Setting up ClearPass

↩ Network Access

Setup has two halves: your collector has to be listening, and ClearPass has to be sending. Neither is on by default.

What you need

• A site collector on v0.6.0 or later at the site.
• Administrative access to ClearPass.

1. Make the collector listen

The collector's syslog listener is off by default. It only starts if a listening port is set, which means recreating the collector container with that setting.

Avoid port 514. It's a privileged port, and the collector image runs as a non-root user — granting the capability to bind it is not sufficient, because the capability is dropped when the process switches user. Use a high port such as 5514 and point ClearPass at that instead. It avoids the problem entirely.

2. Make ClearPass send

In ClearPass, under Administration → External Servers:

1. Add a Syslog Target pointing at your collector's address and the port you chose.
2. Add a Syslog Export Filter selecting the session fields to send.

3. Configure the connection in JOATOS

Under Settings → Integrations, configure the ClearPass connection. Until this exists, the Network Access menu entry stays hidden even with the module enabled.

How long records are kept

Failures are kept for a shorter window deliberately — they're high-volume and most useful while fresh.

Known limits

These are structural, not faults:

• Live utilisation isn't available. No endpoint exposes it, so it can't be shown.
• Live state coverage is bounded to hosts enrolled in JOATOS at a site with a v0.6.0 collector. A device ClearPass knows about but JOATOS doesn't won't have live state.
• No backfill. Records begin when syslog starts arriving.

Notes & tips

• Set the collector's port first, then point ClearPass at it — a syslog target aimed at a port nothing is listening on fails silently.
• If nothing appears after setup, check the collector version before anything else. Below v0.6.0 there is no listener to enable.

Related

• Reading the access log
• Installing the Site Collector