Infrastructure Configuration for Profiling

Infrastructure Configuration for Profilling

Here in this section, we will learn about configuration part, what needs to be configured and where in order to enabling profiling.

DHCP helper

On the default-gateway ip helper-address should be configured, on each access-layer VLANs. Below diagram shows that under VLAN 100, DHCP server and ISE PSN node IP address are configured with ip helper-address command.

If there is very large infrastructure, avoid configure all PSN IP address under VLAN, as it may give undesirable result. Instead we should configure specific PSN ip address by using ip helper-address command which will be used for Profiling. Redundancy can also be achieved by using Anycast between two PSNs and it may also possible that these PSN may locate in different DCs.

SPAN Configuration

SPAN configuration can be done in global configuration mode, below configuration shows SPAN configuration, where an Internet Facing VLAN will be the source of the session, and interface of PSN will be Destination.

Below figure show the output of SPAN Monitor command:

VLAN ACL Captures

Below Configuration is show how VLAN ACL is configured

Step 1. Build an access list to classify the traffic you want to capture:

Step 2. Build an access list for all the rest of the traffic:

Step 3. Create a VLAN access-map sequence to “capture” HTTP traffic:

Step 4. Add a new sequence to the access map to forward all other traffic:

Step 5. Apply the VLAN access map to the VLAN list:

Step 6. Configure the “destination” port for the PSN’s SPAN interface:

Device Sensor:

Device Sensor is switch or WLC feature that collects endpoint attributes locally and sends those attributes to ISE within RADIUS accounting packet. This Feature is present in Cisco Switches in IOS 15.0(1) and IOS-XE 3.3.0. And in Cisco WLC this feature is added in AireOS version 7.3. Device Sensors support three protocols: DHCP, CDP, and LLDP.