topic Re: ISE - WIFI Profiling Issue in Network Access Control

ISE - WIFI Profiling Issue

M_alamin — Tue, 22 Jul 2025 18:32:33 GMT

HI trying to do profiling using MAB over WIFI, i had created initial non-profile auth policy that has ACL from WLC (5508) that allows only DHCP, DNS and IP to ISE PSN, device are hitting this auth profile but keep in unknown state if i hange auth profile to permit access they got profiled successfully which is off course very risky attached is copy of ACL created on WLC knowing my ISE ip is 10.50.3.20 and 10.50.3.30

Re: ISE - WIFI Profiling Issue

MHM Cisco World — Tue, 22 Jul 2025 19:04:21 GMT

Sorry ypu use profiling mac or using mab authc ?

I need more detail please

MHM

Re: ISE - WIFI Profiling Issue

ahollifield — Tue, 22 Jul 2025 19:29:53 GMT

https://www.cisco.com/c/en/us/products/collateral/wireless/5500-series-wireless-controllers/eos-eol-notice-c51-740221.html

https://cs.co/ise-berg#profiling

What probes are you using on ISE? Is your feed service up to date? What version of ISE? Do you have RADIUS Profiling enabled on the WLAN?

Re: ISE - WIFI Profiling Issue

M_alamin — Tue, 22 Jul 2025 20:04:41 GMT

Ise is 3.3 wlc is 8.5 all profiling probe enable on ise as well as dhcp and http under radius under wlan

Re: ISE - WIFI Profiling Issue

ahollifield — Tue, 22 Jul 2025 20:20:40 GMT

Ok so do you actually have DHCP relay configured? Is ISE actually seeing any profiling data? Is the profiling feed service up to date? What patch version of ISE? What exact version of 8.5? You really need to look at getting off of the 5508z

Re: ISE - WIFI Profiling Issue

M_alamin — Tue, 22 Jul 2025 20:47:45 GMT

Ok wil look at all of that but can you please advice if the acl is correct or its wrong

Re: ISE - WIFI Profiling Issue

ahollifield — Tue, 22 Jul 2025 21:17:40 GMT

I mean I have no idea what you are trying to accomplish with that. Why HTTP? Why a permit all?

Re: ISE - WIFI Profiling Issue

MHM Cisco World — Tue, 22 Jul 2025 21:30:42 GMT

He want I think make scan of device connect to his network using ISE profiling probe

He dont use this profiling for any authc.

@M_alamin

Check live log' see if there is any dhcp/dns packet receive from wlc.

MHM