topic Re: Profiler Feed in Network Access Control

Profiler Feed

Donald Fisher — Thu, 30 Jan 2020 20:39:17 GMT

Team,

Is there a way to identify what will be in the profile feed? I had a customer that due to new GE profiles, their author policy stop working. We turned off the feed, and modify the profile, but wanted to see if there is anyway that we can give customer before new profile are sent thought the feed.

Re: Profiler Feed

Colby LeMaire — Fri, 31 Jan 2020 01:49:23 GMT

The customer can do manual offline updates and verify any changes to profiling policies that they currently use before uploading to ISE. It really isn't that often that you need to update profiling policies, especially in corporate environments that are relatively static.

Re: Profiler Feed

Greg Gibbs — Fri, 31 Jan 2020 01:58:03 GMT

Hi Donald,

There is always a bit of risk in using the automated feed service updates on a production system. Ideally, you would want to test the feed service updates in a non-prod environment before updating them in production.

Typically, there are two ways this is done by customers:

Disable the Online Subscription Update for the Feed Service in the Prod system. Allow a Non-Prod system to auto-update via the Feed Service and use the option to notify an Administrator via email when the update occurs. After testing in the Non-Prod environment, enable the Online Update in Prod and perform a manual update during a change window. Perform endpoint testing and back out (Undo Latest) the update if any issues are found.
Disable the Online Subscription Update in the Prod system and use Offline updates. Register for the Offline Feed Service Management via https://ise.cisco.com/partner and sign up for update notifications via email. When new updates are available, download and evaluate the XML file for any overlapping or conflicting profiler updates and test in Non-Prod (if possible). Perform the offline update during a change window, perform endpoint testing, and back out the update if any issues are found.

Cheers,

Greg

Re: Profiler Feed

Damien Miller — Fri, 31 Jan 2020 02:42:02 GMT

My general recommendation for customers is that for any profiling policy that you are using to provide network access, leverage a custom made copy and following a naming standard indicating that it is self made.

There have been a few issues in the past where the automated profiler feed update has burnt me in the same way you experienced.