ISE 2.2 Reprofiling After Adding New Profile Policies

[paul]

I am working on an install at a customer and I am showing them how to build out their profile policies as we learn stuff in monitoring mode.  We are running 2.2 patch 1.  Usually when I add new profile policies that have higher minimum certainty factors than the current matched profiles, ISE will run my new policies against the endpoints and reprofile them within minutes.  In this customer's case we have waited hours and they haven't reprofiled.  If I delete the MAC address from the Endpoint database and have it reauthenticate it will profile correctly into my new policies.

Has this behavior changed in 2.2?  I am going to test it in my lab today if I have time, but wanted to send out the question to the group.

Thanks.

[Timothy Abbott · Accepted solution]

That is still the behavior or ISE 2.2 when you modify profiling policy.  I just recently tested this in my lab and can confirm that is the case.

Regards,

-Tim

[paul]

So what would cause the deployment to not do that? I couldn’t find any settings the customer may have mistakenly turned off. I was sure in the other deployments I had done with 2.2 it still worked as well.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250

[Timothy Abbott]

Honestly, I'm not 100% sure since I know that if any of the profile policies are modified, ISE attempts to reprofile all endpoints it knows about.  If the behavior continues, I suggest reaching out to the TAC.

Regards,

-Tim

[Alex Martin]

Paul,

I am seeing this same behaviour with my deployment with a customer and I have not yet contacted TAC about the issue but will soon be submitting a case with them.  My deployment is 3 physical appliances that we upgraded from ISE 2.0 to 2.2 Patch 1.  If you find any more information out about the issue, could you please update this post so I know as well.  I will also update once we have had a chance for TAC to investigate.

Thanks,

Alex Martin

[paul]

I haven’t done more research on this yet. The devices eventually reprofiled, but it took some time. I know at least a half hour after I added the new profile rules they hadn’t changed, but when I worked with the customer the next day things had reprofiled.

I will let you know if I find anything else out.

Paul Haferman

Office- 920.996.3011

Cell- 920.284.9250