Memory utilization for ClearPass OnGuard depends on the Health Classes configured and the type of Windows OS; however, the minimum requirement for ClearPass OnGuard running on a Windows platform is 90 MB.

#12342

The OnGuard agent fails to collect health on Windows 8 if VMware Server 2.0.2.X is installed.

#13164

Symptom: The hardware installation pop-up dialog appears to stop installing the ClearPass OnGuard Unified Agent for VIA+OnGuard mode. A warning message similar to “The software you are installing... has not passed Windows Logo testing” might be displayed during installation.

Scenario: This might occur during the installation of the ClearPass OnGuard Unified Agent on Windows XP and Windows 2003 SP2.

Workaround: Users should click Continue Anyway to proceed.

#13363

Symptom: On Mac OS X, the current version of the ClearPass OnGuard Unified Agent VPN component does not show some VPN-related information—for example, tunnel IP assigned by the controller, packet count, or diagnostic details.

Scenario: This occurs on Mac OS X. It does not occur on Windows OS.

#13929

At times, OnGuard may fail to detect peer-to-peer applications, such as /uTorrent, on Windows 2008 R2.

#13935

OnGuard does not support enabling or disabling the Windows Update Agent Patch Management Application.

#13970

After anti-virus software is installed, the system must be rebooted before using ClearPass OnGuard.

#14196

ClearPass OnGuard will not be able get the correct status of 'Software Update' PM application on Mac OS X, if “Check for updates” and “Download updates automatically” are not toggled at least once.

#14673

The OnGuard Agent for Mac OS X does not support bouncing of a VPN Interface other than the Aruba VPN Interface (version 6.1).

#14760

In some cases, OnGuard fails to connect to the ClearPass appliance from a wired interface if the VPN is connected from a trusted network.

#14842

Installing the ClearPass OnGuard Unified Agent removes an existing VIA installation. To continue to use VPN functionality, go to Administration > Agents and Software Updates > OnGuard Settings and select Install and enable Aruba VPN component from the drop-down list.

#14996

If McAfee VE is running on Windows XP, the ClearPass OnGuard Unified Agent VPN will not work.

#15072

VIA connection profile details are not carried forward after upgrading from VIA 2.0 to ClearPass OnGuard Unified Agent 6.1.1.

#15097

The ClearPass OnGuard Unified Agent does not support installation of a VPN component on Mac OS X 10.6.

#15156

VPN configuration is not retained after upgrading to the ClearPass OnGuard Unified Agent using MSI Installer on a 64-bit Windows system.

#15233

On Win 7 (64 Bit), upgrading an existing VIA 2.1.1.X to the ClearPass OnGuard Unified Agent can lead to an inconsistent state. Users should first uninstall VIA and then proceed with the ClearPass OnGuard Unified Agent installation.

#15351

Symptom: The state of the Real_Time Scanning button in the Trend Micro Titanium Internet Security for Mac OS X is not updated.

Scenario: This is observed when the ClearPass Unified OnGuard Agent has Real Time Protection (RTP).

Workaround: Close the UI using Command +Q and restart.

#15586

Symptom: The ClearPass OnGuard 6.2 dissolvable agent does not support the following new health classes on Mac OS X: Processes, Patch Management, Peer-To-Peer, Services, USB Devices, and Disk Encryption. The dissolvable agent (DA) does not display these health classes as remediation messages in the user interface because java binary sdk support is not included.

Scenario: The client will be unhealthy if any of the health classes listed above are configured and performing a health scan via the DA.

#15986

ClearPass OnGuard returns the product name of “Microsoft Forefront Endpoint protection” AntiVirus as “Microsoft Security Essential”.

#16181

Symptom: The command level process can be detected using the path “none” but the application level process can't be detected by setting the path to ”none”.

Scenario: This applies to Mac OS X.

Workaround: The application-level process health should be configured with the path set to Applications > Firefox.app.

#16550

Symptom/Scenario: The ClearPass OnGuard Unified Agent does not support checking of disk encryption state using the MacKeeper (ZeoBIT LLC) Disk Encryption Product on Mac OS X. This causes the client to be treated as healthy even if none of the disk is encrypted.

Workaround: There is no workaround at this time.

