topic Re: OUI "Unknown" in EndPoint Profile ISE in Network Access Control

OUI "Unknown" in EndPoint Profile ISE

ALFONSO MONEO VILORIA — Fri, 01 Dec 2017 10:22:22 GMT

Hello all,

we have several ISE 2.0.1.130 authenticating clients from 2 Cisco Anchor Controllers. We have noticed lots of clients are showed as "Unknown" in the ISE Endpoint Profile OUI field.

We have enabled ISE Feed Services and we have checked it is downloading periodically new OUIs and Profiles succesfully so we don't know why OUI appears as "Unknown". We have checked those MACS are included in the "oui.txt" file of ieee.org.

Any idea in order to correct this behaviour? We need to identify MACS correctly.

Thanks and regards!

Alfonso

Re: OUI "Unknown" in EndPoint Profile ISE

ognyan.totev — Fri, 01 Dec 2017 13:03:58 GMT

Are you include this option in WLC WLAN. And for profiling you need plus license.

Re: OUI "Unknown" in EndPoint Profile ISE

ALFONSO MONEO VILORIA — Fri, 01 Dec 2017 13:34:24 GMT

Yes, Ognyan. I'm including both options in Anchors.

Thanks for the info.

Re: OUI "Unknown" in EndPoint Profile ISE

Jason Kunst — Fri, 01 Dec 2017 16:06:20 GMT

i would recommend troubleshooting with the TAC why these are not bring shown correctly. If they are common endpoints then it should be a simple fix, regardless open a case to debug

Also make sure on the PSN handling the authentications you have enabled profiling with http, DHCP and radius probes

How To: ISE Profiling Design Guide

Re: OUI "Unknown" in EndPoint Profile ISE

Craig Hyps — Fri, 01 Dec 2017 17:51:05 GMT

You should see endpoint OUI value in Endpoint view. If still unknown, then may not have profile based on that specific OUI. This is where DHCP and User Agent data can help detect client OS independent of OUI.

Re: OUI "Unknown" in EndPoint Profile ISE

hslai — Tue, 05 Dec 2017 01:37:54 GMT

In case that an endpoint matching a "Private" OUI in oui.txt, then it's expected to be shown as "Unknown".

Either go to http://standards-oui.ieee.org/oui.txt and see if "Private" by itself shown under the column "Organization". Or, download the file and use CLI:

awk '$3 ~/Private^M/ { print $1 }' oui.txt | sort -uf

to get a list of private OUIs.

https://standards.ieee.org/develop/regauth/tut/eui.pdf says,

...for assignees electing to use the private listing option, the IEEE assignment, but not identity of the assignee, is publicly available.