ISE - Which is first, profiling or posturing?

[muthumohan]

Hi,

I am wondering, if both profiling and posturing is enabled on ISE, which happens first? My guess is profiling, but I could not find any Cisco document that says how this works?

Also, one more question, during client provisioning, the ISE must know the OS of the client, so that I can download the appropriate agents. So, how does ISE learn about the OS of the client? I don't think RADIUS passes this info.

Any clarification on this would be appreciated and must be pretty basic. But I am unable to find any document to prove this.

Appreciate any help.

REgards,

Mohan         

[Marcin Latosiewicz]

Mohan,

Profiling can be done based on multipe factors, easiest way is to read user agent when user connects to a portal :-)

There are also configurable actions on ISE:

What kind of scenario are you thinking about to evaluate which is done before?

Although from logic point of view, it might make sense to evaluate what you're dealing with (profiling) before you decide whether's it's fit to access your network (posture assessment). :-)

M.

[Tarik Admani]

I have seen deployments where posturing was a requirement and profiling was not. Radius is one of the "probes" that are used by ISE in order to capture the MAC address which leads ISE to making a determination on the OUI. The http probe is what will give you a better understanding of the OS and much like Marcin mentioned is what ISE uses in order to present the user with the proper agent software.

Another example of this is also similar to how Anyconnect is downloaded for mac or windows based devices for SSL VPN

Sent from Cisco Technical Support iPad App

[Saurav Lodh]

I totally agree with Tarik ,what he says  “Radius is one of the "probes"  that are used by ISE in order to capture the MAC address which leads  ISE to making a determination on the OUI. The http probe is what will  give you a better understanding of the OS ..” is correct