How can we purge Endpoints who do not go into any Identity group ?

[raghchan]

We are performing guest authentications and we don't have profiling persona or license enabled.

Some users do not go with the Guest flow completely and end up in blank Endpoint group.

Can we purge them using Endpoint purge rules ? I know we can manually filter and delete them from Context visibility. Is there some other way to delete them automatically ?

Please note they are not going to Unknown group. The Identity group is Blank for these endpoints.

[Charlie Moreton]

This is covered here:

Endpoint purge policy for 'blank' Identity Group

[hslai]

ISE allows rules using conditions other than endpoint groups in the endpoint purge policy. Please use such with cautions as they would apply to all endpoints. 

[raghchan]

Can we have an automated way to remove MAC address which are in Blank Identity group.

If I create a Purge rule without any Identity group then it applies to all the MAC address which we do not want.

We can manually do it via Context visibility page but customer is not ready for that much manual task.

[hslai]

Endpoint purge policy for 'blank' Identity Group mentioned it related to the lack of ISE plus licenses. Please try recreating it and no using a customer db, because CSCve59024 is in U, and then re-opening the bug.

[raghchan]

I have tested this with custtomer backup and on fresh ISE node. Blank Identity group is something expected if Plus licence and Profiling is not there.

My customer does not want Plus license neither enable Profiling. Just want to remove this MAC addresses.

The bug is mentioned is something not related because when the detailed Endpoint is opened the Identity group is there as per the Bug description.

In lab with customer backup i am seeing blank groups only.

[hslai]

In that case, please open a fresh bug with all the details. AFAIK endpoints should be in "Unknown" instead of blank.

[hslai]

CSCvg46494, perhaps?

[raghchan]

Thanks. I think this is the bug.