ISE 1.x profiler question (Network Scan Action & Exception Action)

[allen00874]

Could someone please explain the following based on this scenario:

Say you create a Profiler Policy called “DeviceBrandX” and you set the Minimum Certainty Factor to 20 and you create a condition to profile based on a check for condition based on host-name in DHCP and you assign the condition a Certainty Factor Increases of 10. In additoin you define an Exception Action and a Network Scan (NMAP) Action in the policy.
 
Here are the two questions:

If you create another condition that initiates a scan Network Scan (NMAP) Action to scan say for OS - how does the scan influence the Certainty Factor?

Also if you create a condition that initiates Exception Action - how does that influence the Certainty Factor?

Thanks,

Allen

[Tarik Admani]

The exception action should not affect the certainty factor it is triggered when a device matches the profiling policy. Take a look at the apple-device policy for reference. The main purpose is to trigger another action if the policy is to generic

Sent from Cisco Technical Support Android App

[allen00874]

Hey Tarik,

Thank you for the response; I have looked at the apple-device policy, I see that the “* Exception Action” field is = NONE. I only see that the Network Scan (NMAP) Action is set to OS-scan. In fact I have looked at all the generic policies and none have an “* Exception Action” field set.

I can see that under the Rules configuration you can set the rule to "Take Exception Action" but in the top part of the configuration the "* Exception Action” there is no selection option.

I am assuming if you wish to trigger and event you would identify the event in the “* Exception Action” field and under the rule you would select "Take Exception Action". How do you configure the “* Exception Action” to determine which Action to take?

Thanks,

Allen