topic CiscoISE - Profiling [MAB] in Network Access Control

CiscoISE - Profiling [MAB]

acapit — Sat, 30 Dec 2023 17:19:43 GMT

Hello there,

I am encountering this problem a lot when the Cisco ISE won't learn important information on a certain endpoint for example a printer, the information that the CiscoISE won't learn is

1) SysObjectID
2) SyObjectDesc

Now I need this information in order to do Profiling for certain MAB endpoints, anyone know what can cause this?

Re: CiscoISE - Profiling [MAB]

Rob Ingram — Sat, 30 Dec 2023 18:03:21 GMT

@acapit you need the SNMP Probe on the ISE nodes to learn the SysObjectID and SysObjectDesc. Here is the ISE profiling guide.

https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId--1464449051

Re: CiscoISE - Profiling [MAB]

acapit — Sat, 30 Dec 2023 19:06:17 GMT

I forgot to mention that I do have an SNMP probe and everything is enabled just fine. The issue is more complicated than it seems.

Let's say I have a certain switch 2 printers (same model), On one printer I can get the SNMP information, and on the other one, I can't and I don't seem to understand why one printer works and the other one doesn't. Sometimes when I force the endpoint to re-authenticate it fixes the problem but I don't really see it as a solution and I want to find what causes the ISE to not get the required SNMP information

Re: CiscoISE - Profiling [MAB]

Rob Ingram — Sat, 30 Dec 2023 19:29:37 GMT

@acapit the SNMP query probe will only perform a query for an endpoint every 24 hours.

You can also use NMAP to query the endpoint directly and profile the printer to learn those attributes, create a custom rule match on the vendor OUI then run a NMAP scan.

Device sensor configured on the switch might be sufficient to learn all the information you require.