MAC address using only DHCP probes

[umahar]

Are MAC addresses learnt if we only enable DHCP probes on a PSN and configure ISE PSN as helper address ?

We want to profile Polycom phones which uses OUI based policy. However to optimize the ISE cluster we are exploring if we can disable Radius probes on PSN and only enable DHCP probes.

[howon]

Yes certainly possible, however, it is still recommended to use RADIUS probe especially if you are authenticating the endpoints with MAB/802.1X. I haven't found any reason not to use RADIUS probe, is there any specific reason that you believe RADIUS probe is causing optimization related issues?

[umahar]

We want to reduce load on PSN since it is a huge cluster with high number of endpoints at each PSN.

We are only using profiling for IP Phones and IOT devices all of which have ISE PSNs as IP helper address in their respective VLANs and it might make sense to not profile workstations via Radius probes coming via other VLANs.

The idea is to profile only those endpoints which are coming via VLANs which need to be profiled.

[Craig Hyps · Accepted solution]

If not implemented already in ISE 2.1, plan is to make RADIUS probe mandatory in future as best determinant when IP address is active and released from active session.  If profiling load too high from enabling key probes, then need to review causes for load.  For example, interim Accounting updates or session timers may be too frequent.

[umahar]

Thanks Craig and Hosuk.

Putting this thought to rest