I've been developing and testing some new IBNS 2.0 configurations on a 3850 with 16.6.6/16.9.3a and came across some odd behavior/interaction with device sensor and the automated tester. I have a TAC case open on this (SR# 687085849), and I am trying to determine if this is the expected behavior or a bug. I have asked TAC but have not heard back, so anyone know if it should behave this way?
What I have found is that when "automate-tester username NAD-Tester ignore-acct-port probe-on" is added to the radius server configuration, learned device sensor attributes that appear in the cache do not get forwarded to ISE.
If I use "automate-tester username NAD-Tester probe-on", removing the "ignore-acct-port", then device sensor attributes show up in ISE, doesn't seem like it should act this way.
Radius server example where device sensor data is not sent
radius server ISE-VIP-A
address ipv4 10.1.1.1 auth-port 1812 acct-port 1813
pac key xxxxxxxxxxx
automate-tester username NAD-Tester ignore-acct-port probe-on
Radius server example where device sensor data is forwarded as expected
radius server ISE-VIP-A
address ipv4 10.1.1.1 auth-port 1812 acct-port 1813
pac key xxxxxxxxxxx
automate-tester username NAD-Tester probe-on
This is the same as configured in the ISE Secure Wired Access Prescriptive Deployment Guide, so quite a few deployments could have this issue and not even realize their profiling is hindered.
https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515
