Profiling with device-sensor and custom attributes

Doorahlek — Mon, 12 May 2025 15:01:10 GMT

Hello,

I am trying to do NAC for AP's 916x series and 913x series. However on some occasions the AP does not get added to Internal Endpoints and even if I add it it does not match the profiling policy. In auth report I can see it sending RADIUS attributes like cdpCachePlatform = cisco CW9164-E, however ISE seems to be ignoring it at times.

Strange thing is also that these AP's match Cisco-Meraki-Device as a top profile because of OUI contains "Meraki" and sometimes Cisco-Router because of the OUI. I was thinking of adding the MAC OUI addresses to the top Cisco-Access-Point profile but it is just not scalable as same models have different OUI MAC's at times.

Kindly checking for your help.

It will be very appreciated!

Re: Profiling with device-sensor and custom attributes

Doorahlek — Mon, 12 May 2025 15:09:36 GMT

It sends such TLV's. I even created a CUSTOMATTRIBUTE for profiling "cdp-tlv" contains CW916, but it does not seem to be matching as well

cdp-tlv	cdpCacheCapabilities=00:00:00:03
cdp-tlv	cdpCachePlatform=cisco CW9164I-ROW
lldp-tlv	lldpSystemCapabilitiesMap=00:04:00:04

topic Re: Profiling with device-sensor and custom attributes in Network Access Control

Profiling with device-sensor and custom attributes

Re: Profiling with device-sensor and custom attributes