ClearPass Policy Service Latency During Peak Enrollment
A K-12 district runs ClearPass with a publisher and two subscribers. During a device enrollment event, 1,200 iPads are onboarded in one hour. Staff report intermittent authentication failures and slow logins. The publisher CPU is at 95%, and Access Tracker shows many requests timing out at 10 seconds. The subscribers show lower CPU (40%). RADIUS requests from the Aruba controllers are configured to point only to the publisher. The district uses Onboard with certificate provisioning, and the database is on the publisher. There is no load balancer.
1. Diagnose the bottleneck and explain why subscribers are underutilized.
Read the worked answer
The controllers send all RADIUS traffic to the publisher, so the subscribers receive little or no authentication load - they are underutilized because they are not in the RADIUS server list. The publisher is handling all authentication plus Onboard certificate provisioning and database writes, saturating CPU. The 10-second timeouts indicate the publisher cannot process requests fast enough. The fix is to distribute RADIUS across all three nodes (publisher and subscribers) using the controllers' RADIUS server group, and to ensure the Onboard/guest services are appropriately placed. Subscribers can handle authentication and policy evaluation; the publisher should be reserved for database and management functions where possible.
2. How would you re-architect and validate the change?
Read the worked answer
Re-architect: (1) Configure the Aruba controllers to use a RADIUS server group containing the publisher and both subscribers, with health checks and failover. (2) Ensure the ClearPass cluster is healthy and subscribers can reach the publisher database. (3) For Onboard, consider directing provisioning traffic to a dedicated node or scheduling enrollment windows. (4) Monitor CPU and request latency across all nodes. Validation: run a staged load test (e.g., 100 devices) and confirm requests distribute across nodes in Access Tracker and that latency drops below threshold. Then proceed to the full event with monitoring. Have a rollback plan to revert the RADIUS server group if issues arise.