ISE ability to report wired endpoint switch address.

[pacavell]

Would it be true that ISE requires Radius probes be enbled in order to report on what switch port a wired endpoint is connected to?

[Jason Kunst · Accepted solution]

RADIUS probes should always be enabled. They are by default and include lots of good information. Especially on Cisco switching with Device Sensor support.

What switching platform are you looking into?

[pacavell]

3650 (16.6.3) and 2960X (15.2(2)E9)

[Jason Kunst]

OK this is natively send in RADIUS device sensor and ISE RADIUS probe is on by default

See wired guide here for more information
https://community.cisco.com/t5/security-documents/ise-secure-wired-access-prescriptive-deployment-guide/ta-p/3641515#toc-hId--983402517

[Arne Bier]

Hey @Jason Kunst - I think this question has been answered before, but do you know for definite whether the Device Sensor data contained in Radius Accounting packets is processed by any PSN node running "Session Services", but where the the "Profiling Service" is NOT enabled?  

[kthiruve · Accepted solution]

Arne,

Great question. Session services internally generates syslog (UDP 30514) and RADIUS probe listens to it and parses attributes from syslog. So if you dont turn on profiling then information will be gathered by PSN but it will not be used towards profiling an endpoint.

-Krishnan

[IPTel Solutions]

If I had a base license to play around with then I could test this conclusively.

1. Build a fresh ISE 2.4 node and leave it on eval license
2. Enable Session Service
3. Enable Profiling Service
4. Apply Base License and delete all eval licenses (so that only Base license remains)

What happens next? Does Profiling remain on, or does the Service get automatically disabled (because I no longer have a Plus license)?

I was always under the impression that Radius Accounting is processed by the PSN Radius profiling probe regardless of whether Profiling Service is enabled (Craig Hyps once mentioned that in an earlier posting somewhere).  I don't understand the connection with SYSLOG and why the Radius Probe processes SYSLOGs?  Is it just me or is this stuff cryptic and confusing ?

How can I get an eval Base-Only license (30 day expiry or whatever)?