CiscoISE - Profiling [MAB]

[acapit]

Hello there,

I am encountering this problem a lot when the Cisco ISE won't learn important information on a certain endpoint for example a printer, the information that the CiscoISE won't learn is

1) SysObjectID
2) SyObjectDesc

Now I need this information in order to do Profiling for certain MAB endpoints, anyone know what can cause this?

[Rob Ingram]

@acapit you need the SNMP Probe on the ISE nodes to learn the SysObjectID and SysObjectDesc. Here is the ISE profiling guide.

https://community.cisco.com/t5/security-knowledge-base/ise-profiling-design-guide/ta-p/3739456#toc-hId--1464449051

[acapit]

I forgot to mention that I do have an SNMP probe and everything is enabled just fine. The issue is more complicated than it seems.

Let's say I have a certain switch 2 printers (same model), On one printer I can get the SNMP information, and on the other one, I can't and I don't seem to understand why one printer works and the other one doesn't. Sometimes when I force the endpoint to re-authenticate it fixes the problem but I don't really see it as a solution and I want to find what causes the ISE to not get the required SNMP information

[Rob Ingram · Accepted solution]

@acapit the SNMP query probe will only perform a query for an endpoint every 24 hours.

You can also use NMAP to query the endpoint directly and profile the printer to learn those attributes, create a custom rule match on the vendor OUI then run a NMAP scan.

Device sensor configured on the switch might be sufficient to learn all the information you require.