Profile via MAC OUI check with ISE

[Y C]

We have had an authorization policy for years now in ISE that says If HP-Printer result = Printer Vlan. This has worked for us relatively well.

We recently got an HP printer that uses a different OUI. Apparently there's some issue with our profiler service update fetching... in the meantime while that's being worked on I created a manual condition that looks for the specific characters within the mac.

I added this condition to the existing HP-Printer profile (If <condition> then <increase certainty by 10>). The condition for some reason isn't met and certainty factor isn't increased - the device gets tagged as unknown with certainty factor of zero.

If I create a new device profile (instead of using HP-Printer) and use the very same condition, and then create a new authorization profile to match the device profile, it matches and gets assigned the right vlan. I don't understand why the same condition is met in one profile but not the other.

[Damien Miller · Accepted solution]

The reason lies in a single line that is easily overlooked. The Cisco provided "HP-Printer" profile is attached to a parent profile as indicated by "Parent Policy: HP-Device".

You must first match the "HP-Device" profile before being evaluated to match the "HP-Printer" profile. You would have to add the OUI to the "HP-Device" profile.

In the mean time you may also want to look in to requesting access to the manual profile feed. You can download it manually and upload it to ISE in the GUI.  

[Y C]

Yep, I'm on day 1 of the 2 day wait for the manual profile feed.

I knew HP-Printer was under HP-Device, but I guess I didn't realize you had to be in one before you could be in the other. I'm not sure why this printer won't even be picked up by HP-Device, perhaps it will be once I fetch the update.

I put my condition in HP-Device, Then in HP-Printer, then put my profile within HP-Printer. Whew that was a workout. Thankyou!

[Damien Miller]

It's pretty common with new MAC address OUIs, ISE either won't have a hex to OUI name mapping, or it doesn't match the name for some reason such as an acquired company with a new MAC range.