Profiling Probes

What it is

A probe is a way for ISE to collect attributes about an endpoint.

Each probe listens for a different kind of data, or asks for it. The more varied the data, the more accurate the profile. You enable probes on the Policy Service Node, and you also configure the network so the data reaches the node.

How it works

You pick the probes, then arrange for each kind of data to arrive.

Probe summary

RADIUS probe

This probe needs no extra setup, because ISE already receives RADIUS. It learns the MAC address from the calling station ID. If the switch includes the Framed IP address, ISE also learns the IP address.

On a switch you can ask for more attributes in the request.

Switch(config)# radius-server attribute 8 include-in-access-req
Switch(config)# radius-server vsa send accounting

DHCP probe

The DHCP request holds some of the best data for profiling. It shows the requested options, the vendor class and the host name.

Switches forward DHCP requests to the DHCP server with a helper address. You add the PSN as an extra helper address on the client VLAN interface.

Switch(config)# interface Vlan10
Switch(config-if)# ip helper-address 10.1.5.5
Switch(config-if)# ip helper-address 10.1.1.11

The first address is the DHCP server. The second is the PSN, which listens and does not answer.

HTTP probe

The user agent in a browser request often names the operating system and the device type. ISE can get it from the redirect traffic that already goes to the PSN for web authentication. It can also get it from mirrored traffic.

SNMP probes

The SNMP query probe polls a switch for data such as the CDP and LLDP neighbours on a port. It needs the network device to have an SNMP community or credentials set in ISE, and the switch has to allow the PSN to query it.

The SNMP trap probe reacts to a change. A switch sends a trap when a new MAC address appears or leaves. ISE then queries the switch for the details.

Switch(config)# snmp-server community SNMPCOMM RO
Switch(config)# snmp-server enable traps mac-notification change move
Switch(config)# snmp-server host 10.1.1.11 version 2c SNMPCOMM mac-notification
Switch(config)# mac address-table notification change

Device sensor

A switch can collect profiling data itself, using the device sensor. It watches DHCP, CDP and LLDP packets and sends the data to ISE in RADIUS accounting. This needs no mirrored traffic.

A full setup also needs filter lists that choose which fields are sent, so check the platform guide.

Switch(config)# device-sensor accounting
Switch(config)# device-sensor notify all-changes

NMAP and other probes

The network scan probe runs NMAP against an endpoint to guess its operating system and open services. It sends traffic, so use it sparingly. You can run it as an action from a policy, so only certain endpoints are scanned.

The DNS probe looks up the host name for an IP address. The Active Directory probe reads data about a domain member. The NetFlow probe collects flow records, and these are heavy, so only use it where you need it.

Choosing probes

A good start is RADIUS, DHCP and device sensor or SNMP. Add the HTTP probe for more detail on user devices. Add the others only where the first set gives a poor result.

Verify

On ISE, open the endpoint in the context visibility pages, and look at the attributes. If DHCP data is missing, the helper address is not set, or the DHCP probe is off on that PSN. On the switch, check the helper address.

Switch# show running-config interface Vlan10