ERS - Endpoint ID to MAC mismatch

giosif — Fri, 15 Dec 2017 17:37:46 GMT

Hello,

I have a customer using ERS to perform certain operations on endpoint entries in ISE and they are hitting the following issue:

CURL GET Response :{ "SearchResult" : { "total" : 1, "resources" : [ { "id" : "d4ad0fb0-a42b-11e7-a15f-02423d50d5bd", "name" : "9C:EB:E8:2D:12:A8", "link" : { "rel" : "self", "href" : "https://<<PAN>>:9060/ers/config/endpoint/d4ad0fb0-a42b-11e7-a15f-02423d50d5bd", "type" : "application/xml" } } ] } }

MAC Address Object ID :: d4ad0fb0-a42b-11e7-a15f-02423d50d5bd

Update Response :: { "ERSResponse" : { "operation" : "PUT-update-endpoint", "messages" : [ { "title" : "Endpoint ID to MAC mismatch. ID 0eb5cf10-e024-11e7-b7ef-0242d715141b, mac in ERS: 9C:EB:E8:2D:12:A8, mac in DB: 9C:EB:E8:53:5C:A1", "type" : "ERROR", "code" : "CRUD operation exception" } ], "link" : { "rel" : "related", "href" : "https://<<PAN>>:9060/ers/config/endpoint/0eb5cf10-e024-11e7-b7ef-0242d715141b", "type" : "application/xml" } } }

Can someone please explain what this error is about (i.e. where are the two mismatching entries coming from)?

Also, how could we end up in such a situation, since the endpoint ID used in the update request above is the one we got from ISE itself?

As a side note that might be relevant to this situation, this customer is using DisplayLink hubs at their desks with the wired connections plugged into these hubs, so the same device may show as having different MAC addresses over time, if the user happens to be sitting at a different desk (and, consequently, connect to a different DisplayLink hub).

Thanks,

George

Re: ERS - Endpoint ID to MAC mismatch

Craig Hyps — Fri, 15 Dec 2017 23:55:29 GMT

If I interpret the snippets correctly, you performed a get on ID d4ad0fb0-a42b-11e7-a15f-02423d50d5bd and was returned a MAC value of 9C:EB:E8:2D:12:A8, and then update request was sent for endpoint with same same values resulted in error? However, it looks like the put request was for ID 0eb5cf10-e024-11e7-b7ef-0242d715141b with MAC of 9C:EB:E8:2D:12:A8 and system responded "no, the MAC associated with this ID is 9C:EB:E8:53:5C:A1.

Maybe I am misreading. In any case, I would try running the query via postman, one request at a time, and see if get same result. If not, then likely a script error where shifting the MAC and ID variables. If issue seen with singular queries using Postman or similar REST tool, then open TAC case for potential defect. TAC will be able to support the command functionality, but cannot troubleshoot scripting errors.

Craig

topic ERS - Endpoint ID to MAC mismatch in Network Access Control

ERS - Endpoint ID to MAC mismatch

Re: ERS - Endpoint ID to MAC mismatch