Cisco ISE detection wrong profiling and always show Xerox-Device

[oum-odom]

Dear Cisco ISE lover, 

I have inquiry refer to cisco ISE profiling detection which multi-domain mode on port configuration. 
So we have wired with IP Phone and PC these two device is working properly, but in the live log we found another failed authentication with Xerox-Device on the same port which we don't use this xerox device, and also perform failed authentication every 15 minutes and OUI start from 00:00:00 .   

While we go to profiling Policy this Xerox-Device is enable by Cisco default. 
Question, what is any issue if we disable this Xerox-Device policy?

Thank you, 

[oum-odom]

No any VMs. 

[Marcelo Morais]

Hi @oum-odom 

 you are receiving different MACs on your NAD, port 34, with the following format 00:00:00:xx:xx (this is a MAC from Xerox).

Let's isolate the problem:

1. Remove the PC and keep the IP Phone ... check if ISE still receives the MAC from the Xerox device
2. Remove the IP Phone and keep the PC ... check if ISE still receives the MAC from the Xerox device

What is the result ?

Hope this helps !!!

[oum-odom]

Hi @Marcelo Morais 
Issue, It happens once Both IP Phone and PC working together. 

[oum-odom]

What should we do next? 

[andrewswanson]

You said that the issue occurs once the PC is connected into the IP Phone?

In that case, does the issue occur when the PC connects directly into the switch (bypassing the phone)?

Do you have the same issue with other PC's and IP Phones on your network or is just this 1 PC? If its just one PC, check drivers applications installed on the PC

hth
Andy

[oum-odom]

Issue happen once the PC connect through IP Phone. 

[MHM Cisco World]

Context Visibility > Endpoints <<- see which profiling rule use for known device 

MHM

[oum-odom]

Profiling Policy detect is Xerox-Device. 

[MHM Cisco World]

Operations > Reports > Endpoints and Users > Endpoint Profiling Summary
please share screenshot and make mark to endpoint with issue 

thanks a lot 

MHM