topic Re: ISE Profiling Switch Configuration in Network Access Control

ISE Profiling Switch Configuration

InfraISE2020 — Tue, 20 Oct 2020 10:16:14 GMT

Hi all,

We are looking at implementing ISE profiling and we have a question around DHCP probes/switch configuration.

As you can see from the attached images, we current run DHCP on a windows server and the firewall interface is set to relay to this server. Our understanding is that for DHCP probes to work we need an IP Address Helper configured on an SVI for each VLAN, so on that basis do we set the IP address helper IPs to the firewall interface IP and the ISE server or direct to the windows DHCP server and the ISE server and turn off IP relaying on the firewall?

Thanks in advance.

Re: ISE Profiling Switch Configuration

Mohammed al Baqari — Tue, 20 Oct 2020 10:41:37 GMT

That is a design question and its really up to you on where to set them.
SVIs are good to do this however you need to allow dhcp communication on
the firewall. Otherwise put the relay on the firewall and no need for
additional rules.

I suggest to try device sensor in your switches instead of attempting
different probes for profiling as it gives more consolidated information.

**** please remember to rate useful posts

Re: ISE Profiling Switch Configuration

Aref Alsouqi — Wed, 21 Oct 2020 15:58:46 GMT

I would add another DHCP Relay on the firewall pointing to ISE, that should do the trick.

Re: ISE Profiling Switch Configuration

Peter Koltl — Thu, 22 Oct 2020 21:50:41 GMT

Don’t.

Device sensor provides DHCP info among others without unscalable relaying.