clearpass-proxmox-deploy

Deploy and validate HPE Aruba ClearPass Policy Manager 6.14 virtual appliances on Proxmox VE KVM.

9|Updated Mar 7, 2026
One-click install
npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill clearpass-proxmox-deploy-fastrevmd-lab
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: clearpass-proxmox-deploy
Source: https://github.com/fastrevmd-lab/fwskillsshare/tree/main/skills/clearpass-proxmox-deploy
Command: npx skills add https://github.com/fastrevmd-lab/fwskillsshare --skill clearpass-proxmox-deploy-fastrevmd-lab

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve? Deploying ClearPass Policy Manager 6.14 on Proxmox VE fails in undocumented ways: the KVM image only boots under UEFI, the installation guide misstates the disk size and bus type, the setup wizard renders on VGA only, and irreversible choices like disk encryption and appliance flavor are locked in at first boot. This Skill encodes a verified end-to-end procedure that avoids each of these traps. ## Core Features & Use Cases - Pre-power-on safety gate: Enforces UEFI firmware with an EFI disk, correct second-disk sizing per appliance flavor, ascending NIC MAC order, and volume resolution via qm config + pvesm path so the raw image write never targets the wrong disk. - Streamed image write with integrity verification: The stream-inflate-zip.py script inflates the ~5 GB compressed zip directly onto the target volume over SSH, verifying size and CRC32 against the zip header without staging a 45 GiB temp file. - VGA console automation: The console-type.py script converts literal strings into QEMU monitor sendkey commands to drive the VGA-only setup wizard, with a --stdin mode that keeps the cluster password out of argv and shell history. - Day-2 operations reference: Covers license ordering, HTTPS certificate import with trust-list requirements, and REST API token minting on 6.14. - Use Case: You received a ClearPass 6.14 KVM zip and a Proxmox host. Use this Skill to size the VM for a C1000V flavor, write the image safely, answer the first-boot wizard through the QEMU monitor, and validate the appliance before enabling autostart. ## Quick Start Use the clearpass-proxmox-deploy skill to plan and execute a ClearPass 6.14 C1000V deployment on my Proxmox VE host, starting with the pre-power-on verification gate.

Frequently Asked Questions about clearpass-proxmox-deploy

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I deploy ClearPass Policy Manager on Proxmox VE?

Create a VM with UEFI firmware (bios ovmf plus an EFI disk), attach a first disk sized exactly to the zip's uncompressed image and a second empty disk sized to the appliance flavor, then stream-inflate the raw image onto the first disk. Boot and answer the flavor, encryption, and network wizard prompts through the QEMU monitor.

Why does the ClearPass KVM image not boot on Proxmox?

The ClearPass 6.14 image only boots under UEFI; its GRUB entry calls linuxefi, which the BIOS build of GRUB 2.06 does not implement. Under SeaBIOS the VM loops at the GRUB menu, so set bios to ovmf and attach an EFI disk before first power-on.

How do I automate the ClearPass setup wizard over a serial console?

You cannot; the wizard renders on the VGA console only because console=tty0 is last on the kernel command line. Drive it through the QEMU monitor using sendkey commands generated by console-type.py and confirm each answer with screendump screenshots.

What disk size does the ClearPass 6.14 KVM image need?

The 6.14.0.371380 image is 45 GiB uncompressed, not the 24 GB the installation guide states. Read the exact uncompressed size and CRC32 from the zip's central directory and size the first disk to match, plus a second disk of 400-1800 GB depending on flavor.

Can I change ClearPass disk encryption after installation?

No. The encryption prompt appears once during first boot and any keystroke other than Y permanently disables encryption. Decide before powering on the VM, and avoid sending a stray Enter at the preceding confirmation prompt.

Why does ClearPass certificate import fail with a trust list error?

ClearPass validates the chain on import, so the issuing root CA must be in the Certificate Trust List even for the appliance's own server certificate. Upload CAs as .crt files, since .pem files are typed as application/pkcs7-mime and rejected.