topic Re: Confusion about profiling on ISE in Network Access Control

Confusion about profiling on ISE

SMD28316 — Mon, 30 Aug 2021 08:43:18 GMT

if a device is already being profiled, will it be profiled again if it has been rebooted? What would cause such behavior? as far as I know this shouldn't happen because it will cause PLUS license consumption issues, and for how long will a device be profiled on ISE? I know radius sessions take 120 hours to be cleared from ISE if no radius packets have been received by ISE.

Re: Confusion about profiling on ISE

Dustin Anderson — Mon, 30 Aug 2021 16:23:10 GMT

So, you will only use a license if you use profiling in rules. ISE profiles every endpoint, you can see that if the endpoint list. Now, I think licensing is consumed until the session is disconnected, or ISE purges the stale ones as you mentioned. About 5 days I believe.

Re: Confusion about profiling on ISE

Arne Bier — Mon, 30 Aug 2021 22:03:29 GMT

An endpoint will be profiled if there is a change in any of the attributes that have already been gathered through profiling. E.g. If there is a change of the IP address (e.g. new DHCP lease). It's unlikely that the endpoint will report different data in its DHCP Discovery packet. If you're profiling HTTP, then you might get dynamic results by using different browsers on the host - the user agent string might vary enough from browser to browser to cause profiling changes.

What is the concern exactly? Did something happen that caused more license consumption, or did something go wrong in Policy Set processing?

If RADIUS Accounting is configured on the NAS (Start, Stop and Interim-Updates), then license consumption should be almost near real-time.

Re: Confusion about profiling on ISE

Marcelo Morais — Tue, 31 Aug 2021 01:26:47 GMT

Hi @SMD28316 ,

at Work Centers > Profiler > Reports > Reports > Profiler Reports > Endpoint Profile Changes ... check the Endpoint Profile Changes, the Profile Time column and the Previous Profile Time column.

Hope this helps !!!