topic Re: ISE 3.1P5 Multiple Configuration Changed Errors in Network Access Control

ISE 3.1P5 Multiple Configuration Changed Errors

ChuckMcF — Mon, 17 Apr 2023 12:05:35 GMT

After upgrading to ISE 3.1P5 we are receiving multiple errors like this:

ISE Alarm : Info : Configuration Added: Admin=internal-feed-user; Object Type=OUI; Object Name=58:C4:1E

Alarm Name : Configuration Changed

Details : Configuration Added: Admin=internal-feed-user; Object Type=OUI; Object Name=58:C4:1E

Description : ISE configuration is updated

Severity : Info

Suggested Actions : Check if the configuration change is expected

*** This message is generated by Cisco Identity Services Engine (ISE) ***

Sent By Host :

These messages appear to be manufacturer's OUIs to the ISE configuration and seem to be harmless. It just seems odd to be getting so many post upgrade. Was wondering if anyone can confirm if this is expected of 3.1? Also wondering if it may just be an alert that was enabled post upgrade that I should turn off.

Appreciate any thoughts,

ChuckMcF

Re: ISE 3.1P5 Multiple Configuration Changed Errors

ahollifield — Mon, 17 Apr 2023 12:42:28 GMT

This is the ISE Profiling Feed service and are normal to see as Cisco releases updates to the profiling feed.

https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId--517419129

https://www.cisco.com/c/en/us/td/docs/security/ise/3-1/admin_guide/b_ise_admin_3_1/b_ISE_admin_31_asset_visibility.html?bookSearch=true#ID1738

Re: ISE 3.1P5 Multiple Configuration Changed Errors

ChuckMcF — Mon, 17 Apr 2023 12:58:19 GMT

Thank you - perfect. Can you explain how to turn off the email alerts for these messages?

TIA
ChuckMcF

Re: ISE 3.1P5 Multiple Configuration Changed Errors

ahollifield — Mon, 17 Apr 2023 13:19:52 GMT

Administration -> System -> Settings -> Alarm Settings. Note that disabling this will disable alerting for ALL configuration changes, not just those made by the Profiler Feed Service.