topic Re: ISE Profiling Conflict in Network Access Control

ISE Profiling Conflict

hpeters34 — Thu, 17 Jul 2025 13:11:00 GMT

Hi all,

I’m relatively new to Cisco ISE, and I’m running into a profiling challenge I could use some help with.

We have an existing deployment of Device A that authenticates via MAB and is correctly profiled using a custom policy. I’ve now been tasked with deploying several newer models of Device A, but I’ve discovered that these models are now manufactured by the same vendor that produces Device B, which already exists in our environment and is profiled under a different policy—also using MAB.

Since both devices now share the same OUI, the newer Device A units are being misprofiled under the Device B policy.

Question:

Is there a way to continue using MAB for these newer Device A models while ensuring they are properly profiled separately from Device B—despite the shared OUI? Would leveraging additional profiling attributes (e.g., hostname via DHCP, CDP/LLDP, or custom DHCP fingerprinting) be the best route?

Any suggestions on best practices or rule order within the profiling policy would be much appreciated.

Re: ISE Profiling Conflict

MHM Cisco World — Thu, 17 Jul 2025 13:21:40 GMT

in profiling policy you can specify multi condition point for each condition
for example
profiling policy A get 40 points
profiling policy B get 60 points
then ISE will use policy B

both policy run in same time

MHM

Re: ISE Profiling Conflict

hpeters34 — Thu, 17 Jul 2025 15:00:30 GMT

Thanks for the reply.

I added an additional condition using DHCP hostname for the condition. When I run sh auth sess it shows the Device-Type as Un-classified and Status- Unauthorized.

Re: ISE Profiling Conflict

MHM Cisco World — Thu, 17 Jul 2025 15:40:11 GMT

live log <<- check dhcp packet (if you use dhcp ip helper)
check if dhcp send hostmane and how hostname is assign
is it mac or hostname+domain

MHM

Re: ISE Profiling Conflict

hpeters34 — Thu, 17 Jul 2025 20:08:40 GMT

thanks for the reply.

I found out that I had to add the correct profile to the authorization policy.

For the conditions I used dhcp_host-name matching ^device A-1234.*

Thanks for your help

Re: ISE Profiling Conflict

MHM Cisco World — Thu, 17 Jul 2025 20:29:33 GMT

You are so welcome

MHM