All,
The attached picture is of an endpoint in my customer's system. You can see that the endpoint has been in there for 600+ days but the inactive days is 0. There is no selected authorization profile so most likely this device has never authenticated against ISE. I am guessing the device needs to authenticate at least once before the Inactive Days counter actually works.
We think these devices got into the system at some point because their guest wireless SSID which doesn't use ISE had accounting enabled using the global accounting servers which ISE was one of them. The Endpoint source says FeedService which I am not sure how that can be a source.
We are trying to figure out how to purge these out of the systems since the Inactive Days counter isn't working. He has 100K+ devices like this and wants to get rid of them.
I think ultimately he is just going to have to purge everything based on a profiling group and let legitimate stuff get relearned.
Thoughts?
