topic Cisco ISE profiling Issue in Network Access Control

Cisco ISE profiling Issue

IMG USA — Sun, 26 Jan 2020 06:45:27 GMT

Hi All,

We are using ISE v2.2 for radius authentication of endpoints. Everything is working fine. Except in one Switch where Cisco VOIP 3905 is used. These devices are not authenticating with ISE and taking the Data domain instead of voice. By statically adding the VOIP mac in the IP-Phone group in ISE, It is working fine. Kindly help on this.

VOIP model

Re: Cisco ISE profiling Issue

Muhammad Awais Khan — Sun, 26 Jan 2020 09:04:53 GMT

Hi,

On the switch access port which is connected to phoneport, what authentication mode you are using ? The recomended mode to use phone and data together in same port is multi-domain.

Interface gi0/x

Authentication host-mode multi-domain

Multi-domain—While in this mode, the authenticator will allow one host from the data domain and one from the voice domain; this is a typical configuration on switchports with IP phones connected.

Re: Cisco ISE profiling Issue

Damien Miller — Mon, 27 Jan 2020 05:03:49 GMT

A few things to check.
Is the phone showing up in the cdp neighbors?
Are you using the radius device sensor for profiling?
Are the correct profiling attributes showing up in the device sensor cache?

Re: Cisco ISE profiling Issue

Jason Kunst — Mon, 27 Jan 2020 17:02:02 GMT

@IMG USA wrote:

Hi All,

We are using ISE v2.2 for radius authentication of endpoints. Everything is working fine. Except in one Switch where Cisco VOIP 3905 is used. These devices are not authenticating with ISE and taking the Data domain instead of voice. By statically adding the VOIP mac in the IP-Phone group in ISE, It is working fine. Kindly help on this.

VOIP model

Did you check the prescriptive wired guide