Confusion about profiling on ISE

[SMD28316]

if a device is already being profiled, will it be profiled again if it has been rebooted? What would cause such behavior? as far as I know this shouldn't happen because it will cause PLUS license consumption issues, and for how long will a device be profiled on ISE? I know radius sessions take 120 hours to be cleared from ISE if no radius packets have been received by ISE.

[Dustin Anderson]

So, you will only use a license if you use profiling in rules. ISE profiles every endpoint, you can see that if the endpoint list. Now, I think licensing is consumed until the session is disconnected, or ISE purges the stale ones as you mentioned. About 5 days I believe.

[Arne Bier]

An endpoint will be profiled if there is a change in any of the attributes that have already been gathered through profiling. E.g. If there is a change of the IP address (e.g. new DHCP lease). It's unlikely that the endpoint will report different data in its DHCP Discovery packet. If you're profiling HTTP, then you might get dynamic results by using different browsers on the host - the user agent string might vary enough from browser to browser to cause profiling changes. 

What is the concern exactly? Did something happen that caused more license consumption, or did something go wrong in Policy Set processing?

If RADIUS Accounting is configured on the NAS (Start, Stop and Interim-Updates), then license consumption should be almost near real-time.

[Marcelo Morais]

Hi @SMD28316 ,

 at Work Centers > Profiler > Reports > Reports > Profiler Reports > Endpoint Profile Changes ... check the Endpoint Profile Changes, the Profile Time column and the Previous Profile Time column.

Hope this helps !!!