topic Re: ISE 2.2 Reprofiling After Adding New Profile Policies in Network Access Control

ISE 2.2 Reprofiling After Adding New Profile Policies

paul — Wed, 14 Jun 2017 21:06:47 GMT

I am working on an install at a customer and I am showing them how to build out their profile policies as we learn stuff in monitoring mode. We are running 2.2 patch 1. Usually when I add new profile policies that have higher minimum certainty factors than the current matched profiles, ISE will run my new policies against the endpoints and reprofile them within minutes. In this customer's case we have waited hours and they haven't reprofiled. If I delete the MAC address from the Endpoint database and have it reauthenticate it will profile correctly into my new policies.

Has this behavior changed in 2.2? I am going to test it in my lab today if I have time, but wanted to send out the question to the group.

Thanks.

Re: ISE 2.2 Reprofiling After Adding New Profile Policies

Timothy Abbott — Wed, 14 Jun 2017 21:10:51 GMT

That is still the behavior or ISE 2.2 when you modify profiling policy. I just recently tested this in my lab and can confirm that is the case.

Regards,

-Tim

Re: ISE 2.2 Reprofiling After Adding New Profile Policies

paul — Wed, 14 Jun 2017 21:21:22 GMT

So what would cause the deployment to not do that? I couldn’t find any settings the customer may have mistakenly turned off. I was sure in the other deployments I had done with 2.2 it still worked as well.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250

Re: ISE 2.2 Reprofiling After Adding New Profile Policies

Timothy Abbott — Thu, 15 Jun 2017 14:43:07 GMT

Honestly, I'm not 100% sure since I know that if any of the profile policies are modified, ISE attempts to reprofile all endpoints it knows about. If the behavior continues, I suggest reaching out to the TAC.

Regards,

-Tim

Re: ISE 2.2 Reprofiling After Adding New Profile Policies

Alex Martin — Tue, 20 Jun 2017 03:59:48 GMT

Paul,

I am seeing this same behaviour with my deployment with a customer and I have not yet contacted TAC about the issue but will soon be submitting a case with them. My deployment is 3 physical appliances that we upgraded from ISE 2.0 to 2.2 Patch 1. If you find any more information out about the issue, could you please update this post so I know as well. I will also update once we have had a chance for TAC to investigate.

Thanks,

Alex Martin

Re: ISE 2.2 Reprofiling After Adding New Profile Policies

paul — Tue, 20 Jun 2017 13:58:10 GMT

I haven’t done more research on this yet. The devices eventually reprofiled, but it took some time. I know at least a half hour after I added the new profile rules they hadn’t changed, but when I worked with the customer the next day things had reprofiled.

I will let you know if I find anything else out.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250