CA chain for the new server certificate includes the CN=GeoTrust Primary Certification Authority G3 root certificate. This root certificate is not included in the default trust list. Workaround: You can download the missing root certificate from one of the following locations: To download the certificate from the Support site at support.arubanetworks.com, go to Download Software > ClearPass > Tools > 3rd Party Root Certificates and select the GeoTrust Primary Certification Authority - G3 Certificate. To download the certificate from GeoTrust, go to certificates/certificates/geotrust_pca_g3_root.pem, and click Keep to download the certificate file to your system. #35676 Symptom: Attempting to import an XML export file of a local database displays the error message "Authentication Source 3 : Primary: Internal database login user must be either appuser or appexternal only." Scenario: This happens when importing to from any earlier 6.5.x version (6.5.0 through 6.5.6) if the authentication source was created by a user with the appadmin permission and the currently logged-in user does not have the appuser or appexternal permission. Workaround: An admin user can manually modify the XML files and re-import them. ClearPass Release Notes What s New in This Release 31

32 32 What s New in This Release ClearPass Release Notes

33 Chapter 5 Enhancements in Previous 6.5.x Releases This chapter provides a brief summary of the features and enhancements introduced in previous ClearPass 6.5.x releases. Issue tracking IDs are included when available. For a list of new features introduced in the release, see the What s New in This Release chapter. This chapter includes: "CLI" on page 33 "Dissolvable Agent" on page 33 "Endpoint Context Servers" on page 34 "Guest" on page 37 "Insight" on page 39 "Onboard" on page 40 "OnGuard" on page 42 "Policy Manager" on page 47 CLI Features Added in The maximum number of authentication attempts into the ClearPass CLI using SSH is now limited to three instead of six. (#30287) The SSH algorithms used by the ClearPass CLI are now modified to only use the following: (#30288) Ciphers: aes128-cbc, aes256-cbc MACs: hmac-sha1, hmac-sha-256 KexAlgorithms: diffie-hellman-group14-sha1 Dissolvable Agent Features Added in The OnGuard Mac Health Checker.dmg file for the Mac OS X Native Dissolvable Agent now uses the Native Agent Installer instead of the Native Agent App. This allows users to easily uninstall the agent. (#25063) The Native Dissolvable Agent is now supported for the Ubuntu operating system with the Firefox browser (it is not supported for the Chrome browser). The following Ubuntu OS versions are supported: bit LTS bit LTS bit LTS bit LTS For more information, see #20656 under "OnGuard" on page 42. (#25271) ClearPass Release Notes Enhancements in Previous 6.5.x Releases 33