ISE nmap profiling attribute for vnc

rcullum — Fri, 24 Aug 2018 17:06:21 GMT

I'm trying to build a profiling policy for a wyse terminal. Nmap scan returns:

22-tcp   ssh
5900-tcp   vnc
80-tcp   http

in Context Visibility but I can't seem to use 5900-tcp as a profiling condition. It's not visible in the nmap dictionary on ISE (but nmap on ISE must know about it, else how would it know tcp/5900 is vnc). How do I fix this? This is ISE 2.3 Patch 4. Latest Profiling feed installed.

Re: ISE nmap profiling attribute for vnc

paul — Fri, 24 Aug 2018 21:09:14 GMT

Build a custom NMAP scan defintion on the Policy->Results->Profiling->NMAP Scan screen. Add 5900 as a custom TCP port to scan. Save it.

Once you do that you will see TCP 5900 show up under NMAP extensions in your profiling options. Make sure you select NMAP extensions.

topic ISE nmap profiling attribute for vnc in Network Access Control

ISE nmap profiling attribute for vnc

Re: ISE nmap profiling attribute for vnc