Hi All
I'm having some issues with ISE profiling Cisco IP Phones correctly. I setup an authorization policy to allow any Cisco IP Phone on the network. However the policy is not getting any hits because the IP phones are being detected as Cisco-Device and the deny rule is being used instead. It used the Radius probe to determine the endpoint classification.
I followed the Cisco Profiling guide and setup DHCP probe which includes the ip helper address on the SVI. I can confirm that ISE is getting copies of the DHCP requests as ISE is now populated with quite a few endpoints on the network. Additionally I did a packet capture on the IP phone's port and verified that when it makes the DHCP request, the hardware identifier includes the string that ISE is checking to verify it is a Cisco IP Phone.
If I change the authorization policy to allow the "Cisco-Device" condition, it works and ISE gets all the information for the phone down to the exact model using the DHCP probe. I verified this in the profiler endpoint classification. Additionally I have the profiling settings configuration set to re authenticate.
As a work around, I enabled SNMP query and set the timer to 600 secs (minimum allowed) to poll the switch. This used CDP to determine that it was an IP phone and allowed it on the network. However this only polls every 10 mins which is a significant delay to allow the device. I also enabled SNMP traps with link up and link down to initiate a polling but this did not help any it seems.
Is there a way to create an authorization policy to allow the device on the network temporarily so that it will get all the device profiling info, then once it is verified as a Cisco IP phone to move it to another authorization profile? Or is there an easier way of doing this?
I definitely don't want to use MAB and have to manually allow mac addresses. That's the reason for trying to get the profiling working.
ISE version: 2.4 Patch 9
IOS: 16.6.6 Catalyst 3650
ISE Policy:
If Condition:Endpoints:EndpointPolicy EQUALS Cisco-Device:Cisco-IP-Phone
Result: Cisco_IP_Phones - Voice VLAN and permit permissions
Switch configs:
aaa new-model
aaa authentication login default group radius local
aaa authentication enable default enable group radius
aaa authentication dot1x default group radius
aaa authorization exec default local group radius
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting auth-proxy default start-stop group radius
aaa accounting dot1x default start-stop group radius
aaa accounting system default start-stop group radius
aaa server radius dynamic-author
client x.x.x.x server-key 7 xxxxxxxxxxx
server-key 7 xxxxxxxxxxx
aaa session-id common
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
!
radius server ISE01
address ipv4 x.x.x.x auth-port 1812 acct-port 1813
key 7 xxxxxxxxxxxxx
interface GigabitEthernet1/0/1
switchport access vlan 100
switchport mode access
switchport voice vlan 50
authentication event server dead action authorize
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
mab
dot1x pae authenticator
dot1x timeout tx-period 10
spanning-tree portfast
spanning-tree bpduguard enable
IP Phone Packet Capture.
Frame 6: 594 bytes on wire (4752 bits), 594 bytes captured (4752 bits) on interface 0
Ethernet II, Src: Cisco_a7:0a:2e (34:a8:4e:a7:0a:2e), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
802.1Q Virtual LAN, PRI: 3, DEI: 0, ID: 80
Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255
User Datagram Protocol, Src Port: 68, Dst Port: 67
Dynamic Host Configuration Protocol (Discover)
Message type: Boot Request (1)
Hardware type: Ethernet (0x01)
Hardware address length: 6
Hops: 0
Transaction ID: 0x00003198
Seconds elapsed: 0
Bootp flags: 0x8000, Broadcast flag (Broadcast)
Client IP address: 0.0.0.0
Your (client) IP address: 0.0.0.0
Next server IP address: 0.0.0.0
Relay agent IP address: 0.0.0.0
Client MAC address: Cisco_a7:0a:2e (34:a8:4e:a7:0a:2e)
Client hardware address padding: 00000000000000000000
Server host name not given
Boot file name not given
Magic cookie: DHCP
Option: (53) DHCP Message Type (Discover)
Option: (61) Client identifier
Option: (12) Host Name
Option: (60) Vendor class identifier
Length: 38
Vendor class identifier: Cisco Systems, Inc. IP Phone CP-7962G
Option: (55) Parameter Request List
Option: (255) End
Padding: 000000000000000000000000000000000000000000000000…
