ISE Profiling Deployment

Question

We are starting a ISE deployment to segregate mobile devices (Iphones and IPads, initially) from corporate notebooks. We have a single SSID and two separate vlans, one for mobile devices and another for corporate notebooks, assigned by ISE. We successfully setup profiling in lab environment, with a few devices, but when we put in production  we had problems with devices not being profiled correctly. Since devices are not profiled their access are denied. Since devices are denied the cannot be profiled because ISE doesn´t see any traffic (DHCP, HTTP) from clients.
What strategy are you using to deploy ISE profiling? Must I put ISE to listen our network for some time before segregating access?

Answer 1

Hi
I've had the same problem with first time users being denied, that's due to ise not being able to profile before it denies.
I think they should come up with something that will profile devices then continue the authentication process.
Someone mentioned doing a re-auth for couple of seconds. (see attached pic how the authorization rule looks like), that could save you from people being denied for the first time, but if your device is never being profiled then it will just spin there all the time re-authenticating.
What you could do is also setup an unrouted VLAN and all the unknown devices stay there until profiled.
I've talked to cisco and they recommened the same thing so I guess that's it for now
What we have done before deploying ISE and it worked pretty good is I have forwarded all DHCP traffic to ISE before deploying ISE at that particular site, so DHCP forwarding ran for few days and I've already had their devices in my database and when I deployed it, it worked pretty neat
By forwarding all dhcp requests I mean:
We have Active Directory and DHCP servers centrally located, so in the router config I've added helper address to ISE ip address and that's it
Now WLC 7.3 has DHCP PROFILING and HTTP PROFILING options.
Http profiling sends first https packets to ISE and capturing USER-Agent string, that helps if you browse with safari, but if you use any other application that uses http traffic it will end up totally wrong.
example you connect with your iphone to wifi and open up VIBER, ISE will capture viber_blabla_smth as user agent and will not profile accurately.
Hope it helps