Cisco Ise 13 User Guide

TheupdatedOUIdatabaseisavailableforanyISEdeploymentasafeedthatCiscoISEdownloadstoitsown
database.CiscoISEupdatesendpointsandthenstartsreprofilingendpoints.
ThedesignatedCiscofeedserverislocatedathttps://ise.cisco.com:8443/feedserver/.Ifyouhaveanyissues
accessingtheservice,ensurethatyournetworksecuritycomponents(likeafirewallorproxyserver,for
example)allowdirectaccesstothisURL.
Configure Profiler Feed Service
TheProfilerFeedServiceretrievesnewandupdatedendpointprofilingpoliciesandMACOUIdatabase...

Procedure
Step 1ChooseAdministration>Certificates>TrustedCertificates,andcheckifVerisignClass3PublicPrimary
CertificationAuthorityandVerisignClass3ServerCA-G3areenabled.
Step 2ChooseAdministration>FeedService>Profiler.
Step 3ChecktheEnableProfilerFeedServicecheckbox.
Step 4EntertimeinHH:MMformat(localtimezoneoftheCiscoISEserver)intheFeedServiceSchedulersection.
Bydefault,CiscoISEfeedserviceisscheduledat1.00AMeveryday.
Step...

Procedure
Step 1ChooseAdministration>FeedService>Profiler.
Step 2ChecktheEnableProfilerFeedServicecheckbox.
Step 3ClickGotoUpdateReportPageifyouwanttoviewtheconfigurationchangesmadeintheChange
ConfigurationAuditreport.
Step 4ClickUndoLatest.
Profiler Reports
CiscoISEprovidesyouwithvariousreportsonendpointprofiling,andtroubleshootingtoolsthatyoucanuse
tomanageyournetwork.Youcangeneratereportsforhistoricalaswellascurrentdata.Youmaybeableto...

andCAMsperiodicallypullthelistofMACaddressesofendpointsandtheircorrespondingprofilesandthe
listofalltheprofilenames,fromCiscoISE.
YoumustexportthecontentsoftheX509CertificatefromtheCleanAccessManagerinAdministration>
CleanAccessManager>SSL,andimportitintothePrimaryPANunderAdministration>System>Certificates
>TrustedCertificatesStoreinCiscoISEforapropersecurecommunicationbetweenCiscoISEandCAM.
FormoreinformationonhowtosetupapairofCAMsforhighavailability,seethelinkbelow.
Cisco ISE Profiler and Cisco Clean...

Procedure
Step 1ChooseAdministration>NetworkResources>NACManagers.
Step 2ClickAdd.
Step 3EnterthenamefortheCiscoAccessManager.
Step 4ClicktheStatuscheckboxtoenableRESTAPIcommunicationfromtheCiscoISEprofilerthatauthenticates
connectivitytotheCAM.
Step 5EntertheIPaddressfortheCAMexceptthefollowingIPaddresses:0.0.0.0and255.255.255.255.
Step 6EntertheusernameandpasswordoftheCAMadministratorthatyouusetologintotheuserinterfaceofthe
CAM.
Step 7ClickSubmit.
Create Endpoints with Static Assignments of Policies...

Import Endpoints from CSV Files
YoucanimportendpointsfromaCSVfileforwhichyouhavealreadyexportedendpointsfromaCiscoISE
server,oraCSVfilethatyouhavecreatedfromCiscoISEandupdatedwithendpointdetails.
Thefileformathastobeintheformatasspecifiedinthedefaultimporttemplatesothatthelistofendpoints
appearsasfollows:MAC,EndpointPolicy,EndpointIdentityGroup.
BothendpointpolicyandendpointidentitygroupareoptionalforimportingendpointsinaCSVfile.Ifyou...

Unknown Endpoints Reprofiled During Import
IfthefileusedforimportcontainsendpointsthathavetheirMACaddresses,andtheirassignedendpoint
profilingpoliciesistheUnknownprofile,thenthoseendpointsareimmediatelyreprofiledinCiscoISEtothe
matchingendpointprofilingpoliciesduringimport.However,theyarenotstaticallyassignedtotheUnknown
profile.IfendpointsdonothaveendpointprofilingpoliciesassignedtothemintheCSVfile,thentheyare
assignedtotheUnknownprofile,andthenreprofiledtothematchingendpointprofilingpolicies.Seebelow...

Table 46: Invalid Profiles: Import from a File
Endpoint Profiling Policy Assigned After
Import in Cisco ISE
Endpoint Profiling Policy Assigned Before
Import in Cisco ISE
MAC Address
Xerox-DeviceUnknown.00:00:00:00:01:02
Theendpointisnotimportedbecause
thereisnomatchingprofileinCiscoISE.
Ifanendpointsuchas00:00:00:00:01:05
isassignedtoaninvalidprofileotherthan
theprofilesthatareavailableinCiscoISE,
thenCiscoISEdisplaysawarningmessage
thatthepolicynameisinvalidandthe
endpointwillnotbeimported....

Procedure
Step 1ChooseAdministration>IdentityManagement>Identities>Endpoints.
Step 2ClickExport,andchooseoneofthefollowing:
•ExportSelected—YoucanexportonlytheselectedendpointsintheEndpointspage.
•ExportAll—Bydefault,youcanexportalltheendpointsintheEndpointspage.
Step 3ClickOKtosavetheprofiler_endpoints.csvfile.
Identified Endpoints
CiscoISEdisplaysidentifiedendpointsthatconnecttoyournetworkanduseresourcesonyournetworkin...

databaseonlywhensignificantattributeschangeintheendpoints,andreplicatedtotheotherPolicyService
nodesdatabase.
Thefollowingarethesignificantattributes:
•ip
•EndPointPolicy
•MatchedValue
•StaticAssignment
•StaticGroupAssignment
•MatchedPolicyID
•NmapSubnetScanID
•PortalUser
•DeviceRegistrationStatus
•BYODRegistration
WhenyouchangeendpointprofiledefinitionsinCiscoISE,allendpointshavetobereprofiled.APolicy
Servicenodethatcollectstheattributesofendpointsisresponsibleforreprofilingofthoseendpoints....