cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
505
Views
0
Helpful
2
Replies

Should I be using the SNMP probe?

Josh Morris
Level 3
Level 3

I am currently using the Radius probe mostly, as my NADs use device-sensor to send most profiling data. I do have the SNMP probe enabled, but I'm not sure how to verify that I am actually getting useful information from SNMP. It seems that the biggest part of the probe is me having to clear the alarms everyday from devices that aren't able to reply to SNMP requests. 

 

Edit: I do see frmo one of Craig Hyps presentations that SNMP Query and Device Sensor gather the same endpoint attributes, and they shouldn't be used together. Can anyone think of a reason why I would continue using the SNMP query probe?

1 Accepted Solution

Accepted Solutions

hslai
Cisco Employee
Cisco Employee

SNMP probe also queries network devices periodically and gathers the ARP cache for devices or endpoints regardless they are authenticated to the network with sessions in ISE. Device sensor, depending on the IOS trains and IBNS 1 or 2 style, might be able to configure to gather these additional endpoints.

View solution in original post

2 Replies 2

The more probes you have the better profiling results you get. However as a
general rule trying to avoid snmp and netflow unless you see lot of wrong
profiled endpoints and you get better results with snmp. device sensor
combines cdp, lldp and dhcp which usually good enough.

To see the source probe for your profiling, context visibility > endpoints
> select endpoint > attribute > endpointsource. This field shows the source
of profiling

**** Remember to rate useful posts

hslai
Cisco Employee
Cisco Employee

SNMP probe also queries network devices periodically and gathers the ARP cache for devices or endpoints regardless they are authenticated to the network with sessions in ISE. Device sensor, depending on the IOS trains and IBNS 1 or 2 style, might be able to configure to gather these additional endpoints.