topic Re: ISE export full profiling info in Network Access Control

ISE export full profiling info

Gustavo Novais — Tue, 09 May 2017 08:18:09 GMT

Hello,

I have a customer that is using the visibility features of ISE in order to have a better view of what is connected to the network.

The information we can get is very good, but what we'd like would be to have access to full extent of the profiling info acquired per endpoint, so that we can export it and treat it.

Namely there are a few fields that are listed as endpoint attributes that are simply not present on the exported attributes. For instance if I want to export the AD-OS-Version, or the AD-Join-Point we can't.

Am I missing something? I see that there are (in version 2.2 p1) 87 fields that we can treat, but not all of them are exportable.Is there a reason why? Is it foreseen to add the rest in a next version?

Thanks

Gustavo Novais

Re: ISE export full profiling info

Craig Hyps — Tue, 09 May 2017 12:08:51 GMT

Correct. Not all attributes are exportable from Context Visibility as they are not stored there. If wish to export other endpoint data not hosted in Context Visibility, you can either download the Endpoint Analysis Tool (EAT) from iseeat.cisco.com (be sure to register with company email), or export from CLI "application configure ise" and select option to Get All Endpoints. I recommend EAT and running tool during off hours.

Craig

Re: ISE export full profiling info

Gustavo Novais — Tue, 09 May 2017 14:16:49 GMT

Hi Craig,

as EAT Tool supports only ISE up to 1.4 it looks like the available version does not support AD-Probe related attributes.

Anyway the Get All Endpoints worked like a charm!

Thank you for your help!

Re: ISE export full profiling info

Craig Hyps — Tue, 09 May 2017 14:50:20 GMT

Did you actually try it? The screen requires update to show support for ISE 2.x releases. We should be updating tool to support ISE 2.2 any day now. The original report filter for Profiling does not include newer AD Probe attribute, but it is certainly present if export all attributes...

AD-Fetch-Host-Name

AD-Host-Exists

AD-Join-Point

AD-Last-Fetch-Time

AD-OS-Version

AD-Operating-System

/Craig

Re: ISE export full profiling info

Gustavo Novais — Tue, 09 May 2017 15:23:13 GMT

Hi Craig,

as the canned reports as well as the requirements page indicated no support to what we wanted, we didn't install it on our management server and went with the CLI option.

I'll try it out on a test VM to see what we can get then.

Regards

Gustavo