topic ISE Profiling Without DHCP Snooping in Network Access Control

ISE Profiling Without DHCP Snooping

Damien Miller — Tue, 09 Jul 2019 04:18:18 GMT

I have a new ISE POC going and was testing ISE/dot1x functionality without DHCP snooping. In past deployments the customers have either been open to enabling snooping, or already had it in use. Before saying it is a hard requirement, I have taken a minimalist approach testing without snooping. DHCP information is expectantly missing from the device sensor cache, but so far everything works as it should.

ISE is still receiving DHCP information via IP helpers, and the authentication sessions still have an IP assigned presumably via IP device tracking.

Some docs say snooping is optional, other say it's mandatory. With the combination of IP helpers and IP device tracking, what would we miss if DHCP snooping wasn't implemented to enable the DHCP device sensor?

Re: ISE Profiling Without DHCP Snooping

Mark Elsen — Tue, 09 Jul 2019 07:17:04 GMT

https://community.cisco.com/t5/policy-and-access/ise-and-dhcp-snooping/td-p/2473425

Re: ISE Profiling Without DHCP Snooping

Mohammed al Baqari — Tue, 09 Jul 2019 07:43:59 GMT

With the combi of tracking and helper, dhcp snooping won't add to the
information as you already got what you want. I have configured as you
mentioned and can see dhcp options populated successfully in ISE

**** Remember to rate useful posts