If you query an existing endpoint using ERS, you'll notice the profileId and the groupId shown are the IDs and not the names:
$ curl --insecure --header 'Content-Type:application/json' --header 'Accept: application/json' --user admin:C1sco12345 --request GET https://198.18.133.27:9060/ers/config/endpoint/64bc07c0-4745-11e8-b11d-005056b84efe
{
"ERSEndPoint" : {
"id" : "64bc07c0-4745-11e8-b11d-005056b84efe",
"name" : "D8:EB:97:A2:51:2C",
"mac" : "D8:EB:97:A2:51:2C",
"profileId" : "3ab41d70-8c00-11e6-996c-525400b48521",
"staticProfileAssignment" : true,
"groupId" : "43ee0260-4744-11e8-b11d-005056b84efe",
"staticGroupAssignment" : true,
"portalUser" : "",
"identityStore" : "",
"identityStoreId" : "",
"link" : {
"rel" : "self",
"href" : "https://198.18.133.27:9060/ers/config/endpoint/64bc07c0-4745-11e8-b11d-005056b84efe",
"type" : "application/xml"
}
}
}
If you want to create a new endpoint with a profile or group, you will need to use these long, ugly IDs. 8-)
Let's assume you want to create a new endpoint that is a Cisco 7975 IP Phone ...
Find your Endpoint Group groupId:
$ curl -insecure --header 'Content-Type:application/json' --header 'Accept: application/json' --user admin:C1sco12345 --request GET https://198.18.133.27:9060/ers/config/endpointgroup?filter=name.CONTAINS.Phone
{
"SearchResult" : {
"total" : 1,
"resources" : [ {
"id" : "14f5cac0-8c00-11e6-996c-525400b48521",
"name" : "Cisco-IP-Phone",
"description" : "Identity Group for Profile: Cisco-IP-Phone",
"link" : {
"rel" : "self",
"href" : "https://198.18.133.27:9060/ers/config/endpointgroup/14f5cac0-8c00-11e6-996c-525400b48521",
"type" : "application/xml"
}
} ]
}
}
Find your Profiler Profile 'Cisco-IP-Phone-7975' :
$ curl --insecure --header 'Content-Type:applicatin/json' --header 'Accept: application/json' --user admin:C1sco12345 --request GET https://198.18.133.27:9060/ers/config/profilerprofile?filter=name.CONTAINS.7975
{
"SearchResult" : {
"total" : 1,
"resources" : [ {
"id" : "1abef670-8c00-11e6-996c-525400b48521",
"name" : "Cisco-IP-Phone-7975",
"description" : "Policy for Cisco IP Phone 7975",
"link" : {
"rel" : "self",
"href" : "https://198.18.133.27:9060/ers/config/profilerprofile/1abef670-8c00-11e6-996c-525400b48521",
"type" : "application/xml"
}
} ]
}
}
Put it all together to create your new Endpoint :
$ curl --include --insecure --header 'Content-Type:applicaton/json' --header 'Accept: application/json' --user admin:C1sco12345 --request POST https://198.18.133.27:9060/ers/config/endpoint --data '
{
"ERSEndPoint" : {
"description" : "New 7975 IP Phone from ERS API",
"mac" : "00:11:22:33:44:55",
"profileId" : "1abef670-8c00-11e6-996c-525400b48521",
"staticProfileAssignment" : true,
"groupId" : "14f5cac0-8c00-11e6-996c-525400b48521",
"staticGroupAssignment" : true
}
}'
HTTP/1.1 201 Created
Set-Cookie: JSESSIONIDSSO=4D57D1F5D5ECDD34C68B47ED00054D9A; Path=/; Secure; HttpOnly
Set-Cookie: APPSESSIONID=7D66A263CF7A2E8D0A25C7EEE36406BD; Path=/ers; Secure; HttpOnly
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: https://198.18.133.27:9060/ers/config/endpoint/fe283830-474e-11e8-b11d-005056b84efe
Date: Mon, 23 Apr 2018 23:35:23 GMT
Content-Type: application/json;charset=utf-8
Content-Length: 0
Server:
Verify it was created using the Location header above :
$ curl --insecure --header 'Content-Type:application/json' --header 'Accept: application/json' --user admin:C1sco12345 --request GET https://198.18.133.27:9060/ers/config/endpoint/fe283830-474e-11e8-b11d-005056b84efe
{
"ERSEndPoint" : {
"id" : "fe283830-474e-11e8-b11d-005056b84efe",
"name" : "00:11:22:33:44:55",
"description" : "New 7975 IP Phone from ERS API",
"mac" : "00:11:22:33:44:55",
"profileId" : "1abef670-8c00-11e6-996c-525400b48521",
"staticProfileAssignment" : true,
"groupId" : "14f5cac0-8c00-11e6-996c-525400b48521",
"staticGroupAssignment" : true,
"portalUser" : "",
"identityStore" : "",
"identityStoreId" : "",
"link" : {
"rel" : "self",
"href" : "https://198.18.133.27:9060/ers/config/endpoint/fe283830-474e-11e8-b11d-005056b84efe",
"type" : "application/xml"
}
}
}
And if you look at it in ISE you should see it created :
Hi Thomas, thanks for answering. While I'm completely able to run your examples here and get the same results I still can't see the EndPoint Profile in the Identity Management->Groups tab.
I'm going to check now whether it actually matters for enforcing policy. But anyway do you have an idea for why is that?
And again, in the future I'd like to overrun a profile chosen by ISE for a specific device with my of my own profiles. Will it be possible?
(Just for reference for other people who might run these commands, notice that some have little typos and since cURL fails silently it's a bit hard to notice (like "applicaton/json").)
