Security

 View Only
Back to discussions
Expand all | Collapse all

Clearpass Onguard & MAC OS 27

This thread has been viewed 47 times

  • 1.  Clearpass Onguard & MAC OS 27

    Posted Sep 14, 2026 10:02 AM

    Is anyone having any luck with posture checking newly released mac OS 27 (Golden Gate)? I'm testing with 6.11.15 and posture failing for encryption checks.



  • 2.  RE: Clearpass Onguard & MAC OS 27

    Posted Sep 14, 2026 10:51 AM

    I think you have to wait for next release, as Mac OS 27 have just been released. If you check previous release notes you may be able to calculate how long time it will normally takes from a release of a new Mac OS version until it's supported in OnGuard.



    ------------------------------
    Best Regards
    Jonas Hammarbäck
    MVP Guru, ACEX, ACDX #1600, ACCX #1335, ACX-Network Security
    Aranya AB
    If you find my answer useful, consider giving kudos and/or mark as solution
    ------------------------------



  • 3.  RE: Clearpass Onguard & MAC OS 27

    Posted 26 days ago

    Same here. I'm on ClearPass 6.11.10 and OnGuard can't properly detect the built-in firewall on macOS 27 even though it's enabled.

    I opened a TAC case and they confirmed macOS 27 isn't supported yet on 6.11.10 or 6.11.15. No public fix/patch yet, still under Engineering investigation.




  • 4.  RE: Clearpass Onguard & MAC OS 27

    Posted 22 days ago

    Hi Mate, 

    Update: I found a workaround for the OnGuard firewall detection issue on macOS 27.

    I'm running ClearPass 6.11.10. OnGuard couldn't detect the macOS firewall correctly even though it was enabled.

    Workaround:

    1. Disable the firewall under macOS Network settings.

    2. Open Terminal and run:

    sudo pfctl -s info

    sudo pfctl -e

    1. Enter the Mac administrator password.

    After enabling PF (Packet Filter), OnGuard was able to detect the firewall status correctly in my environment.

    This is only a workaround, not an official HPE fix.


    Original Message


  • 5.  RE: Clearpass Onguard & MAC OS 27

    Posted 22 days ago

    Two things before anyone waits on a 6.11 fix.

    6.11 hit end of support the day 6.14.0 shipped as the new LSR, back in May. The published policy after that is critical security patches only, and a new macOS platform for OnGuard isn't one. Last year macOS 15 support did land on 6.11 as a 6.11.9 hotfix that rolled into 6.11.10, but 6.11 was the current LSR at the time. This year expect it on 6.14.x. If macOS 27 posture matters, the upgrade is the plan, not the wait.

    On the pfctl workaround, careful. pfctl -e loads the stock /etc/pf.conf, which on macOS is anchors only, no block rules, and you turned the application firewall off to get there. OnGuard sees a firewall and the Mac is filtering less than it was. It passes the check without meeting the reason the check exists. Worth knowing the macOS 15 firewall status bug was fixed with an OnGuard Agent Library update rather than a patch, so check Administration > Agents and Software Updates for a newer library before you touch pf fleet-wide.



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------

    Original Message


  • 6.  RE: Clearpass Onguard & MAC OS 27

    Posted 18 days ago

    JD, did a newer Agent Library show up under Agents and Software Updates, and did it clear the encryption check? If not, open the failed session in Access Tracker and post the OnGuard agent version and what it reported for FileVault. If it's sorted, marking it solved helps the next Mac admin find it.



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------

    Original Message


  • 7.  RE: Clearpass Onguard & MAC OS 27

    Posted 17 days ago

    Related to macOS and 6.11.15, When updating from 6.11.13 to 6.11.15 I am seeing this Filevault message:




  • 8.  RE: Clearpass Onguard & MAC OS 27

    Posted 17 days ago

    JD, NP, correcting myself first. On paper 6.11 has been security patches only since 6.14.0, but 6.11.15 still landed in August with Ubuntu 26.04 support and a batch of OnGuard fixes, and the known issues already mention a 6.11.16. So macOS 27 on 6.11 is likelier than I made it sound. I'd still rather be on 6.14, where Posture Engine Updates can add new OS support between patches.

    ST, that's not FileVault, it's the login keychain. The 6.11.15 Mac agent is signed with HPE's Apple certificate instead of Aruba's (CP-59255 in the 6.11.15 known issues), and the ArubaOnGuard item was written by the old Aruba-signed agent, so macOS sees the new one as a different app and asks. Mac login password plus Always Allow once per user and it should stop. Warn your helpdesk before it goes wide.

    Same signing change is why Mac auto-upgrade from 6.11.x fails, so the rest of the fleet needs the custom-script upgrade (there's an HPE TechNote for it) or your MDM. And while you're on 6.11.15, look up CP-60891: RADIUS can stop answering if its server cert has more than one CN in the subject.



    ------------------------------
    Dustin Burns
    @Worldcom Exchange, Inc.
    www.wei.com

    - - -
    The comments I post here are my own, and not my employers
    If my post was useful accept solution and/or give kudos
    Personal Blog: www.networkfieldnotes.com
    - - -
    ------------------------------

    Original Message


  • 9.  RE: Clearpass Onguard & MAC OS 27

    Posted 15 days ago

    a new release/update is available (6.11.16, 6.14.1)

    and for 6.14.1, there is a support of Mac OS 27 (i don't yet check for 6.11...)



    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCL: Powershell Module to use Aruba Central

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 10.  RE: Clearpass Onguard & MAC OS 27

    Posted 15 days ago

    Same for 6.11.16:  The ClearPass OnGuard Agent now supports Apple macOS 27.x (Golden Gate). (CP‑60500, CP‑61145)

    I am going to ask the Clearpass admins to provide me with this version for testing and deployment.


    Original Message


  • 11.  RE: Clearpass Onguard & MAC OS 27

    Posted 15 days ago

    Thanks all. I have started testing 6.11.16 support for MAC OS 27, but the first hurdle to get over is the Onguard automatic update. 

    Has anyone done a successful auto update from 6.11.12 to 6.11.16?


    Original Message


  • 12.  RE: Clearpass Onguard & MAC OS 27

    Posted 14 days ago
    Edited by ST-Xks358 14 days ago

    I would like to try upgrading from the Clearpass servers. We have never done that and use Jamf and Intune to push out the clients. On the Mac side, using Jamf has always worked well except this time users will need to auth again to OnGuard after the update.  BTW, I am the Jamf Apple engineer and not a Clearpass admin.


    Original Message


  • 13.  RE: Clearpass Onguard & MAC OS 27

    Posted 11 days ago

    If you have a device management system like Intune/JAMF, I would use that to push out the upgrades for the OnGuard Agent.

    The upgrades from ClearPass, I would use for non-managed clients.



    ------------------------------
    Herman Robers
    ------------------------
    If you have urgent issues, always contact your HPE Aruba Networking partner, distributor, or Aruba TAC Support. Check https://www.arubanetworks.com/support-services/contact-support/ for how to contact HPE Aruba Networking TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or HPE Aruba Networking.

    In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
    ------------------------------

    Original Message


Related Content