Profiler

What this chapter covers

The profiler lets ISE learn what each device is, so that policy can treat printers, phones and laptops differently.

This chapter covers the profiling service and its policies, the probes that collect data, the CoA that applies a new result, and the endpoint identity management that keeps the database in order.

Profiling matters most for devices that cannot run a supplicant. These devices use MAB, and the profile tells ISE which access to give.

How the topics fit together

The pieces work as a loop that runs each time ISE learns something new about an endpoint.

The topics follow that loop:

• Profiler services and policies explain how attributes become a profile.
• Probes explain how the attributes get to ISE.
• CoA explains how a changed profile changes the live session.
• Endpoint identity management explains the groups, static assignments, the blocked list and purge.

Think of the chapter as one question asked many times. What is this device, and does the access it has now still fit? Probes give the evidence, policies make the judgement, and CoA applies it.

Keep an eye on the cost of each choice. More probes give better answers, but they add load to the nodes and sometimes to the network. A static assignment is certain, but it stops profiling from correcting a mistake.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

• What it is: the idea in plain words.
• How it works: the mechanism, with diagrams and example commands.
• What to remember for the exam: the facts to memorise.
• Common mistakes: the classic traps.
• Check yourself: three questions to test your understanding.

Read the pages in order. In a lab, enable the RADIUS and DHCP probes and watch a phone or a laptop move from unknown to a specific profile in the endpoint list.