ISE Probe attribute overlap

[trevorjenix]

I'm curious what is the logic in ISE 1.3 when more than one probe report different information for an endpoint. Say an endpoint with a MAC address got identified, and next it gets two different IP addresses for the same MAC from DHCP probe and maybe from SNMP CDP cache probe? Which one will it prefer? It appears that maybe it takes the last probe updated received regardless of the probe, is that correct?

[nspasov · Accepted solution]

Profiling attributes are constantly collected and stored in the ISE database. One attributed is not preferred over the other. Instead, it is the profiling rules that decide how a device is profiled. More specifically, Profiling rules with higher Certainty Factor are preferred over the others. For instance, a device is profiled as a "Cisco Phone" with a CF=10. Later on, more attributes are collected, and now ISE has enough information to match a Profiling Rule for Cisco-IP-Phone-7945 with CF=30. As a result, the device will be profiled as a Cisco-IP-Phone-7945. 

I hope this helps!

Thank you for rating helpful posts!