#18281

The ClearPass OnGuard configured health quiet period is supported in Health only mode. It doesn’t work in Auth+Health mode.

#18341

Symptom/Scenario: OnGuard cannot start a process on Mac OS X for non-administrative users.

Workaround: The user must have root privileges to start process-level health checks by OnGuard on Mac OS X.

#19019

The network interface will be bounced twice (once immediately, and once after the configured interval) when the log-out/bounce delay parameter is configured. This is expected behavior; the first bounce is required to end the existing session.

#20316

OnGuard’s Health Check Quiet Period is applicable per network interface. If a machine has more than one network interface, then each interface will have its own Health Check Quiet Period duration.

#23470

Symptom/Scenario: On a Japanese OS, when upgrading from VIA 2.1.1.3 to the ClearPass OnGuard Unified Agent, a known issue with uninstalling VIA displays a message asking the user to select the VIA driver. This does not occur on an English OS.

#23636

Symptom: The value of the Posture:Applied Policy attribute is not correctly displayed in the Access Tracker for posture policies carried over from releases earlier than 6.3.0.

Scenario: This has been observed when upgrading from 6.2.6 to 6.3.2.

Workaround: This can be corrected by manually saving the affected posture policy once after upgrade.

#24986

Symptom: The Native Dissolvable Agent is not automatically launched after downloading and running the agent the first time on the Chrome browser.

Scenario: This occurs on Windows and on Mac OS X.

Workaround: The first time you launch the Dissolvable Agent, click Launch ClearPass OnGuard Agent.

#25827

Symptom/Scenario: On Internet Explorer 8, when the security warning message asks whether you want to view only the content delivered through a secure HTTPS connection, the behavior is not as expected.

Workaround: For the Native Agent flow to work correctly, click No in the pop-up dialog.

#26224

Symptom/Scenario: Some combined products that include both antivirus and anti-spyware (for example, McAfee VirusScan Enterprise + AntiSpyware Enterprise) are not shown in the AntiSpyware Posture configuration.

Workaround: Add products like this only in Antivirus. Both the AntiVirus and AntiSpyware values are the same.

#27134

Symptom: OnGuard does not support dynamic switching between logged-in users on an Ubuntu client.

#27599

Symptom: The OnGuard logo is not shown on the desktop on Ubuntu.

Scenario: On the Ubuntu OS, the OnGuard logo is not visible on the desktop at first. The logo will be updated automatically after the desktop is refreshed.

#27876

Users should be aware that RADIUS CoA over VPN is not supported on Ubuntu.

#29243

Symptom: The Unified Agent fails to disable other types of network connections when “Allow Only One Network Connection” is selected.

Scenario: Users should be aware that the ClearPass OnGuard Unified Agent for Windows does not support disabling USB data card/modem type network interfaces.

#29598

Symptom: OnGuard does not stop or pause VM Player 7.x virtual machines.

Scenario: Users should be aware that the ClearPass OnGuard Unified Agent does not support auto-remediation for Guest VMs running on VMware Player.

#30106

Symptom: On Mac OS X, the native and Java dissolvable agents do not get the RTP status of ESET Cyber Security Antivirus 6.x.

Scenario: Users should be aware that the ClearPass OnGuard Native Dissolvable Agent for Mac OS X does not support the RTP Status check for ESET Cyber Security and ESET NOD32 Antivirus.

#30243

#30212

Symptom: The ClearPass OnGuard Unified Agent fails to load on Windows Server 2003, and does not support VPN, Auto Upgrade, or SSO on Windows XP or Windows Server 2003.

Scenario: Users should be aware that Microsoft stopped supporting Windows Server 2003 on July 14, 2015, and stopped supporting Windows XP on April 8, 2014. Aruba will not provide further ClearPass support for these operating systems.

Workaround: Windows 2003 server and XP machines are required to update the Microsoft root CA certificate or missing trust certificates in order to load the OnGuard user interface properly.

The following Microsoft knowledge base article provides information, as well as a link to the hotfix download that needs to be installed in order to enable certificate support with the SHA-256 algorithm: https://support.microsoft.com/en-us/kb/968730.

