ISE - Cisco IP Phone profiling

[eng.malak]

Dears

i have issues profiling the Cisco ip phones , it's profiled as "PROFILED"  the only probes i enabled on switches and ISE is Radius and now i know the i need to enable CDP device sensor so it can be sent via Radius accounting but i can't find the commend "device-sensor account"  on my switch , i use "

Version 15.0(2)SE3" and WS-C2960S-24PS

any ideas ?

[Eduardo Aliaga]

According to the release notes, the 2960 don't support this feature, only the 3750 and 3560.

http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/15.0_2_se/release/notes/OL25301.html#wp1047686

I've been using 3750-X and 3560 with device sensor for a month now, and it profiles Cisco IP phones in less than a minute, most of the times in 20 seconds or so.

Please rate if it helps

[eng.malak]

so what is the alternative ?

[Eduardo Aliaga]

you could use another type of profiling, for example, DHCP profiling, then you would have to use DHCP relay pointing to your ISE  to collect the information, but I have never tested it and don't know how reliable and how fast to profile it's.

I would recommend to use static profiling, you could get the list of all MAC addresses from your Call Manager and then import them into ISE. The benefit it's that static profiling doens't use advanced licenses, only standard licenses, so it's cheaper to do it this way

Please rate it helps

Message was edited by: Eduardo Aliaga

[Tarik Admani]

Hi,

You should be able to use the dhcp relay feature because the hostname of the phone is contained in the dhcp request, I am sure that there is a condition already identified for the cisco ip phone hostname, and if there isnt you should be able to write one yourself.

Event though the device sensor isnt really supported on the 2960s i have had good luck with in the labs, however I havent proposed this as a solution for either of my customers, just a real head scratcher I wanted to share with you.


Sent from Cisco Technical Support iPad App

[eng.malak]

Hi

i read once that i should let the ISE to updates its profiler via Internet , any idea about how to do this ?

[Octavian Szolga]

ISE will update automatically it's OUI database, using Profiler Feed Service in version 1.2 that should be released this month.

[eng.malak]

What about ISE 1.1.4. ?

Sent from Cisco Technical Support iPhone App

[Tarik Admani]

At this point I dont think the feed service is a critical issue for any cisco ip phone deployments that have been in service for quite some time, Where the feed service really comes into play is the latest smartphones and the profiling characteristics they fall under. For cisco ip phones you should be able to write a simple policy and have this tested fairly easily. If you go to the profiling conditions you should be able to see which attributes (or checks) that ISE performs for each cisco ip phone. I am sure the dhcp atttribute is one of the checks that you can leverage.

Thanks,

Sent from Cisco Technical Support iPad App

[Ravi Singh]

I would like to inform you that 2960 does not support this feature. For profiling IP phones on ISE please follow the instruction given in the below link.

https://techzone.cisco.com/t5/Unified-Controller-Based-WLC/Wireless-BYOD-for-FlexConnect-Deployment-Guide/ta-p/239326

[Venkatesh Attuluri]

With ISE Release 1.2*, Cisco is delivering,  a unique feed service that provides new and updated profiles for various IP  enabled devices when vendors release new devices. So ISE customers will be able  to recognize new devices, in addition to a multitude of other network attached  devices such as printers, video cameras, and specialized mobile computing  devices.

Cisco works with various vendors, partners,  customers, etc. to profile the multitude of IP enabled devices that are expected  to be deployed in various customer environments and create profiles for these.  These profiles are made available through the Cisco Feed Service. An ISE server*  that is configured to connect to the Feed Service establishes a secure  connection with cloud based Feed Service. The various profiles on the Feed  Service are then automatically downloaded to the ISE server, thus providing ISE  customers the ability to stay abreast and detect various IP enabled devices that  connect to their network. The Feed Service will be available with the release of  ISE 1.2* software release and is part of the Advanced  License.