topic Re: How is the profiling probe elected on ISE in Network Access Control

How is the profiling probe elected on ISE

SMD28316 — Tue, 16 Aug 2022 09:47:53 GMT

From the endpoint attributes in the context visibility, I can see DHCP attributes received, but I can't get the profiling to be via DHCP, as the endpoint source is always RADIUS probe, not DHCP, and before that it was active directory probe, it only changed when I disabled AD probe for the whole node, how can I control this behavior? I tested editing the profiling policies by adding DHCP probes but with no luck,

Re: How is the profiling probe elected on ISE

ahollifield — Tue, 16 Aug 2022 11:12:33 GMT

Is ISE actually receiving DHCP information? How are you sending the DHCP discover packets to ISE? DHCP Relay? Cisco Device Sensor?

Re: How is the profiling probe elected on ISE

SMD28316 — Tue, 16 Aug 2022 11:40:53 GMT

Yes, I can see them in the attributes tab and in packet captures, and I use device sensor.

Re: How is the profiling probe elected on ISE

Marcelo Morais — Tue, 16 Aug 2022 15:57:48 GMT

Hi @SMD28316 ,

ISE shows the last Probe "used", in other words, if you are using DHCP, AD and RADIUS Probe but the last Probe "used" (Endpoint attribute received by ISE) is RADIUS, then RADIUS is the Probe that you see.

To use a DHCP Probe:

1st use the ip helper-address command point to ISE

2nd at Profiling Policies (Work Centers > Profiler) double check your DHCP Expressions, for ex.:

DHCP:dhcp-class-identifier CONTAINS xxx
DHCP:hostname CONTAINS xxx

Hope this helps !!!

Re: How is the profiling probe elected on ISE

Arne Bier — Tue, 16 Aug 2022 20:18:04 GMT

I normally go by the "Total Certainty" factor to verify that ISE has selected the profiling policies that I was expecting. Perhaps running an Endpoint Trace would show the exact workings of the ISE Profiling Engine? Delete the endpoint, start the endpoint debug and then look through the detailed logs.