ISE 1.2 does not do HTTP profiling ???

Question

Hi, guys.
Has anyone ISE 1.2 Patch 1 successfully enabled to do profiling using HTTP on a monitor session/span port ???
I have tried the following:
- DMZ switch, which holds a vlan where (only) the central proxy server resides
- ESX 5.1 host, one nic connected to the DMZ switch
- configured a virtual switch/network on this host, which uses the nic connected to the DMZ switch (enabled promiscious mode on the vswitch and network)
- ISE 1.2 Patch 1 installed on the ESX host, two interfaces (Gig 0 and 1), Gig 1 connected to the vswitch and virtual network
- configured virtual ISE to do http profiling on Gig 1
Here are some shows:
#sh moni
Session 1
Type                   : Local Session
Source VLANs           :
    Both               : xx
Destination Ports      : Gi2/0/48
    Encapsulation      : Native
          Ingress      : Disabled
#sh run int gig2/0/48
interface GigabitEthernet2/0/48
description *** ISE Proxy SPAN Port
switchport access vlan xx
The span destination port shows lots of outgoing packets:
#sh int gig2/0/48
GigabitEthernet2/0/48 is up, line protocol is down (monitoring)
  Hardware is Gigabit Ethernet, address is 588d.0941.7130 (bia 588d.0941.7130)
  Description: *** ISE-Riker Proxy SPAN Port
  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,
     reliability 255/255, txload 10/255, rxload 1/255
  Encapsulation ARPA, loopback not set
  Keepalive set (10 sec)
  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX
  input flow-control is off, output flow-control is unsupported
  ARP type: ARPA, ARP Timeout 04:00:00
  Last input never, output 00:22:36, output hang never
  Last clearing of "show interface" counters 03:03:20
  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 14352300
  Queueing strategy: fifo
  Output queue: 0/40 (size/max)
  5 minute input rate 0 bits/sec, 0 packets/sec
  5 minute output rate 42962000 bits/sec, 13051 packets/sec
     33 packets input, 2436 bytes, 0 no buffer
     Received 33 broadcasts (18 multicasts)
     0 runts, 0 giants, 0 throttles
     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
     0 watchdog, 18 multicast, 0 pause input
     0 input packets with dribble condition detected
    223104868 packets output, 98731284385 bytes, 0 underruns
     0 output errors, 0 collisions, 0 interface resets
     0 babbles, 0 late collision, 0 deferred
     0 lost carrier, 0 no carrier, 0 PAUSE output
     0 output buffer failures, 0 output buffers swapped out
But the interface on ISE hardly shows any incoming packets:
# sh int gig 1
GigabitEthernet 1
          Link encap:Ethernet  HWaddr 00:50:56:8D:4A:C1
          inet6 addr: fe80::250:56ff:fe8d:4ac1/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:3810 errors:0 dropped:0 overruns:0 frame:0
          TX packets:12 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:347928 (339.7 KiB)  TX bytes:936 (936.0 b)
          Interrupt:67 Base address:0x20a4
I have tested if the vmware virtual network makes the packets disappear, therefore I have connected a windows virtual machine to the same network as ISE 
Running Wireshark on this windows machine shows me LOOOOOTS of http packets on this virtual network, seem like the ISE nic just doesn't see them ......
Any ideas ???
Rgs
Frank

Answer 1

1. it is vm, right?    
Yepp !!
can you get netstat -i?
Executed where ?? On the esx host ?? On the ise vm ??
What do you expect to see ??
2. Did you configure an ip for the span receive interface?
No, why should this be necessary ?? (switchport, wireshark, etc. don't need an ip to capture
packets on a promiscuous interface, even ISE 1.1.4 didn't need one on the http profiling interface .....)
Configuration guide doesn't say so anyway ......
if not, you must configure one to make it work.
looks like you don't have one,,, pls configure one...
Ok, ok ..., configured an ip address, checked the profiling attributes ...
Result: did not make any difference ..... (tadaaaahhhhh !!!)
tcpdump: WARNING: eth1: no IPv4 address assigned
Right, but tcpdump shows dozens of live packets as they arrive live on ise, they are just not reflected in the "sh int gig 1" counters
and furthermore not picked up by the application, that is why I would suspect a nic driver malfunction on the underlying linux os ......
3. on vswitch make sure the port is in promiscuous mode.
As I already mentioned before in this thread, it is.
If the vmware virtual network inbetween ise and the non-virtual network would swallow the packets, why would "tech dumptcp 1" show anything at all ??
(see screenshots above)
Rgs
Frank