topic Re: MAC address using only DHCP probes in Network Access Control

MAC address using only DHCP probes

umahar — Tue, 18 Oct 2016 04:38:07 GMT

Are MAC addresses learnt if we only enable DHCP probes on a PSN and configure ISE PSN as helper address ?

We want to profile Polycom phones which uses OUI based policy. However to optimize the ISE cluster we are exploring if we can disable Radius probes on PSN and only enable DHCP probes.

Re: MAC address using only DHCP probes

howon — Tue, 18 Oct 2016 05:08:40 GMT

Yes certainly possible, however, it is still recommended to use RADIUS probe especially if you are authenticating the endpoints with MAB/802.1X. I haven't found any reason not to use RADIUS probe, is there any specific reason that you believe RADIUS probe is causing optimization related issues?

Re: MAC address using only DHCP probes

umahar — Tue, 18 Oct 2016 05:55:11 GMT

We want to reduce load on PSN since it is a huge cluster with high number of endpoints at each PSN.

We are only using profiling for IP Phones and IOT devices all of which have ISE PSNs as IP helper address in their respective VLANs and it might make sense to not profile workstations via Radius probes coming via other VLANs.

The idea is to profile only those endpoints which are coming via VLANs which need to be profiled.

Re: MAC address using only DHCP probes

Craig Hyps — Tue, 18 Oct 2016 06:20:15 GMT

If not implemented already in ISE 2.1, plan is to make RADIUS probe mandatory in future as best determinant when IP address is active and released from active session. If profiling load too high from enabling key probes, then need to review causes for load. For example, interim Accounting updates or session timers may be too frequent.

Re: MAC address using only DHCP probes

umahar — Tue, 18 Oct 2016 08:44:41 GMT

Thanks Craig and Hosuk.

Putting this thought to rest