Feed Policies Questions (ISE 2.4, Patch 13)

[AlfredBanks4414]

Good morning.

I have a question regarding "skipped" feed policies with Cisco ISE.

Feed Version 1,2,3 policies downloaded.
Total number of feed polices to apply are 19.
Feed policies total 19 skipped.
Feed policies warning message : Apple-Device has been changed by admin.
Apple-TV has been changed by admin.
Apple-iDevice has been changed by admin.
Apple-iPad has been changed by admin.
Cisco-IP-Phone has been changed by admin.
Macintosh-Workstation has been changed by admin.
Microsoft-Workstation has been changed by admin.
Nokia-Windows-Phone has been changed by admin.
OS_X-Workstation has been changed by admin.
Windows10-Workstation has been changed by admin.
Windows7-Workstation has been changed by admin.
Windows8-Workstation has been changed by admin.
WindowsXP-Workstation has been changed by admin.
Workstation has been changed by admin.

Based on my research, when a profile policy is modified, ISE will “skip” the profiles that were “Administrator Modified”. My question is, how can we see what was skipped for each profile?

Clicking the above link takes you to:

I see the “feed” email showing “OUIs” updated which would be for the above image, but not any "skipped" policies.

My concern is these other "feed" updates” that have been skipped from Cisco Feed Service may eventually include important profiling updates for say a “Macintosh Workstation” or a “Windows8-Workstation” that ISE will miss due to the modifications. I’d like to keep the custom profiling policies but have the ability to “view” what Cisco was trying to add/modify.

To add, we have a project underway to move to ISE 3.1, patch 1 in the next few months (which may give more insight?).

Thanks for any assistance you can provide.

[Arne Bier]

Hi @AlfredBanks4414 

Great question. The answer probably lies in a log somewhere - I usually check this link and then enable the logging for the relevant issue I am looking into. Do a bit of investigating while the profile update happens

I am not 100% sure but since the profiler feed update from Cisco only concerns itself with the MAC OUI updates/additions, then I would assume it won't add those MAC OUIs into ISE. e.g. Apple-TV would include MAC OUI checks for known Apple MAC prefixes - if Apple adds a new MAC OUI and ISE skips it, then I assume ISE wouldn't add it to the database. It would be good to have more clarity on this.

[hslai]

If you may install another ISE instance, then check the profiler policies there.

Else, I would suggest copying the admin-modified policies with new names and give them more certainty factors. Then, deleting the admin-modified ones so they would go back to what provided by Cisco.