ISE 1.3 Chromebook profiling

[robertbrink1]

Hi,

We are connecting our Chromebooks directly to a dot1x network with MSChapv2, and have no CWA/Client Provisioning policy defined for this network. The "problem" with this is that there is no ACL redirecting traffic to the ISE, and thus doesnt snap up the IP_UserAgent. 

Has anyone else tried to profile Chromebooks another way?

Thanks!

[nspasov]

Hi Robert-

I have not played with Chromebooks before but there should be some other attributes that you can use to profile the device. Can you:

1. Tell me what profiling probes you have enabled

2. Post a screenshot/document that shows all of the details about the endpoint

3. What are the Chrombooks being profiled as 

Thank you for rating helpful posts!

[robertbrink1]

Hi Neno,

1) We have enabled DHCP, HTTP, RADIUS, NMAP, DNS, SNMPQuery. 

2) The problem here is that there are different vendorversions of the Chromebook, so different OUI's. The one Im testing on is a Samsung XE303C12. 

User-Agent Mozilla/5.0 (X11; CrOS armv7l 6680.24.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.41 Safari/537.36

3) Unknown Device. But if we redirect the chromebook to the ISE, we can profile it using IP_UserAgent (contains CrOS). 

I've tried to run Nmap (not with ISE), to find something unique with the Chromebook, without any good result. 

This is what I've done now.. 

* Made a new Authorization Profile with CWA redirection to a hotspot page with no AUP. 

* Defined a new Authorization Polilcy. If Unknown and Wireless 802.1x then -> redirect the device to the hotspot success page. 

This will profile the Chromebook using the UserAgent. I dont find this the best solution, but it may work for now. But if anyone else has a better way to profile a chromebook, I would love to hear it. :)

[nspasov]

Ugh, if it is only profiled as "uknown" then we don't have many other options. I do like your idea about a CWA policy tied to the unknown devices. 

Btw, do you have the WLCs configured for HTTP and DHCP profiling?

Thank you for rating helpful posts!

[robertbrink1]

Yep, I've tried that as well. But i dont find the 3x50 to have so many profile-sets. 

Its beeing profiled as Unknown there as well btw. 

Thanks anyway. Then the solution for now is to redirect all unknown devices to a "success" page (hotspot) so that different UserAgents-profile policies can run. :)