topic Re: Ise profiling in Network Access Control

Ise profiling

kp-tkr2014 — Wed, 08 Jul 2020 10:29:38 GMT

Hi,

How to check any profiling policies applied in ISE.

If I say when this mac adders device 00-14-22-01-23-45 is accessing assign vlan x ,Can we consider this as profile ?

Thanks

Re: Ise profiling

Marvin Rhoads — Wed, 08 Jul 2020 10:49:35 GMT

Profiling is making a decision about a device identity based on observed characteristics and behavior.

Assigning a MAC address to a VLAN is not profiling by itself it it's done by virtue of the MAC address being statically assigned to an endpoint group.

If we inspect the MAC address of unknown devices to see if the first 6 bytes indicate and HP Printer OUI and then dynamically decide it's an HP printer and put it in the printer VLAN automatically as a result then it's profiling. (as an example)

We can profile by turning the feature on at our PSN(s) and optionally customizing profiling policies.

Only if we use the profile outcome in an Authorization result is Plus licensing required.

Re: Ise profiling

kp-tkr2014 — Wed, 08 Jul 2020 13:51:28 GMT

Hi,

Can we consider the attached as part of profiling which is under "standard authorization profile "

Thanks

Re: Ise profiling

Marvin Rhoads — Wed, 08 Jul 2020 19:32:46 GMT

No, that's not profiling.

Re: Ise profiling

Greg Gibbs — Thu, 09 Jul 2020 01:30:45 GMT

See the ISE Profiling Design Guide for info on what Profiling is and how it works.

Re: Ise profiling

hslai — Thu, 09 Jul 2020 23:06:57 GMT

Marvin is right about this.

NAD profiles are to support third-party. More info, see ISE Third-Party NAD Profiles and Configs