ISE MAB Authentication issue

[yaoqishi]

 hi,I  meet a issue with ISE MAB authentication.

I try to use MAB authentication.

When I connect the new device such as workstation,ISE will profiled it automatically and move it to the endpoint  identify group.

 I use endpoint identify group to authentic the MAB request.

So the device will successfully authentic . 

I try to disable the profile service and the device will move to unknow ,but it still authenic successfully.

Any soultion 

[Saurav Lodh]

Yes it would be authenticated as the mac entry is there in internal endpoints as unknown. You can delete the mac from there. Also do the below in authentication policy.

If authentication failed	REJECT
If user not found	REJECT
If process failed	DROP