topic Re: ISE profiling doubt in Network Access Control

ISE profiling doubt

cgm — Thu, 16 Jan 2020 15:20:02 GMT

Hi,

I'm testing ISE profiling reading some material (ISE course) that says that basic profiling works even w/o the profiling service up.

That seems to be the case, but I get some inconsistent info.

Case in point, I get "Unknown" Endpoint profile in context visibility for an iPad that is recognized as such if you drill down in the Profiled Endpoints Summary report.

Any idea of why can this happen ? ISE 2.1 BTW.

Thanks!

Re: ISE profiling doubt

Arne Bier — Fri, 17 Jan 2020 05:13:08 GMT

Have a look for the great Profiling document originally written by Craig Hyps. If the answer is not in there then AFAIK, even if you have not enabled Profiling on a an ISE node, ISE will process the RADIUS Accounting records that your Cisco NAS is sending (and if you have enabled Device Sensor, then you are getting profiled info via the NAS. ISE is just decoding the data in this case). If you are not using Device Sensor, then ISE would only decode the MAC OUI for free. But that is not really Profiling. An ISE node that does not have Profiling enabled should not be displaying any newly profiled data. Perhaps you’re seeing historic profiling data when Profiling was enabled? Do you have a Plus license?

Re: ISE profiling doubt

cgm — Fri, 17 Jan 2020 09:38:52 GMT

Yes, I do have the a license installed.

I do see that profiling is taking place, for sure out of OUI and HTTP Agent header.

What I don't understand is why it keeps showing as Unknown in some places while it shows correctly profiled at others...

Re: ISE profiling doubt

Greg Gibbs — Fri, 17 Jan 2020 23:55:28 GMT

If you're seeing a discrepancy between the endpoint attributes in live logs or reports and those in the Context Visibility, there may be a sync issue between the endpoint and context visibility databases.

Try resyncing the Context Visibility database using the procedure in the following document:

ISE 2.3 Rest/Sync Context Visibility

Keep in mind that ISE 2.1 reached End of Software Maintenance on Sep 17th 2019 and reaches End of Support on Mar 17th 2020. You should urgently consider upgrading to a newer supported version.

Cheers,

Greg

Re: ISE profiling doubt

cgm — Sat, 18 Jan 2020 12:57:17 GMT

I'll try that when (and if) I reproduce the issue. Having enabled the profiler (service) now it all synchs.