topic Re: See what triggered a profile change? in Network Access Control

See what triggered a profile change?

Dustin Anderson — Wed, 30 Aug 2017 14:50:13 GMT

Every once in a while I run into devices that just change profile for no reason. My latest is an Apple MacBook profiled as an Apple-Device changed to Android for no reason.

Is there any way to see what was triggered.

I tried to look at what updated by the feed service, but the link to the reports page is not found and then sends me back to the login page.

Re: See what triggered a profile change?

kthiruve — Thu, 31 Aug 2017 00:01:32 GMT

Hi Dustin,

Have you turned on Nmap scan. Make sure to understand the difference in the results of the probe to identify the difference. You can look at the endpoint dashboard, click on the endpoint, look at the attributes.

I am hoping that you have turned on feed services to get the profiling updates.

Thanks

Krishnan

Re: See what triggered a profile change?

Craig Hyps — Fri, 01 Sep 2017 12:16:58 GMT

Go to Operations > Reports > Diagnostics > Endpoint Profile Changes

Set filter at top for specific MAC address. Details link should reveal the new/changed profile data received in that profile assignment or change.

Re: See what triggered a profile change?

Dustin Anderson — Fri, 01 Sep 2017 14:51:32 GMT

Thanks for the info, Still not sure what caused it, but looking at all the data, I do see this as odd.

User-Agent

Fabric Android Studio Plugin for Mac OS X/Android Studio 2.3

operating-system-result

Android

This is a MacBookPro

It looks like it triggered with a certainty of 30 due to thinking the OS was Android.

Re: See what triggered a profile change?

paul — Fri, 01 Sep 2017 17:19:34 GMT

Yep this is a common issue I have seen in my deployments. Minimum Certainty factor on the profiling policy wins the race. You have a few options here:

Remove NMAP condition from the Android profile policy.
Bump up the minimum certainty factor on Apple-Device rule to above the minimum certainty factor of the Android rule.
Make your own Apple-Device profiling policy and make the certainty factor is higher than Android rule.

I personally would go with #3. As I always instruct customers "Cisco's minimum certainty factor is typically a 10/20/30 progression. If you want your profiling policies to always beat Cisco's then make custom policies 100/200/300 progression."

Re: See what triggered a profile change?

Dustin Anderson — Fri, 01 Sep 2017 17:39:00 GMT

Yeah, I usually set custom rules at 100, but normally have to only make for new phones and devices. My usual problem is unknown devices.

Re: See what triggered a profile change?

paul — Fri, 01 Sep 2017 17:45:23 GMT

Yep identity the unknown devices is the “fun” part of the ISE install. Usually that is where I spend most of my time after the initial setup.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250