07-13-2022 05:50 AM
Hi all,
i'm facing a problem with Profiling and device sensor. In particoular, using show device-sensor cache all command i see that some stranger values are appended in front of the expected value. The figure shows the output.
Proto Type:Name Len Value
DHCP 60:class-identifier 9 3C 07 79 65 61 6C 69 6E 6B
DHCP 12:host-name 10 0C 08 53 49 50 2D 54 32 33 47
DHCP 55:parameter-request-list 18 37 10 01 02 03 04 06 07 0C 0F 1C 2A 42 43 2B 64
65 78
DHCP 61:client-identifier 9 3D 07 01 00 15 65 E5 7A 51
LLDP 7:system-capabilities 6 0E 04 00 24 00 24
LLDP 6:system-description 13 0C 0B 34 34 2E 38 34 2E 30 2E 31 34 30
LLDP 5:system-name 10 0A 08 53 49 50 2D 54 32 33 47
LLDP 2:port-id 9 04 07 03 00 15 65 E5 7A 51
CDP 6:platform-type 8 00 06 00 08 54 32 33 47
CDP 5:version-type 15 00 05 00 0F 34 34 2E 38 34 2E 30 2E 31 34 30
CDP 4:capabilities-type 8 00 04 00 08 00 00 00 90
CDP 2:address-type 17 00 02 00 11 00 00 00 01 01 01 CC 00 04 AC 1D 07 C5
CDP 1:device-name 20 00 01 00 14 54 32 33 47 30 30 31 35 36 35 45 35
Referring to LLDP port-id field, i expect to see only the MAC address of the device. Instead there are 3 bytes "04 07 03" in front of the actual MAC address. Due to this problem i cannot use the Ports ID starts with condition in ISE for profiling. While using contains condition it works.
Capturing packets i don't see these extra bytes. Does someone knwos where they come from and how can i resolve this problem in ISE?
Thanks
Solved! Go to Solution.
07-14-2022 01:11 PM
I added port-id to the filter-list for LLDP in one of our lab switches and I got a similar value as yours that started with "04 07 03". However, ISE profiler got only the MAC address and showed it as the value for lldpPortId. By enabling DEBUG on profiler, the debug log profiler.log also giving the same evidence.
2022-07-14 17:43:50,470 DEBUG [RADIUSParser-1-thread-1][] cisco.profiler.probes.radius.RadiusParser -::::- Parsed IOS Sensor 1: lldpPortId=[03:3c:fd:fe:8b:39:59]
"04 07 03" seems likely representing the types of the identifiers and my guess is that the values representing the subtypes as in the LLDAP MIB:
LldpPortIdSubtype ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"This TC describes the source of a particular type of port
identifier used in the LLDP MIB.
The enumeration 'interfaceAlias(1)' represents a port
identifier based on the ifAlias MIB object, defined in IETF
RFC 2863.
The enumeration 'portComponent(2)' represents a port
identifier based on the value of entPhysicalAlias (defined in
IETF RFC 2737) for a port component (i.e., entPhysicalClass
value of 'port(10)'), within the containing chassis.
The enumeration 'macAddress(3)' represents a port identifier
based on a unicast source address (encoded in network
byte order and IEEE 802.3 canonical bit order), which has
been detected by the agent and associated with a particular
port (IEEE Std 802-2001).
The enumeration 'networkAddress(4)' represents a port
identifier based on a network address, detected by the agent
and associated with a particular port.
The enumeration 'interfaceName(5)' represents a port
identifier based on the ifName MIB object, defined in IETF
RFC 2863.
The enumeration 'agentCircuitId(6)' represents a port
identifier based on the agent-local identifier of the circuit
(defined in RFC 3046), detected by the agent and associated
with a particular port.
The enumeration 'local(7)' represents a port identifier
based on a value locally assigned."
SYNTAX INTEGER {
interfaceAlias(1),
portComponent(2),
macAddress(3),
networkAddress(4),
interfaceName(5),
agentCircuitId(6),
local(7)
}
If you are still seeing this issue, please engage Cisco TAC to troubleshoot.
07-14-2022 01:11 PM
I added port-id to the filter-list for LLDP in one of our lab switches and I got a similar value as yours that started with "04 07 03". However, ISE profiler got only the MAC address and showed it as the value for lldpPortId. By enabling DEBUG on profiler, the debug log profiler.log also giving the same evidence.
2022-07-14 17:43:50,470 DEBUG [RADIUSParser-1-thread-1][] cisco.profiler.probes.radius.RadiusParser -::::- Parsed IOS Sensor 1: lldpPortId=[03:3c:fd:fe:8b:39:59]
"04 07 03" seems likely representing the types of the identifiers and my guess is that the values representing the subtypes as in the LLDAP MIB:
LldpPortIdSubtype ::= TEXTUAL-CONVENTION
STATUS current
DESCRIPTION
"This TC describes the source of a particular type of port
identifier used in the LLDP MIB.
The enumeration 'interfaceAlias(1)' represents a port
identifier based on the ifAlias MIB object, defined in IETF
RFC 2863.
The enumeration 'portComponent(2)' represents a port
identifier based on the value of entPhysicalAlias (defined in
IETF RFC 2737) for a port component (i.e., entPhysicalClass
value of 'port(10)'), within the containing chassis.
The enumeration 'macAddress(3)' represents a port identifier
based on a unicast source address (encoded in network
byte order and IEEE 802.3 canonical bit order), which has
been detected by the agent and associated with a particular
port (IEEE Std 802-2001).
The enumeration 'networkAddress(4)' represents a port
identifier based on a network address, detected by the agent
and associated with a particular port.
The enumeration 'interfaceName(5)' represents a port
identifier based on the ifName MIB object, defined in IETF
RFC 2863.
The enumeration 'agentCircuitId(6)' represents a port
identifier based on the agent-local identifier of the circuit
(defined in RFC 3046), detected by the agent and associated
with a particular port.
The enumeration 'local(7)' represents a port identifier
based on a value locally assigned."
SYNTAX INTEGER {
interfaceAlias(1),
portComponent(2),
macAddress(3),
networkAddress(4),
interfaceName(5),
agentCircuitId(6),
local(7)
}
If you are still seeing this issue, please engage Cisco TAC to troubleshoot.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide