ISE 2.3.0.298 P3 - EndPoint Devices Automatically Re-Added to Blacklist Identity Group

[moyersc]

We're running ISE 2.3.0.298 P3 with Primary/Secondary Administration, Policy, and Monitoring nodes in a VMWare environment.

We manually add MAC addresses to the Blacklist Identity Group in order to quarantine non-compliant Windows workstations.  This process has been working fine until several weeks ago we discovered MAC addresses manually removed from the Blacklist would re-add themselves within several hours.

According to the guides we perform all updates from the Primary Node Application Node so not sure why the Blacklist is behaving this way.

Thank you,

Scott Moyer

[kthiruve · Accepted solution]

I am not sure what is the impact of the action you described in your network. Whether ISE is allowing non-compliant devices etc.  Please call TAC if you still have issues.

-Krishnan

[moyersc]

As I stated initially, we MANUALLY add/remove non-compliant devices from the Blacklist....there is no automatic blacklisting in place at this time.

The impact is that some systems are, for some reason, adding themselves back to the Blacklist (thereby disconnected from the network) after we MANUALLY remove them.  This ONLY happens to systems that were previously in the BLACKLIST group before.