topic Re: Automating imaging using ISE profiling in Network Access Control

Automating imaging using ISE profiling

Mike.Cifelli — Mon, 01 Apr 2019 18:23:13 GMT

I am attempting to automate the imaging process in an environment by utilizing ISE profiling.
I have the following pieces working as expected:
Using the DHCP probe with the dhcp-class-identifier STARTSWITH PXEClient:Arch:. The endpoint MACs move to a profiled endpoint group.

I have coa set to reauth which is where my issues are. Upon reauth the device gets re-profiled and removed from the endpoint group in ISE. Therefore the device hits a different policy upon reauth. I would like to have hosts get profiled, added to a group, re-authenticate and get restricted authorization upon reauth to complete pxe boot process. Then finally purge endpoints after 1-2 days, which I have setup now.

Does anyone have a better/easier way of utilizing device profiling to automate an imaging process?

Re: Automating imaging using ISE profiling

Arne Bier — Wed, 24 Jul 2019 12:06:06 GMT

Hi @Mike.Cifelli

Did you ever find a solution to this question offline?

I have to say I didn't know you could solve this via profiling, and in the past we used to tell customers to use MAB as a temporary workaround until the machine has been re-imaged (PXE Boot).

Re: Automating imaging using ISE profiling

Mike.Cifelli — Wed, 24 Jul 2019 12:40:01 GMT

@Arne Bier nothing different from what you mentioned. The current process leverages mab. However, I am in the process of exploring ISE REST APIs, and my current environment is getting Ansible in a couple of months. The hope is to potentially use Ansible and the ISE APIs to create a more automated workflow. I can definitely let you know how that all plays out, but it will be a little bit of time. Cheers

Re: Automating imaging using ISE profiling

aysarmohamed — Fri, 03 Apr 2026 04:49:35 GMT

Since this was in 2019

now we are in 2026

did you find an automated solution 😁

Re: Automating imaging using ISE profiling

Greg Gibbs — Mon, 06 Apr 2026 23:36:11 GMT

This legacy build process is still dependent on SCCM, which has had no significant enhancements to improve this flow.

Many customers are moving to Autopilot, for which I built this solution:
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-and-microsoft-windows-autopilot/ta-p/5256754

Re: Automating imaging using ISE profiling

aysarmohamed — Mon, 11 May 2026 03:19:10 GMT

Thank you sir