Dear Cisco TME/BU
Most of my confusion/frustration with ISE seems to revolve around my lack of understanding of how endpoints work. Don't get me wrong - I know that I can create Endpoint Identity Groups for my guest types and I use this for my Sponsored Guest flows (MAB/Remember Me).
The problem I have is that my endpoints table is growing and I don't know why.
Our production deployment is fairly small right now and we are in a luxurious position to be able to keep an eye on this thing while it's relatively quiet to study its behaviour. Once we unleash the monster (i.e. total ACS to ISE migration) I want to sleep easy knowing that ISE is doing the right thing. My ACS system is handling hundreds of thousands of auths per day.
I have a look at the Context Visibility almost on daily basis and I can't see the real information that I need to see (i.e. my guest users). I have exported the Endpoint database from the PAN and played with Excel filters to try understand why I have more noise than real data here. The Endpoint Analysis Tool in my opinion doesn't help me at all - I have downloaded and installed version 2.0.2 - seems like an abandoned tool. And the reports contain nothing new, other than haphazard blank lines that make a mess of the resultant .csv file. What is the real point of that tool?
I have asked this before and I will ask again (maybe someone at CiscoLive 2018 Melbourne can give a tech workshop on this 
?)
Can we please have a deep-dive session from the Experts on how ISE treats Identities, and how one is supposed to interpret the Exported Endpoint database from the PAN?
This file seems to contain key information behind the workings of ISE and how the network behaves.
I am mainly confused about the three topics below, given the fact that I don't have Profiling enabled on any of my PSN's - and using ISE 2.3 patch 1
Authentication Identity Store
What I think I know: These are internal data structures that the user cannot control (add/delete endpoints) but that the user can refer to in his Authentication policies.
What I don't know: Why do I see null values "blank" in this column? Or often times I see entries with 'Guest Users', or even AD domains?
Identity Group
What I know: This is what I (Admin) can influence and I put the MAC addresses in these Groups for my Policy Set logic.
What I don't know: Why does ISE assign values to this Group (e.g. Workstation, Android, Profiled, etc)?
Endpoint Profile
What I think I know: This is used when you have profiling enabled on PSN's - since I don't use profiling, I expected this to be blank
What I don't know: What does ISE use this for when Profiling is disabled? It contains all sorts of random information - nothing makes sense.
As far as I know, an endpoint can only be in one Identity Group at a time - makes sense.
Accepted Solutions
