Security

 View Only
Expand all | Collapse all

[TUTORIAL] ClearPass Policy Visualiser

This thread has been viewed 195 times
  • 1.  [TUTORIAL] ClearPass Policy Visualiser

    Posted Aug 22, 2026 06:49 AM
    Edited by AP-e172d8 Aug 22, 2026 08:52 PM

    ClearPass Policy Visualiser available on my GitHub repository, is a dependency analysis and policy impact exploration platform for HPE Aruba Networking ClearPass Policy Manager. The platform provides an interactive view of the relationships between Services, Role Mapping Policies, Enforcement Policies, Enforcement Profiles, Roles and Enforcement Attributes. It helps administrators trace dependencies, inspect policy logic, identify unused objects and understand how proposed changes may affect authentication, authorisation and enforcement workflows.

    Version 1.5.0 adds read-only Impact Analysis for Enforcement Profiles, Enforcement Policies and Role Mapping Policies, together with a dashboard lookup for rapid access to used, unused and built-in ClearPass objects.


    By consolidating policy relationships and dependencies into one interface, ClearPass Policy Visualiser supports troubleshooting, change planning, configuration review, cleanup and operational documentation.

    This accompanying technote covers how to configure ClearPass API access and then provide step-by-step guidance for installing, configuring and using ClearPass Policy Visualiser.

    I hope you find it useful, and I’d welcome your feedback and suggestions for improvement. I’d also appreciate help with scale testing, particularly in environments with large numbers of Services, policy objects and endpoints



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 2.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted Aug 23, 2026 07:24 PM

    This looks awesome thanks. Looking forward to trying it out! 




  • 3.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted Aug 24, 2026 10:05 AM

    I'll definitely try this out! Thank you




  • 4.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted Aug 25, 2026 02:17 AM

    I was looking for something just like this. Thank you!




  • 5.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted Aug 26, 2026 01:02 PM

    This looks like the answer to the problem I have had with ClearPass the whole time. Looking forward to trying it out. thanks for your effort, and I will provide feedback here if appropriate.




  • 6.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted Aug 26, 2026 06:56 PM

    Thanks for the comments and feedback both here and in private.  ClearPass Policy Visualiser 1.5.2 is now released.

    check the github site for the new feature and some fixes too :-)



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 7.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted Sep 02, 2026 03:29 AM

    Nice ! Thanks, (i have the same idea but using PowerShell and PowerArubaCP ;-)) 



    ------------------------------
    PowerArubaSW : Powershell Module to use Aruba Switch API for Vlan, VlanPorts, LACP, LLDP...

    PowerArubaCP: Powershell Module to use ClearPass API (create NAD, Guest...)

    PowerArubaCL: Powershell Module to use Aruba Central

    PowerArubaCX: Powershell Module to use ArubaCX API (get interface/vlan/ports info)..

    ACEP / ACMX #107 / ACDX #1281
    ------------------------------



  • 8.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 28 days ago

    just a quick update,  Thanks everyone for all the feedback so far.

    ClearPass Policy Visualiser v1.6.0 is now available, with a number of improvements:

    • Docker-based deployment with Docker Compose
    • Waitress as the production WSGI server
    • Configurable container timezone
    • Endpoint profiling now uses the ClearPass PostgreSQL database directly
    • Improved endpoint profiling cache initialisation and startup logging

    Docker is now the recommended deployment method, making it much easier to get the Visualiser up and running without having to manage a separate Python environment on the host.

    Also the technote "ClearPass Policy Visualiser" has been updated to reflect these changes

    As always, please keep the feedback coming. 



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 9.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 21 days ago

    We had delayed the build out of this until after you released this version, so unfortunately, I don't have comparative analysis to provide, however, I must say I am very impressed. This makes ClearPass so much more usable. Really should be built into it honestly. Thanks again AP, great work!!




  • 10.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 21 days ago

    One thing I noticed in v1.6.0, the hit count is not incrementing. Is this expected? Would be super helpful to have the feature again, since it was stripped out of the ClearPass service page




  • 11.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 20 days ago

    thanks for your feedback Sean, the funny thing is that I was planning  to bring back the hit count to the model. Then I could use it in the impact analysis, etc.

    I am thinking to initially add the meta data under "Total Services" card on the dashboard, where I would show  

    • enabled xx
    • top hits xx
    • least hits: xx

    and then have a sort-able hit count column for the "configured services"



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 12.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 18 days ago

    That sounds ideal Ariya!




  • 13.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 15 days ago

    Now we have ClearPass Policy Visualiser 1.6.1, new features include 

    • Added Top Hits and Least Hits summaries to the dashboard.
    • Added Hit Counts to individual Service Visualise pages.
    • Added sortable Order, Name, Type and Hit Count columns.

    Note that Hit Counts are refreshed during application startup and when Refresh Services is selected.



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 14.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 11 days ago
    Edited by SC-e61e78 11 days ago

    Nice!! That was remarkably quick turnaround! I am noticing that there is not an option to select a different node for the Insights retrieval. Is this something that could be done?

    Host: it uses CP_SQL_HOST, the same value as endpoint profiling, so there is no way to point Insight at a different node.




  • 15.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 11 days ago

    yes currently it does not give you an option to select a specific note, but generally I would point it to the publisher to get all the info including the Insight retrieval for hitcounts.

    As a side note CPV v1.6.1 is now tested against a substantially larger ClearPass deployment that had 1.37 million endpoints and the endpoint profiling cache was populated in just over 9 min.  I have added Appendix A in the technote ClearPass Policy Visualiser that goes through the details.



    ------------------------------
    If my post was useful accept solution and/or give kudos.
    Any opinions expressed here are solely my own and not necessarily that of HPE or Aruba.
    ------------------------------



  • 16.  RE: [TUTORIAL] ClearPass Policy Visualiser

    Posted 3 days ago

    I am quite excited to give this a 'go' to see how it may assist in understanding the use and impact of our fledgling 6.14.x deployments as we roll it out to more Guest and LAN locations.  cheers to you for your efforts.