Solved: ISE profiling not working

Stv_666 · ‎08-27-2020

Hi,

I'm configuring profiling for bunch of Yealink IPPhones, the only thing significant they have is OUI from MAC address and this value I would like to use to profile them. I have configured porfiling policy catching OUI by name but ISE constantly classifying them as Unknown devices. Please take a look at attched configuration screens and let me know if I'm doing something wrong ?

BR

Mike.Cifelli · ‎08-27-2020

Your issue could be the fact that you are referencing 'IP-Phone' as the parent policy. I have had this issue before. In order to match a child profile, the endpoint must match all parent policies. I would suggest removing the parent policy, or identifying general attributes that will allow you to match on the parent policy to then match and get profiled on your manual child policy.

See this for further detail: https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456

HTH!

View solution in original post

Mike.Cifelli · ‎08-27-2020

Your issue could be the fact that you are referencing 'IP-Phone' as the parent policy. I have had this issue before. In order to match a child profile, the endpoint must match all parent policies. I would suggest removing the parent policy, or identifying general attributes that will allow you to match on the parent policy to then match and get profiled on your manual child policy.

See this for further detail: https://community.cisco.com/t5/security-documents/ise-profiling-design-guide/ta-p/3739456

HTH!

Stv_666 · ‎08-27-2020

Thanks Mike - that was exactly the case !!!