Troubleshooting and Monitoring
Insight and logs
ClearPass Insight provides dashboards, reports, and search over authentication and accounting data. Access Tracker is the primary troubleshooting tool: it shows each request's service match, authentication result, role mapping, and enforcement. Candidates must know to start in Access Tracker.
Logs and tools
Use Policy Manager logs, event logs, syslog, and packet capture on the NAD and ClearPass. The RADIUS server logs and service logs show detailed reasons for failures. OnGuard and Guest have their own logs.
Common failure patterns
- No service match → request hits default/deny. Check service match rules and order.
- Authentication failure → wrong credentials, unreachable AD, expired cert, or method mismatch.
- Role mapping empty → source not returning attributes.
- Enforcement not applied → NAD lacks the attribute/dictionary or CoA unsupported.
- CoA failure → shared secret mismatch or NAD doesn't support RFC 5176.
Traps in questions
- Forgetting Access Tracker shows the whole decision chain per request.
- Assuming a RADIUS timeout is an authentication failure - often it's reachability or shared secret.
- Overlooking clock skew breaking certificate validation.
Rule of thumb
Reproduce, then read Access Tracker top-down: service → auth → role → enforcement → NAD response. Compare with NAD-side logs to confirm what the NAD received.
Worked example
Users intermittently fail. Access Tracker shows some requests with no service match and others with auth failures. The no-match requests come from a new NAD whose IP isn't in the service match rule; the auth failures are from an expired server cert. Fix the match rule and renew the cert.