Profiler Services and Policies

What it is

Profiling is how ISE works out what kind of device an endpoint is, from the data it can see.

ISE collects clues, such as the MAC address, DHCP options and web browser details. It then compares them with a library of profiling policies. The best match becomes the endpoint profile, such as an IP phone or a printer.

How it works

Probes gather attributes, and profiling policies score them to pick a profile.

Enable the service

Profiling runs on the Policy Service Nodes. You turn it on for each PSN in the deployment page, and choose which probes that node uses. The path is Administration, System, Deployment, then edit the node.

Only nodes with the profiling service enabled collect the data. If you leave it off, endpoints are never profiled on that node.

Profiling policies

A profiling policy is a set of rules. Each rule is a condition on an attribute and a number that is added to the certainty factor when the condition matches.

The policies are in the Profiling pages of the ISE admin portal, and the exact menu location differs by release. They are arranged in a hierarchy, with general parents and specific children. For example, a generic device type has a child for a vendor, and that has a child for a model.

ISE picks the policy with the highest certainty factor, as long as that is at least the minimum for the policy. A more specific policy usually collects more points than a general one, so the specific match wins.

Endpoint identity groups

A policy can create a matching identity group for the endpoints it profiles. Policy rules can then match on the group or on the profile itself.

This is the link between profiling and access. A rule such as, if the endpoint profile is IP phone, then give the phone access profile, works without anyone listing MAC addresses.

The feed service

Cisco publishes updated profiling policies as a feed. ISE can download them on a schedule or on demand. This keeps the library up to date with new devices.

The feed is set under Administration, then the feed service. Online updates need internet access from the admin node. Without it, you can update from a downloaded package instead.

Custom policies

You can add your own policies for devices that the feed does not know. A custom policy needs one or more conditions that single out the device. A vendor MAC prefix is a common one, although it is a weak signal alone.

Avoid editing the policies that Cisco supplies. Copy a policy first and edit the copy, so a feed update does not overwrite your change.

Profiler settings

Global profiling settings include the type of CoA that ISE sends when an endpoint changes profile. The choices are no CoA, port bounce and reauthentication. You can also set the CoA type on an individual policy.

The next pages cover the probes and CoA in detail.

Using the results

The profile can be used in two main ways:

• In authorization policy: The rule matches an endpoint profile or its identity group and returns a profile, VLAN or ACL.
• In MAB: The profile identifies devices that have no supplicant, so you can give them the right access.

An endpoint that matches no policy is called unknown. A rule for unknown endpoints should give limited access and keep collecting data. When enough data arrives, the endpoint is reprofiled and a CoA applies the new result.

Verify

You can see the result in the live logs, in the endpoint list, and in the context visibility pages. The endpoint list shows the profile, the identity group and the attributes collected.

ise-psn/admin# show application status ise

Use the command to check that the ISE processes are running on the node. If the application is down, no probe can collect data.