topic Re: How can we purge Endpoints who do not go into any Identity group ? in Network Access Control

How can we purge Endpoints who do not go into any Identity group ?

raghchan — Mon, 16 Oct 2017 03:17:50 GMT

We are performing guest authentications and we don't have profiling persona or license enabled.

Some users do not go with the Guest flow completely and end up in blank Endpoint group.

Can we purge them using Endpoint purge rules ? I know we can manually filter and delete them from Context visibility. Is there some other way to delete them automatically ?

Please note they are not going to Unknown group. The Identity group is Blank for these endpoints.

Re: How can we purge Endpoints who do not go into any Identity group ?

Charlie Moreton — Mon, 16 Oct 2017 11:09:28 GMT

This is covered here:

Endpoint purge policy for 'blank' Identity Group

Re: How can we purge Endpoints who do not go into any Identity group ?

hslai — Tue, 17 Oct 2017 14:31:36 GMT

ISE allows rules using conditions other than endpoint groups in the endpoint purge policy. Please use such with cautions as they would apply to all endpoints.

Re: How can we purge Endpoints who do not go into any Identity group ?

raghchan — Sat, 28 Oct 2017 04:22:16 GMT

Can we have an automated way to remove MAC address which are in Blank Identity group.

If I create a Purge rule without any Identity group then it applies to all the MAC address which we do not want.

We can manually do it via Context visibility page but customer is not ready for that much manual task.

Re: How can we purge Endpoints who do not go into any Identity group ?

hslai — Sat, 28 Oct 2017 04:43:46 GMT

Endpoint purge policy for 'blank' Identity Group mentioned it related to the lack of ISE plus licenses. Please try recreating it and no using a customer db, because CSCve59024 is in U, and then re-opening the bug.

Re: How can we purge Endpoints who do not go into any Identity group ?

raghchan — Sat, 28 Oct 2017 04:55:29 GMT

I have tested this with custtomer backup and on fresh ISE node. Blank Identity group is something expected if Plus licence and Profiling is not there.

My customer does not want Plus license neither enable Profiling. Just want to remove this MAC addresses.

The bug is mentioned is something not related because when the detailed Endpoint is opened the Identity group is there as per the Bug description.

In lab with customer backup i am seeing blank groups only.

Re: How can we purge Endpoints who do not go into any Identity group ?

hslai — Sat, 28 Oct 2017 05:09:12 GMT

In that case, please open a fresh bug with all the details. AFAIK endpoints should be in "Unknown" instead of blank.

Re: How can we purge Endpoints who do not go into any Identity group ?

hslai — Sun, 29 Oct 2017 01:01:18 GMT

CSCvg46494, perhaps?

Re: How can we purge Endpoints who do not go into any Identity group ?

raghchan — Mon, 30 Oct 2017 05:39:08 GMT

Thanks. I think this is the bug.