#30381

Symptom: The ClearPass OnGuard Unified Agent might not be able to detect the installation of certain Windows updates that are not visible in Control Panel > Programs and Features > View installed updates.

Scenario: These are updates that might not use an installer or cannot be removed. Some examples include the Windows Malicious Software Removal Tool, certain Windows Defender updates (but these are validated through AntiVirus health class), and foreign language input method editor (IME) files.

Workaround: There is no workaround at this time.

#30618

Symptom: The ClearPass user interface may become unavailable after installing ClearPass OnGuard hotfix patches due to a service restart.

Workaround: Log in to the ClearPass CLI using the appadmin account, and restart cpass-admin-server using the ‘service restart cpass-admin-server’ command. This will only affect the GUI and not the availability of ClearPass services (for example, RADIUS).

#31734

Symptom/Scenario: When both the wired and wireless interfaces are connected, the ClearPass OnGuard Dissolvable Agent sometimes picks the wrong interface to perform health checks.

#31893

Symptom/Scenario: Although Windows 10 does not support the Network Access Protection (NAP) platform, Windows 10 is still listed in the Windows System Health Validator and Windows Security Health Validator plugins for OnGuard at Configuration > Posture > Posture Policies > Posture Plugins tab.

#32590

Symptom/Scenario: The ClearPass OnGuard Unified Agent stops performing health checks on clients where AVG Anti-Virus Free Edition 2016.x is installed.

Workaround: Perform the following steps to resolve the issue.

rename 'c:Program FilesAVGAvavgwdsvcx.exe' avgwdsvcx.exe.org

taskkill /F /IM avgwdsvcx.exe

rename c:ProgramDataAvgAVDBstats.db stats1.db

rename 'c:Program FilesAVGAvavgwdsvcx.exe.org' avgwdsvcx.exe

sc start avgwd

#33332

Symptom: The Java Dissolvable Agent guest portal page hangs.

Scenario: This occurs when the user clicks Continue on the Security Warning dialog after installing or upgrading to JRE 8u73. This is not an issue with current Java versions.

Workaround: Upgrade to the latest JRE version.

#33458

Symptom/Scenario: If there are more than two auto-connect SSIDs configured, a Windows OS will sometimes keep connecting to these SSIDs after the OnGuard Agent disconnects the wireless interface.

#33532

Symptom/Scenario: When the ClearPass OnGuard Agent for Windows is running in Service mode, the Retry button is sometimes disabled and an incorrect system tray icon is shown.

Workaround: Quit OnGuard and relaunch it.

#34571

Symptom/Scenario: The Java-based Dissolvable Agent sometimes does not show health check results on Windows in the Firefox browser.

Workaround: Rebooting the system or clearing the browser cache might fix the problem.

#34744

Users should be aware that the Dissolvable Agent flow might not work with the latest Google Chrome versions (49.x and later) on the following operating systems because Google no longer supports Chrome on these platforms: Windows XP, Windows Vista, and Mac OS X 10.6, 10.7, and 10.8.

#34829

Symptom: The ClearPass OnGuard Unified Agent's Retry and Login buttons sometimes become inactive if the network interface is disabled or disconnected.

Scenario: This occurs on Windows operating systems, and is only seen in Service mode.

Workaround: Quit and relaunch the OnGuard Agent.

#34987

Symptom/Scenario: If the VPN component is enabled on the ClearPass OnGuard Unified Agent, multi-user (switch user) use cases are not supported.

#36208

Symptom: Double backslash characters ( ) are shown in the Access Tracker for the Path and Command attributes of the Agent Script Enforcement profile, but users should only enter a single backslash character ( ).

Scenario: On the Monitoring > Live Monitoring > Access Tracker > Output tab for an Agent Script enforcement profile, the Application Response area shows double backslash characters instead of single backslash characters in Path and Command attribute values.

This is normal display behavior for this form and is not an issue. Users should be aware that, when creating an attribute, only single backslash characters may be entered in attribute values. Although a double backslash is displayed in these attribute values on the Output tab, the value sent to OnGuard uses the single backslash.

#36334

Symptom: The Native Dissolvable Agent does not launch automatically after it is installed, and if the user clicks “Launch ClearPass OnGuard Agent” it again prompts the user to download the Native Agent.

