Showing results for 
Search instead for 
Did you mean: 
Choose one of the topics below to view our ISE Resources to help you on your journey with ISE

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.


Purge endpoints which are not part of a Identity Group

Hi All,

Since we are running ISE version 2.1 we are seeing a huge increase of the amount of learned endpoints.

After investigation it looks like these are endpoints are/were connected to our hotspot SSID but the user didn't accept the AUP.
As soon as a user accept the AUP the endpoint becomes a member of an endpoint identity group which we purge at certain times.

Because the solution is implemented in more than 150 high density locations we're facing about more 20000 endpoints this month which are not part of a scheduled purge operation.

We tried to create a purge policy including never purge rules for certain endpoint Identity groups and one general purge rule which did not have an endpoint identity group as condition. This policy was purging the 'unkown' endpoints but also the endpoints which are member of an endpoint group to which a never purge policy is be applied.

Does anyone see a solution for this?

Thanks in advance,

Jan-Willem Molenaar