We are noticing that some of our MAB (MAC Authentication Bypass) devices, primarily printers, are intermittently losing their static endpoint group assignments in Cisco ISE and reverting to the default or "Unknown" profile. We have already verified that purging is not the cause, as the affected endpoints are consistently connected to the network. Given our complex environment, we suspect that the auto-profiling mechanism in ISE might be overwriting the static group assignments. We’ve raised a TAC case, but Cisco is requesting debug logs—which poses a challenge since we are not sure exactly when the issue is occurring. We are looking for best practices or configuration recommendations to prevent static endpoint groups from being overwritten, and to ensure persistent group assignments for MAB devices like printers. Any guidance on preventing dynamic profiling from interfering with static settings, or recommended policy configurations, would be appreciated.
