Help Understanding Context Visibility

[DannyDulin]

Hello everyone.

We are using ISE version 3.1.0.518.

When I take a look at Context Visibility/Endpoint Classification is see over 900 endpoints that ISE sees.

I have created a profile policy that groups endpoints that are joined to our AD domain. I purge all the rest of the endpoints. However, they keep coming back. Within a day or so, the total endpoints grow to over 900 endpoints. 

If I don't have over 900 endpoints authenticating through ISE, why are these endpoints keep coming back?

I've even deleted endpoints that are categorized as Unknown, buth these still keep coming back. 

How do I permanently remove these endpoints that are most likely stale.

[Rob Ingram]

@DannyDulin are these random MAC addresses? (these change everytime). https://community.cisco.com/t5/security-knowledge-base/random-mac-address-how-to-deal-with-it-using-ise/ta-p/4049321

Typically you'd create a purge schedule to clear down these endpoints at regular intervals.

[DannyDulin]

Good question are they random? I'll start to keep track to determine. Thank you for the link.

I have the default purge rules in play. Any tips on best practices for tis.

[DannyDulin]

Rob, I did an export of all the endpoints. It appears that there are many duplications of endpoints, with different MAC addresses. There are duplicate hostnames with different MAC addresses. There are duplicate endpoint email addresses with different MAC addresses. There are duplicate endpoint IP addresses with different MAC addresses.

I also noticed that 2/3 of the endpoints ISE PAN 1 is the Endpoint Profile Server and 1/3 use IS PAN 2. Is this correct.

How do I know which is the right instance of an enpoint to purge?

This seems much more complex than I first expected. 

[ahollifield]

What are your use-cases for ISE?  Wireless?  Do you have guest wireless deployed on ISE?  What NADs are these MAC addresses showing connected to?

[DannyDulin]

The immediate use case 3 years ago was to upgrade from ACS -> ISE for VPN and Wireless AAA with the eye on leveraging posturing and profiling.

Good question whether we have Guest Wireless deployed on ISE. I do not think so, but that's something I'll verify.

Another good question NADs MACs are connected to. What would be the relevance here?

[Arne Bier]

In addition to what Rob and Adam have said, are you using Profiling and perhaps also running regular SNMP queries against your NAD devices (SNMP configured in the ISE Network Devices definitions)?  I have noticed that when I do that, ISE gets a dump of all the MAC addresses of switches, whether those MAC addresses are subject to NAC or not - it's a useful discovery method, but it can also pollute the Context Visibility.

[DannyDulin]

Good question Arne. It's quite possible. I'll check that too.

[DannyDulin]

I checked a sample of network devices and neither of them are configured for SNMP. Additionally, I do not have SNMP probes enabled.

[ahollifield]

So are these wireless MACs then? On a guest network? What NAD are they connected to?

Do you use the DHCP probe?

[DannyDulin]

Are these wireless MACs? - Mixed. As you know typically remote users are wireless who connect to our network via VPN and the NAD for those endpoints is our ASA. I should point out that VPN users are authenticated via Duo SSO and Authorized by ISE.

On prem users connect via Wired and Wireless. We are only authenticating the Wireless users via ISE and the NAD is WLC.

We are not utilizing ISE for Wired.

The DHCP probe is being used.

[ahollifield]

So if you take one of these "unknown" MACs what is it connected to?  The ASA VPN?  Wireless? 

Do you use ISE for guest wireless?  WLC?  AireOS or 9800? 

[DannyDulin]

Connected to both ASA VPN and WLC.

We are not using ISE for guest wireless.

The WLC is 5500.

[ahollifield]

So are those MAC addresses actual clients properly authenticating to your network?  Do you have a matching Live Log entry for these MAC addresses?  

[DannyDulin]

I ran a RADIUS authentications report for the last 3 weeks. Approximately 300 endpoints that have authenticated in this time frame match the overall inventory list.