topic printer profiling error. in Network Access Control

printer profiling error.

engahmedsaied — Mon, 11 Mar 2019 06:14:12 GMT

I have this printer HP LaserJet P4015 Printers

has a PTR and I can ping -a on its ip and it response with its name.domain name

but I can't get this printer in its profile I get it just as hp_device

my condition is ip:FQDN contain domain name

it works with other printers and other same problem

I notice that this printer comes through SNMP trap probe (EndPointSource).

so please help

When you look at the

kurmai — Thu, 12 Nov 2015 23:01:19 GMT

When you look at the attributes list for this printer endpoint, do you see in any of the attributes containing P4015? ISE relies on SNMP:hrDeviceDescr attribute to know the type of this printer. You mentioned that the printer comes from SNMP trap probe, do you see this attribute on this endpoint?

in this photo all attributes

engahmedsaied — Fri, 13 Nov 2015 14:28:49 GMT

in this photo all attributes on end point.

yea the SNMP trap probe doesn

kurmai — Fri, 13 Nov 2015 16:12:05 GMT

yea the SNMP trap probe doesn't provide enough information. You will need the NMAP network scan for HP printers. For NMAP scan to happen, ISE needs to first learn the IP address of the printer via the Framed-IP RADIUS attribute. This attribute is only sent in Accounting Start messages from the switch, and switch will only send that if the printer's authentication gets an "Access-Accept". In other words, ISE should permit access for the new printer when it first authenticates, but sends a DACL with limited access. Once ISE knows the IP address of the printer, it will send a NMAP query to the printer directly, followed by SNMP query which contains the hrDeviceDescr attribute.

The reason for this not working can be pretty complex and requires real time troubleshooting, so feel free to open a tac case.

Hi,

Vivek Ganapathi — Tue, 24 Nov 2015 05:44:23 GMT

Hi,

Are you having any other modes of profiling enabled on the PSNs? For example : DHCP? If the printer is configured for DHCP, then the DHCP profiling can be enabled on the ISE. Certain DHCP attributes like DHCP-client-identifier / class-identifiers are helpful to determine the exact model of the Printer.

Regards

Vivek