topic ISE - Cisco IP Phone profiling in Network Access Control

ISE - Cisco IP Phone profiling

eng.malak — Wed, 13 Mar 2019 00:42:00 GMT

Dears

i have issues profiling the Cisco ip phones , it's profiled as "PROFILED" the only probes i enabled on switches and ISE is Radius and now i know the i need to enable CDP device sensor so it can be sent via Radius accounting but i can't find the commend "device-sensor account" on my switch , i use "

Version 15.0(2)SE3" and WS-C2960S-24PS

any ideas ?

ISE - Cisco IP Phone profiling

Eduardo Aliaga — Thu, 04 Jul 2013 21:12:22 GMT

According to the release notes, the 2960 don't support this feature, only the 3750 and 3560.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/15.0_2_se/release/notes/OL25301.html#wp1047686

I've been using 3750-X and 3560 with device sensor for a month now, and it profiles Cisco IP phones in less than a minute, most of the times in 20 seconds or so.

Please rate if it helps

ISE - Cisco IP Phone profiling

eng.malak — Fri, 05 Jul 2013 20:05:59 GMT

so what is the alternative ?

Re: ISE - Cisco IP Phone profiling

Eduardo Aliaga — Fri, 05 Jul 2013 20:24:27 GMT

you could use another type of profiling, for example, DHCP profiling, then you would have to use DHCP relay pointing to your ISE to collect the information, but I have never tested it and don't know how reliable and how fast to profile it's.

I would recommend to use static profiling, you could get the list of all MAC addresses from your Call Manager and then import them into ISE. The benefit it's that static profiling doens't use advanced licenses, only standard licenses, so it's cheaper to do it this way

Please rate it helps

Message was edited by: Eduardo Aliaga

Re: ISE - Cisco IP Phone profiling

Tarik Admani — Sun, 07 Jul 2013 05:54:55 GMT

Hi,

You should be able to use the dhcp relay feature because the hostname of the phone is contained in the dhcp request, I am sure that there is a condition already identified for the cisco ip phone hostname, and if there isnt you should be able to write one yourself.

Event though the device sensor isnt really supported on the 2960s i have had good luck with in the labs, however I havent proposed this as a solution for either of my customers, just a real head scratcher I wanted to share with you.

Sent from Cisco Technical Support iPad App

ISE - Cisco IP Phone profiling

eng.malak — Sun, 07 Jul 2013 09:34:32 GMT

i read once that i should let the ISE to updates its profiler via Internet , any idea about how to do this ?

ISE - Cisco IP Phone profiling

Octavian Szolga — Sun, 07 Jul 2013 13:17:45 GMT

ISE will update automatically it's OUI database, using Profiler Feed Service in version 1.2 that should be released this month.

Re: ISE - Cisco IP Phone profiling

eng.malak — Sun, 07 Jul 2013 13:47:12 GMT

What about ISE 1.1.4. ?

Sent from Cisco Technical Support iPhone App

Re: ISE - Cisco IP Phone profiling

Tarik Admani — Sun, 07 Jul 2013 21:24:36 GMT

At this point I dont think the feed service is a critical issue for any cisco ip phone deployments that have been in service for quite some time, Where the feed service really comes into play is the latest smartphones and the profiling characteristics they fall under. For cisco ip phones you should be able to write a simple policy and have this tested fairly easily. If you go to the profiling conditions you should be able to see which attributes (or checks) that ISE performs for each cisco ip phone. I am sure the dhcp atttribute is one of the checks that you can leverage.

Thanks,

Sent from Cisco Technical Support iPad App

ISE - Cisco IP Phone profiling

Ravi Singh — Mon, 08 Jul 2013 02:25:19 GMT

I would like to inform you that 2960 does not support this feature. For profiling IP phones on ISE please follow the instruction given in the below link.

https://techzone.cisco.com/t5/Unified-Controller-Based-WLC/Wireless-BYOD-for-FlexConnect-Deployment-Guide/ta-p/239326

ISE - Cisco IP Phone profiling

Venkatesh Attuluri — Tue, 09 Jul 2013 12:10:02 GMT

With ISE Release 1.2*, Cisco is delivering, a unique feed service that provides new and updated profiles for various IP enabled devices when vendors release new devices. So ISE customers will be able to recognize new devices, in addition to a multitude of other network attached devices such as printers, video cameras, and specialized mobile computing devices.

Cisco works with various vendors, partners, customers, etc. to profile the multitude of IP enabled devices that are expected to be deployed in various customer environments and create profiles for these. These profiles are made available through the Cisco Feed Service. An ISE server* that is configured to connect to the Feed Service establishes a secure connection with cloud based Feed Service. The various profiles on the Feed Service are then automatically downloaded to the ISE server, thus providing ISE customers the ability to stay abreast and detect various IP enabled devices that connect to their network. The Feed Service will be available with the release of ISE 1.2* software release and is part of the Advanced License.