License for ISE profiling feature

[minkumar]

Hi

  I am going to do voice phone authentication through MAB. I have heard that with te feature called profiling. ISE automatically collects the information of all the mac address of the VOIP phones (cisco as well as different vendor).

In order to enable the feature will I have to take Plus license or advance License and what will be the part number for it.

Minakshi

[mohanak]

If you are looking for Profiling then Plus License is enough, else if you want posture then u need advance License

http://ecm-bocs-blr-1.cisco.com:16001/bocs/servlet/ACS?command=read&version=2.0&docbaseid=0dcae1&objectid=090dcae185546c44&cacheid=ddgIAgA%3D%3Dg%2F8FgA%3D%3D&format=pdf&pagenum=0&signature=ft8sMRzWASpWJxd%2Fk14APD4B4jue83HhCO08FOrBhBNitBldo2%2FKn4zp...

Refer the link for the License SKU's:

http://ecm-bocs-blr-1.cisco.com:16001/bocs/servlet/ACS?command=read&version=2.0&docbaseid=0dcae1&objectid=090dcae185546c43&cacheid=ddgIAgA%3D%3Dgv8FgA%3D%3D&format=pdf&pagenum=0&signature=X5SC1s0W28EZbq5wa1KEjVwMG%2BivlNG88uo3aI%2Buv9M%2BhUMpBrhImugL...

[nspasov]

In addition to what Mohanak said, you can also use EAP-TLS 802.1x based authentication with your Cisco phones by utilizing the MIC (Manufacturer Installed Certificates). This will be cheaper and more secure. 

Thank you for rating helpful posts!

[bikespace]

If you are happy with manually loading the MAC addresses of the phones, then you can make do with base license. It's not the be all and end all of security, but if your policy just deploys a voice LAN and restricts access to that, then it reduces the risk. The phones will still have to register with callmanager before they will work.

[Venkatesh Attuluri]

if the device profiled condition is used in authorization policy then only plus/advanced license consumed