04-29-2015 07:20 AM - edited 03-10-2019 10:41 PM
I'm curious what is the logic in ISE 1.3 when more than one probe report different information for an endpoint. Say an endpoint with a MAC address got identified, and next it gets two different IP addresses for the same MAC from DHCP probe and maybe from SNMP CDP cache probe? Which one will it prefer? It appears that maybe it takes the last probe updated received regardless of the probe, is that correct?
Solved! Go to Solution.
05-04-2015 12:23 AM
Profiling attributes are constantly collected and stored in the ISE database. One attributed is not preferred over the other. Instead, it is the profiling rules that decide how a device is profiled. More specifically, Profiling rules with higher Certainty Factor are preferred over the others. For instance, a device is profiled as a "Cisco Phone" with a CF=10. Later on, more attributes are collected, and now ISE has enough information to match a Profiling Rule for Cisco-IP-Phone-7945 with CF=30. As a result, the device will be profiled as a Cisco-IP-Phone-7945.
I hope this helps!
Thank you for rating helpful posts!
05-04-2015 12:23 AM
Profiling attributes are constantly collected and stored in the ISE database. One attributed is not preferred over the other. Instead, it is the profiling rules that decide how a device is profiled. More specifically, Profiling rules with higher Certainty Factor are preferred over the others. For instance, a device is profiled as a "Cisco Phone" with a CF=10. Later on, more attributes are collected, and now ISE has enough information to match a Profiling Rule for Cisco-IP-Phone-7945 with CF=30. As a result, the device will be profiled as a Cisco-IP-Phone-7945.
I hope this helps!
Thank you for rating helpful posts!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide