Hi,
It should work.
---------------------------
You have to check for the parent profile configuration:
parent profile General_CORP_Printer
total certainty factor = 50 (just an example)
Conditions:
if OUI or entire MAC is/contains X = 50 points
+ take network scan action
---------------------------
Make sure the global SNMP community string is public or whatever custom community you've configured on your printer.
---------------------------
Check if you printer is indeed identified as being General_CORP_Printer.
---------------------------
The first connection of the printer should match a profile that allows for network access (with dACL allowing access to ISE - return traffic for the scan part)
---------------------------
Your switch should have IP Device Tracking on so that ISE learns printers IP. In order to 'stimulate' the printer you should configure authentication control-direction in
If nobody connects to the printer (wants to print), the printer itself will not generate any traffic, thus the switch will not learn its IP, thus ISE will not know the IP to scan.
(do a ping to the printer so that you trigger an ARP on the L3/printer's gateway; the printer will get the ARP request - auth control-direction in - will want to respond; IP Device Tracking will kick in and know the printer's IP.
Regards,
Octavian
