Question about ISE MAC Database

[Terence Lockette]

Hello all,

I hope I have the right board but wanted to ask a question about where ISE stores the MAC database for endpoints detected by ISE?  Is this database part of the config backup file, operational backup file, or neither?

[martin.fischer · Accepted solution]

Hi @Terence Lockette 

The MAC address database is part of the configuration data backup.

The configuration data backup also includes the application-specific and ADE operations system configuration data.

The operational data backup includes log / monitoring data.

Keep in mind, that certificates are NOT included in either backup.

[Terence Lockette]

Hi @martin.fischer 

I was afraid of that.  We are moving from version 2.3 to 2.7 and have rebuilt the entire system from the ground up rather than restoring from backup.  The reason for this is due to the bugginess of ISE 2.3 so we didn't want to risk bringing in something to the new build.  However, I've decided to let the new VMs rebuild the MAC database until we're ready to put it into production.

Thanks for your response.

[martin.fischer · Accepted solution]

You could export the MAC addresses from the 2.3 environment to a CSV file if you want to keep them. Then put the MAC addresses and other information which you want to keep in the CSV import template and import them to the 2.7 environment.

[Terence Lockette]

Will this contain all MAC addresses whether manually entered as well as learned by ISE?

[Damien Miller · Accepted solution]

If you do it through the GUI Context Visibility "export all" option, or from the PAN CLI "application configure ise" option 16 "get all endpoints", it will include all endpoints as well as their group memberships among other things. 

The export and import follow different templates though so keep that in mind, you can't just export the endpoints and import the same CSV. You need to download the template from the Context Visibility endpoint import page and transpose some columns. Blank cells will be ignored. 

[Terence Lockette]

Ahhhh ok.  Thanks for that insight!  I will wait til the day we are ready to cut over before exporting/importing.

Thanks all!