# Profiling: unknown is a fact, not a VLAN

Source: https://ai.techclick.in/blog_cisco_ise_profiling_unknown_endpoint
Markdown: https://ai.techclick.in/blog_cisco_ise_profiling_unknown_endpoint.md
Publisher: Techclick Infosec Pvt Ltd

Profiling probes (RADIUS, DHCP, HTTP, NMAP) turn an unknown MAC into a profile. Dummy camera vs laptop.

## The ticket

 A new badge camera sits in quarantine forever. DHCP works. ISE never saw option 60 because the DHCP probe is off on the PSN. Junior adds the MAC to Printers. Now cameras print.

  Quick interview answer

 Profiling uses probes (RADIUS accounting, DHCP, HTTP, DNS, SNMP, NMAP — enable only what you need) to classify endpoints. Context Visibility shows profile + match certainty. Authorization should key off  logical profiles / endpoint groups , not “if Unknown then permit.” After a better profile, CoA reapplies Authz.

  Hero · unknown cube

 Unknown means “we do not know yet.” It does not mean “trusted.”
  Lab data · dummy only
 PAN  ise-pan   10.10.10.20  · PSN  ise-psn1   10.10.10.21  · MnT  ise-mnt   10.10.10.22  · NAD  sw-access-01   10.10.10.2  · AD  dc01   10.20.30.10  · Priya  10.20.30.80   TECHCLICK\priya.hr  · printer  10.20.30.60 . Not a live customer.

## Probes

   Probe  Learns  Watch-out

  RADIUS  MAC, NAD, session  Always on if AAA works
  DHCP  Class-id, hostname  Need span/helper toward PSN
  HTTP  User-Agent  Needs redirect or SPAN
  NMAP  Open ports / OS  Do not blast OT (Forescout lesson)

     https://ise-pan.techclick-lab.in/admin

     Training mock · not live

       ISE Admin

       Context Visibility  Operations  Policy  Administration

       Context Visibility → Endpoints → aa:aa:aa:ca:me:01

### Profile details

        Endpoint profile  Unknown → Axis-Device (after DHCP)

  Certainty  10 → 80

  Probes  RADIUS, DHCP

  Static assignment  No

        Cancel  Save

   Context Visibility + Policy → Profiling. Training mock.

## Unknown policy

 Monitor: log and allow limited DHCP. Enforce: quarantine VLAN / tiny dACL. Never Permit ip any any for Unknown.

## How you profile

- #### Side A — PSN probes Administration → System → Deployment → PSN → Profiling Configuration. DHCP + RADIUS on.

- #### Side B — Authz IF Camera profile THEN VLAN 50. IF Unknown THEN Quarantine.

- #### Side C — CoA When profile flips, CoA should re-auth. show authentication sessions VLAN should change.

## Four profiling failures

### 1 · DHCP never reaches ISE

 No helper/span. Profile stuck Unknown.

### 2 · Static group overrides profile

 You nailed it to Printers last year.

### 3 · NMAP on OT

 PLC faults. Use passive probes. See Forescout OT lesson.

### 4 · No CoA

 Profile updates, port stays in quarantine until unplug.

## How to prove it

  Close the ticket only when

 1) Endpoint attributes show DHCP class. 2) Profile ≠ Unknown (or Unknown is intentional quarantine). 3) Authz matches the profile. 4) CoA visible in Live Logs.

## Traps

   Wrong  Right

  Unknown = HR  Unknown = tight
  Disable all probes  RADIUS + DHCP at minimum
  NMAP everywhere  Exclude OT prefixes

## Knowledge check

   Judgment items. One best answer. Reasons send you back to the matching section.

       Q1
       Unknown profile should get…

           A tight / quarantine result
           HR dACL
           PAN access
           No RADIUS

       Correct:  a . Choose.

       Q2
       DHCP class-id never appears. First check?

           DHCP probe + helper/span to PSN
           Delete the NAD
           Turn off MAB
           pxGrid cert

       Correct:  a . Failure 1.

       Q3
       Why CoA after a profile change?

           To re-apply Authorization for the new type
           To join AD
           To issue EAP certs
           To reboot PAN

       Correct:  a . Concept.

       Q4
       NMAP on a PLC subnet is risky because…

           Active scans can fault OT
           ISE forbids all probes
           Switches cannot MAB
           RADIUS uses TCP only

       Correct:  a . Failure 3.

       Q5
       Static endpoint group beats a new profile when…

           You pinned the MAC last year
           Always
           Never
           Only for guests

       Correct:  a . Failure 2.

       Q6
       Where do you read profile certainty?

           Context Visibility → Endpoints
           Switch spanning-tree
           Gaia clish
           Hide NAT

       Correct:  a . Portal.

       Check answers
       Reset

  Cisco ISE class series:   Personas  ·  First day  ·  NAD + RADIUS  ·  Policy sets  ·  Wired 802.1X  ·  MAB  ·  CWA / guest  ·  Profiling  ·  dACL vs VLAN  ·  Live logs  ·  vs Forescout  ·  Interview

## Sources

- ISE 3.3 profiling / probes.
- Lab PDF — identity includes device type (what).

 Related:  ISE evidence desk  ·  session factory  ·  Forescout series .

---
Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees.
Browse all lessons: https://ai.techclick.in/blogs
AI index: https://ai.techclick.in/llms.txt