OnGuard Posture Fails Only on Wi-Fi, Passes on Wired
A company enforces OnGuard health checks. Wired 802.1X users pass posture and get the 'healthy' role. The same laptops on corporate Wi-Fi fail posture with 'Agent cannot reach ClearPass' and land in a remediation role. The OnGuard agent is installed and the same version on both paths. The Wi-Fi SSID uses the same 802.1X service and enforcement policy as wired. Wired clients are on VLAN 100; Wi-Fi clients are on VLAN 200. There is a firewall between VLAN 200 and the ClearPass cluster; VLAN 100 has no firewall. ClearPass is reachable for RADIUS on both paths (authentication succeeds). Posture only fails after authentication, during the health check phase.
1. Why does authentication succeed but posture fail only on Wi-Fi, and what should be checked first?
Read the worked answer
Authentication uses RADIUS (UDP 1812/1813) and succeeds on both paths, so basic reachability to ClearPass exists. Posture assessment is a separate channel: the OnGuard agent communicates with the ClearPass OnGuard service over HTTPS (TCP 443) to the policy manager/OnGuard server. If the firewall between VLAN 200 and ClearPass permits RADIUS but blocks TCP 443 to the OnGuard endpoint, the agent cannot retrieve or post posture results.
Check first: firewall rules from VLAN 200 to the ClearPass cluster for TCP 443 (and any OnGuard-specific ports), and confirm the agent's configured server address resolves/routes correctly from the Wi-Fi subnet. The symptom pattern - auth OK, posture channel dead, only on the firewalled VLAN - points to a port/protocol block, not an agent or policy problem.
2. If the firewall is confirmed open on 443, what is the next diagnostic step?
Read the worked answer
Move up the stack:
- On a failing Wi-Fi client, verify the agent's configured ClearPass server address - if it uses a hostname, confirm DNS resolution on VLAN 200 returns the correct IP (split-horizon DNS can differ between VLANs).
- Check Access Tracker for the posture request: does the health check arrive at ClearPass at all? If no request arrives, the client-side channel is broken. If a request arrives but fails, inspect the posture policy and agent logs.
- Compare the OnGuard agent logs on a Wi-Fi vs wired laptop for the connection error. A DNS or certificate-trust error (agent rejecting the ClearPass HTTPS cert on the Wi-Fi path) would also present as 'cannot reach ClearPass' despite an open port.