Scenario: This issue has been observed mostly on Firefox versions 48.x and 49.x.

Workaround: In the Firefox menu, click the Add-ons link and then select Plugins in the left menu. The Native Dissolvable Agent will then launch automatically.

#36354

Symptom: The Native Dissolvable Agent does not launch automatically after it is downloaded and run for the first time on the Firefox browser.

Scenario: This occurs on the Firefox browser for both Windows and Mac OS X.

Workaround: When the agent is launched for the first time , click “Launch ClearPass OnGuard Agent” to launch it manually.

#37354

Symptom: The Java Dissolvable Agent does not work with the Safari browser on macOS 10.12.

Scenario: When trying to perform health checks using the Java Dissolvable Agent, after the applet opens OnGuard stops and does not perform the health checks. This is due to recent changes in the Safari browser, and is not an issue with ClearPass.

Workaround: None.

#37393

Symptom/Scenario: After the RTP status of AhnLab V3 Endpoint Security AntiVirus is enabled on Korean Windows 7 as part of auto-remediation, the ClearPass OnGuard Unified Agent takes a few seconds to detect the RTP status as Enabled.

#37531

Symptom:The ClearPass OnGuard Unified Agent fails to enable the Real-Time Protection (RTP) method of Symantec Endpoint Protection 14.x (SEP14).

Workaround: In Symantec Endpoint Protection, go to Change Settings > Client Management > Tamper Protection and un-mark the Protect Symantec security software from being tampered with or shut down check box.

#37539

Symptom: The ClearPass OnGuard Unified Agent cannot install missing patches using the Microsoft Windows Update Agent if the patch has an empty value in the KBARTICLEID field.

Scenario: This issue is seen on Windows 10 LSTB 14393 Build 2016.

#37939

Symptom: The Native Dissolvable Agent does not work in the Firefox browser.

Scenario: The Native Dissolvable Agent for Windows does not support the 64-bit version of the Firefox browser.

Workaround: Use the 32-bit version of Firefox browser instead.

#38141

Users should be aware that the Java-based OnGuard Dissolvable Agent is no longer supported on Windows, MacOS, or Ubuntu systems. Only the Native OnGuard Dissolvable Agent workflow will be used for those platforms in the 6.6.5 release and future releases.

#38208

Symptom: After the ClearPass OnGuard Unified Agent is installed it does not automatically display the VIA profile download dialog.

Scenario: When a non-administrator user is logged in and tries to install the agent, they are prompted to provide administrator credentials. When they do, the agent installs, but the VIA profile download dialog does not open.

Workaround: To download the VIA profile, go to the Details tab. In the Change Detail Type drop-down list, select Connection Details, and then click the Download button. Enter the server details and credentials in the Login window.

#38303

Symptom/Scenario: The ClearPass OnGuard Unified Agent does not support updating Symantec Endpoint Protection 14.x as part of auto-remediation.

#38403

Symptom: The Native Dissolvable Agent does not work in the Firefox browser on macOS.

Scenario: After installing OnGuard through the Firefox browser, the “Install OnGuard” dialog does not open and the plugin cannot be found. This has been observed in the Firefox browser on Mac OS X 10.10 and macOS 10.12.

Workaround: Use the Safari or Chrome browser instead.

#38976

Symptom: The ClearPass OnGuard Native Dissolvable Agent is not supported on Firefox versions 52.x and later. This is because of recent changes in the Firefox browser itself.

Scenario: This has been observed on MacOS, Windows, and Linux operating systems.

Workaround: Use the Google Chrome, Internet Explorer (IE), or Safari browsers instead.

#39148

Symptom: Attempting to update from 6.6.4 to 6.6.5 using the Cluster Update page fails and displays the error message “certificate common name ... doesn’t match requested host name.”

Scenario: If you are upgrading a cluster from 6.6.4 to 6.6.5, the Cluster Upgrade page only works if the publisher's certificate includes the publisher’s IP Address in the Common Name (CN).

This only occurs when updating from 6.6.4 to 6.6.5. It is not an issue when updating from other versions.

Workaround: If the publisher’s certificate does not include the publisher’s own IP address, manually update the cluster instead of using the Cluster Update page.