topic Re: ISE Profiler and applying only the downloaded OUI Package... in Network Access Control

ISE Profiler and applying only the downloaded OUI Package...

rezaalikhani — Wed, 04 Sep 2024 16:38:42 GMT

Hi all;

We see in the ISE 2.7 release notes, the following statement:

If you have customized your profiler conditions and do not want the profiler feed to replace those conditions, you can manually download OUI updates without downloading the policy updates.

Now my question is that how is it possible updating profiler feed replace an "administrator-created" or "administrator-modified" profiling policy?

Thanks

Re: ISE Profiler and applying only the downloaded OUI Package...

ahollifield — Thu, 05 Sep 2024 11:00:31 GMT

It's not. I read this as if/when you use provided conditions nested with administrator custom profiling policies.

https://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/bulletin-c25-2943876.html

Re: ISE Profiler and applying only the downloaded OUI Package...

Arne Bier — Mon, 09 Sep 2024 22:09:01 GMT

Profiler Feed update will never update your administrator-created profiles. The administrator-modified profiles won't be updated either, because that is the case when a cisco-created profile is modified. This puts an update lock on that profile, which can be bad news. E.g. if you modify the Cisco provided Windows-Workstation, then it will prevent downloading updates for future versions of Windows that rely on that profile. I had a customer who modified a bunch of Cisco profiles and that killed the update process. The solution was to delete all the admin-modified profiles - when you do that, ISE will replace that profile with the original cisco-provided profile.

Not sure if that helps.

Re: ISE Profiler and applying only the downloaded OUI Package...

rezaalikhani — Tue, 10 Sep 2024 04:10:17 GMT

So, we can conclude that the mentioned Cisco's document is not correct. Right?

Re: ISE Profiler and applying only the downloaded OUI Package...

Arne Bier — Tue, 10 Sep 2024 07:05:40 GMT

What the documentation is saying, is that you can (or could ... since I have failed and now given up trying) download two separate files from ise.cisco.com/partner (or whatever the URL is/was) - one contains only the MAC OUI prefix mappings. And the other file contains the MAC OUI prefix mappings AND the Profiler Policy updates.

Document doesn't say what should/might happen to the administrator-* profiles.