Licensing Shortfall Discovered Mid-Onboarding
An enterprise purchased 5,000 ClearPass Access licenses and 1,000 OnGuard licenses. They have 4,000 active endpoints authenticating daily via 802.1X, plus 800 guest devices. They are about to enable OnGuard health checks on the corporate SSID for all 4,000 endpoints. The publisher is a hardware appliance; there is one subscriber. The customer also plans to add 2,000 IoT devices using MAC authentication in the next quarter. Current Access license consumption is reported as 4,800. The customer asks whether they can enable OnGuard for all corporate endpoints today and whether the IoT rollout fits.
1. Assess license headroom for OnGuard today and explain what happens if OnGuard is enabled for all 4,000 endpoints.
Read the worked answer
OnGuard licenses are consumed per concurrently connected OnGuard-managed endpoint, not per Access license. With 1,000 OnGuard licenses and 4,000 endpoints to be health-checked, enabling OnGuard for all corporate endpoints would exceed entitlement by roughly 4x.
Access consumption of 4,800 of 5,000 leaves only 200 Access licenses of headroom - the 800 guests are already counted. So the answer is: no, they cannot enable OnGuard for all 4,000 today without additional OnGuard licenses, and even the Access pool is nearly exhausted.
Recommended: enable OnGuard in a pilot group first, monitor license usage in Policy Manager, and procure OnGuard capacity sized to peak concurrent corporate endpoints before broad rollout.
2. Does the planned 2,000-device IoT MAC-auth rollout fit within current licensing, and what should be verified?
Read the worked answer
No. 4,800 of 5,000 Access licenses are consumed; adding 2,000 MAC-auth devices would require ~6,800, exceeding the 5,000 Access entitlement by ~1,800.
Verify: (a) whether MAC-auth devices count toward Access licenses (they do - any authenticated endpoint consumes an Access license), (b) whether any existing endpoints can be decommissioned or moved to a non-licensed path, and (c) whether the subscriber requires its own license capacity (licenses are pooled at the cluster level but must be installed on the publisher). Plan to purchase at least 1,800 additional Access licenses plus buffer before the IoT phase.