T Techclick ← All lessons
Cisco · ISE 3.3 · Lesson 8 of 12

Profiling: unknown is a fact, not a VLAN

Live Logs identity is a MAC. Profile = Unknown. Authorization therefore hits Default/quarantine. Someone wants Permit_All for Unknown. This lesson is how ISE learns device type — and how you prove it — without opening the LAN.

Updated 2026-08-18·18 min read·L2 primary·Quiz at end

After this page you can

The ticket

A new badge camera sits in quarantine forever. DHCP works. ISE never saw option 60 because the DHCP probe is off on the PSN. Junior adds the MAC to Printers. Now cameras print.

Quick interview answer

Profiling uses probes (RADIUS accounting, DHCP, HTTP, DNS, SNMP, NMAP — enable only what you need) to classify endpoints. Context Visibility shows profile + match certainty. Authorization should key off logical profiles / endpoint groups, not “if Unknown then permit.” After a better profile, CoA reapplies Authz.

Hero · unknown cube
Unknown endpoint becoming a classified camera
Unknown means “we do not know yet.” It does not mean “trusted.”
Lab data · dummy only

PAN ise-pan 10.10.10.20 · PSN ise-psn1 10.10.10.21 · MnT ise-mnt 10.10.10.22 · NAD sw-access-01 10.10.10.2 · AD dc01 10.20.30.10 · Priya 10.20.30.80 TECHCLICK\priya.hr · printer 10.20.30.60. Not a live customer.

Probes

ProbeLearnsWatch-out
RADIUSMAC, NAD, sessionAlways on if AAA works
DHCPClass-id, hostnameNeed span/helper toward PSN
HTTPUser-AgentNeeds redirect or SPAN
NMAPOpen ports / OSDo not blast OT (Forescout lesson)
https://ise-pan.techclick-lab.in/admin
Training mock · not live
ISE Admin
Context VisibilityOperationsPolicyAdministration
Context Visibility → Endpoints → aa:aa:aa:ca:me:01

Profile details

Unknown → Axis-Device (after DHCP)
10 → 80
RADIUS, DHCP
No
Context Visibility + Policy → Profiling. Training mock.

Unknown policy

Monitor: log and allow limited DHCP. Enforce: quarantine VLAN / tiny dACL. Never Permit ip any any for Unknown.

How you profile

  1. Side A — PSN probes

    Administration → System → Deployment → PSN → Profiling Configuration. DHCP + RADIUS on.

  2. Side B — Authz

    IF Camera profile THEN VLAN 50. IF Unknown THEN Quarantine.

  3. Side C — CoA

    When profile flips, CoA should re-auth. show authentication sessions VLAN should change.

Four profiling failures

1 · DHCP never reaches ISE

No helper/span. Profile stuck Unknown.

2 · Static group overrides profile

You nailed it to Printers last year.

3 · NMAP on OT

PLC faults. Use passive probes. See Forescout OT lesson.

4 · No CoA

Profile updates, port stays in quarantine until unplug.

How to prove it

Close the ticket only when

1) Endpoint attributes show DHCP class. 2) Profile ≠ Unknown (or Unknown is intentional quarantine). 3) Authz matches the profile. 4) CoA visible in Live Logs.

Traps

WrongRight
Unknown = HRUnknown = tight
Disable all probesRADIUS + DHCP at minimum
NMAP everywhereExclude OT prefixes

Knowledge check

Judgment items. One best answer. Reasons send you back to the matching section.

Q1

Unknown profile should get…

Correct: a. Choose.
Q2

DHCP class-id never appears. First check?

Correct: a. Failure 1.
Q3

Why CoA after a profile change?

Correct: a. Concept.
Q4

NMAP on a PLC subnet is risky because…

Correct: a. Failure 3.
Q5

Static endpoint group beats a new profile when…

Correct: a. Failure 2.
Q6

Where do you read profile certainty?

Correct: a. Portal.

Cisco ISE class series: Personas · First day · NAD + RADIUS · Policy sets · Wired 802.1X · MAB · CWA / guest · Profiling · dACL vs VLAN · Live logs · vs Forescout · Interview

Sources

Related: ISE evidence desk · session factory · Forescout series.