OUI "Unknown" in EndPoint Profile ISE

[ALFONSO MONEO VILORIA]

Hello all,

we have several ISE 2.0.1.130 authenticating clients from 2 Cisco Anchor Controllers. We have noticed lots of clients are showed as "Unknown" in the ISE Endpoint Profile OUI field.

We have enabled ISE Feed Services and we have checked it is downloading periodically new OUIs and Profiles succesfully so we don't know why OUI appears as "Unknown". We have checked those MACS are included in the "oui.txt" file of ieee.org.

Any idea in order to correct this behaviour? We need to identify MACS correctly.

Thanks and regards!

Alfonso

[ognyan.totev]

Are you include this option in WLC WLAN. And for profiling you need plus license.

[ALFONSO MONEO VILORIA]

Yes, Ognyan. I'm including both options in Anchors.

Thanks for the info.

[Craig Hyps · Accepted solution]

You should see endpoint OUI value in Endpoint view.  If still unknown, then may not have profile based on that specific OUI.  This is where DHCP and User Agent data can help detect client OS independent of OUI.

[Jason Kunst · Accepted solution]

i would recommend troubleshooting with the TAC why these are not bring shown correctly. If they are common endpoints then it should be a simple fix, regardless open a case to debug

Also make sure on the PSN handling the authentications you have enabled profiling with http, DHCP and radius probes

How To: ISE Profiling Design Guide

[hslai]

In case that an endpoint matching a "Private" OUI in oui.txt, then it's expected to be shown as "Unknown".

Either go to http://standards-oui.ieee.org/oui.txt and see if "Private" by itself shown under the column "Organization". Or, download the file and use CLI:

awk '$3 ~/Private^M/  { print $1 }' oui.txt | sort -uf

to get a list of private OUIs.

https://standards.ieee.org/develop/regauth/tut/eui.pdf says,

...for assignees electing to use the private listing option, the IEEE assignment, but not identity of the assignee, is publicly available.