topic Re: Cisco ISE detection wrong profiling and always show Xerox-Device in Network Access Control

Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Mon, 04 Aug 2025 09:59:05 GMT

Dear Cisco ISE lover,

I have inquiry refer to cisco ISE profiling detection which multi-domain mode on port configuration.
So we have wired with IP Phone and PC these two device is working properly, but in the live log we found another failed authentication with Xerox-Device on the same port which we don't use this xerox device, and also perform failed authentication every 15 minutes and OUI start from 00:00:00 .

While we go to profiling Policy this Xerox-Device is enable by Cisco default.
Question, what is any issue if we disable this Xerox-Device policy?

Thank you,

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

MHM Cisco World — Mon, 04 Aug 2025 10:13:10 GMT

Hi
can I see rule for this policy

MHM

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Mon, 04 Aug 2025 10:17:35 GMT

Here

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

MHM Cisco World — Mon, 04 Aug 2025 10:38:34 GMT

Mim certainty factor = 10

And each rule have certainty 10

So this policy will apply if any rule success'

Try make min 20 so force ISE take decisions depend on two rules not only one.

MHM

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

andrewswanson — Mon, 04 Aug 2025 13:30:54 GMT

Does the PC also have a wireless nic that it is configured to connect to a Xerox printer?

hth

Andy

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Tue, 05 Aug 2025 01:59:29 GMT

So, We don't need to disable the profiler policy, just to reconfigure for 20 of certainty factor ?

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Tue, 05 Aug 2025 02:00:39 GMT

Hi @andrewswanson There is no any Xerox used/connected in network.

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Tue, 05 Aug 2025 10:14:36 GMT

Any idea just to disable the profiler policy (Xerox-Device) or reconfigure certainty factor 20 ?
@MHM Cisco World

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

Rob Ingram — Tue, 05 Aug 2025 10:23:39 GMT

@oum-odom disabling the Xerox policy doesn't really solve the problem, if the Xerox policy is disabled it would be profiled as another device type. There appears to be a device that is being authenticated by ISE, have you investigated what other device is connected to that switchport? What does the output on the switchport tell you? What attributes have been learnt on the endpoint profile on ISE?

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

MHM Cisco World — Tue, 05 Aug 2025 10:55:38 GMT

I will go with op2

Change certainty to be 20 if one condition (10) have wrong detect device as Xerox' certainty need two conditions at least to apply policy.

MHM

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Tue, 05 Aug 2025 11:01:33 GMT

Hi @Rob Ingram
There is just only 2 devices, PC and Phone connected to switch port.
Regarding to profiler and certainty factor, does it cause to this issue?

What if I disable this profiling policy?

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

Rob Ingram — Tue, 05 Aug 2025 11:43:07 GMT

Hi @oum-odom it seems there is a problem as to why you are seeing this other authentication being sent to ISE. I don't see why disabling the Xerox profile would solve it, whatever is triggering this will just be profiled as something else, or an "Unknown device".

Could it be a dock or a misbehaving client?

Can you provide a screenshot of the live logs for that endpoint and the output from the switchport on the NAD itself please

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Wed, 06 Aug 2025 07:54:27 GMT

Hi @Rob Ingram @MHM Cisco World
At the same switch port, there are Xerox and unknown.
Kindly refer to figure below

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

MHM Cisco World — Wed, 06 Aug 2025 09:12:35 GMT

Context Visibility > Endpoints <<- see which profiling rule use for known device

MHM

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

Rob Ingram — Wed, 06 Aug 2025 09:26:02 GMT

@oum-odom have you checked the client devices? Are they running VMs on the workstations that are generating these MAC addresses?

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Wed, 06 Aug 2025 10:48:48 GMT

No any VMs.

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

Marcelo Morais — Thu, 07 Aug 2025 03:26:18 GMT

Hi @oum-odom

you are receiving different MACs on your NAD, port 34, with the following format 00:00:00:xx:xx (this is a MAC from Xerox).

Let's isolate the problem:

Remove the PC and keep the IP Phone ... check if ISE still receives the MAC from the Xerox device
Remove the IP Phone and keep the PC ... check if ISE still receives the MAC from the Xerox device

What is the result ?

Hope this helps !!!

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Thu, 07 Aug 2025 03:50:15 GMT

Hi @Marcelo Morais
Issue, It happens once Both IP Phone and PC working together.

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

oum-odom — Thu, 07 Aug 2025 10:44:08 GMT

What should we do next?

Re: Cisco ISE detection wrong profiling and always show Xerox-Device

MHM Cisco World — Thu, 07 Aug 2025 10:48:22 GMT

Context Visibility > Endpoints <<- see which profiling rule use for known device

MHM