Security

Quick question.

For our WPA2-PSK net we set devices up to have a expiry time of 1 year, the theory being that  students have to re register old devices and any that aren;t used gracefully drop out of the database.

Doesn't seem to work like that.  We rolled our our "mydevices" SSID a year ago and now I'm seeing a lot of "Expired" mac addresses in ClearPass guest ( v6.8.2 btw)

Can we set up an automagic "delete this mac address when it expires" ?

o.k. so that'll be clearpass  guest / guest manager / Expiration Options/ Expire Action = Delete at expired time

Plus associated notification stuff

A

Course tis not that simple Having changed the entry from "disable" to "delete and logoff" .... it only works for devices registered after you make the change. If you look at a guest device, there's an attribute called do_expire which is set to 1 = disable device.

..... and you can't change this from the gui

... wonder if you can do it from an api call. .... or an appexternal db query.

reason being we've got about 1000 devices set to disable only coz thats the number that have registered since we started this service and it would be good to change them all to delete.

Next year it'll be "delete and logoff" and the user will get an email 5 days before it gets deleted ... but for now would be nice to be able to change them all to delete and logoff.

Actually next year is about now :-(

All is not lost however as the user can log on and delete /re register  the device  .. someone is bound to complain this is too difficult

Sigh!

... and gets better.

A lot of headless devices now require an app on your iphone/android device etc to configure them. B4 all that was required was that the configuring and configured device were on the same vlan/network. Now it appears that both of them need to be on the same SSID :-(

We don;t normally allow that but now I've set things up so that you can (temporarily register a configuring device on . our "mydevices" network so you can configure said headless one.

Rather than have the configuring device having the same expiry time as a "normal" device, I set the expiry time to be an hour... that should give the user enough time to get their pet ChromeCast/ HomePod whatever up and running.

it seemed to work. My iPhone could connect to our wpa2-psk network and see the Apple HomePod I was fighting with and I could then configure it as required. the Guest Device entry for my iPhone had a do_expire set to 4 ( delete and log off) and an expiry time of 1 hour (see attached files). In theory 1 hour after the iphone was registered it would get deleted .... almost, its now disabled but still there. Theres a yellow triangle against the record implying that something is wrong.

One step forward ... slight shuffle back :-(