Issue with Triggered Endpoint NMAP Scan for Canon Printers

[jitendrac]

We are currently facing an issue with the Triggered Endpoint NMAP Scan functionality on our Cisco ISE 3.3 deployment.

We are attempting to perform NMAP scans on Canon printer devices to obtain detailed information such as model and OS. These printers are configured with static IP addresses.

To enable this, we have taken the following steps:

• Enabled the NMAP probe on the PSN as per the ISE Profiling Design Guide (Cisco Community).

• Allowed all required NMAP ports from the PSN to the subnet range of the printer IPs.

• We are using the default Cisco-provided profiler policy for Canon devices: "Canon-Device", which has defulat condition with an NMAP action based on the OUI (refer to the attached screenshot for reference).

We are observing that

• The printer devices are successfully authenticating using MAB.

• The profiling policy "Canon-Device" is being matched correctly in the attribute filter.

Despite the above configuration:

• we do not observe any triggered NMAP scans.

• Attributes such as NmapScanCount and LastNmapScanTime are not being populated.

I would appreciate your assistance in identifying the root cause and helping us enable successful NMAP scans for these devices.

[jitendrac]

[andrewswanson]

Hi

Does a manual NMAP Scan show any open ports on the Canon printers? You mentioned that you'd checked that all nmap ports are permitted FROM the psn to printer - is the return traffic also permitted on any firewalls/ACLs?

hth

Andy

[jitendrac]

Manual NMAP works perfectly as expected. Not sure why it is not triggering an automatic NMAP scan 

I suspect that ISE PSN is not getting IP addresses to MAC binding information via RADIUS (Framed IP Address)

But I am not sure how to check on ISE if PSN is getting the IP addresses to the MAC binding information via RADIUS

[jitendrac]

Manual NMAP works perfectly as expected. Not sure why it is not triggering an automatic NMAP scan

I suspect that ISE PSN is not getting IP addresses to MAC binding information via RADIUS (Framed IP Address)

But I am not sure how to check on ISE if PSN is getting the IP addresses to the MAC binding information via RADIUS