Profiled w/out Probes on

[cpaquet]

Good afternoon,

MAC 00:0C:29:24:15:72 was entered from CWA through Device Registration by an AD user.  Eventually, this MAC address appeared in the Endpoint database as "VMWare-Device" (which it is) and static assignment FALSE (because it was entered via CWA).

How is it that ISE was able to profile it as a VMware, when there are no probe turned on ISE?  (profiler is not turned on)

Thank you.

Cath.

[Tarik Admani]

Cath,

When you drill down down to the endpoint attributes is there a probe that is associated with this entry?

Thanks,

Tarik Admani
*Please rate helpful posts*

[cpaquet]

No probe listed.  See attached.

[Tarik Admani]

Cath,

Missed your last response. Because the endpoint was added through device registration it must be present so that if the device is lost it will get assignrd as to the blacklist identity group.

The reason the device appears as a vmware device is that it still goes the profiling policies to see what type of device this. However this device was not profiled by any of the probes. However did the user end up connecting to the network and then accept the aup?  I am curious why it didn't end up being statically assigned as registered device.

[vikasyad]

Please review the below link which might be helpful  on your concerns:

http://www.cisco.com/en/US/solutions/collateral/ns340/ns414/ns742/ns744/docs/howto_30_ise_profiling.pdf

http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_prof_pol.html