Context Visibility and Docking Stations

[ryanbess]

As we've started to roll out ISE to more and more endpoints, we have started to see some odd behavior in context visibility.  The oddness seems to be related to docking stations where various endpoints throughout the day are using the same docking station.  Example, lets say we have a docking station of 11:24:9B:7A:C5:69 (as an example).  In the beginning of the day a windows endpoint plugs into the docking station.  ISE postures, profiles, and does all its prob stuff about the windows endpoint plugged into the docking station.  All this data is then fed into Context visibility.  The windows user unplugs and goes home.  At noon a mac user plugs into the same docking station and ise does all the same things.  If you then go look at the context visibility for that mac, you will see in some attributes saying the endpoint is windows, some saying it's a mac.  Go into applications you'll see some C:\program files\ XXXX and others like /Application/Cisco.

How do we prevent ISE from doing this.  Its like it just uses the mac address as the primary key and dumps all things under that mac and thus providing data in an odd way.     

[Rob Ingram]

@ryanbess Investigate enabling MAC Address Passthrough mode on the laptops, so that the MAC address of the laptops are used instead of the MAC address of the docking station.

[ryanbess]

Yeah thought of that but was hoping there was another way.  Not sure every laptop or OS will support it.  Have you had good luck with it?

[Rob Ingram]

@ryanbess Windows OS on DELL and Lenovo hardware works well, no idea about MacOS tbh.

[ryanbess]

i'll give it a shot.  My understanding was this required docking stations that supported mac passthrough....

[Greg Gibbs]

"Its like it just uses the mac address as the primary key and dumps all things under that mac"

This is exactly how it works. In most cases, ISE uses the MAC address as the key attribute in the database. It does not flush all of the Profiling attributes learned for a particular MAC address when a device disconnects, so you will see this behaviour with shared docks/dongles. It will only replace new profiling attributes learned for that same MAC address.

To avoid this, ISE would need to see a unique MAC address (or GUID) from the endpoint to keep the profiling data separate. AFAIK, only Windows laptops still support a unique burned-in MAC address that can be passed through on docks/dongles (assuming the dock supports it). Macbooks do not have any such burned-in Wired MAC address.

In addition, Macbooks do not send any useful profiling network information (like DHCP class identifier) that would replace the info previously learned from the Windows laptop.