Profiling Overview

Profiling is a feature in ISE that lets the system detect what kind of devices are connecting to your network. It gleans information about each device (such as MAC address, OS type, or user-agent details) and maps that data against known device profiles to identify what kind of endpoint it is.

Implementing the Profiling service in Cisco Identity Services Engine (ISE) helps you solve one of the main security issues that network administrators face today: lack of endpoint visibility. Lack of endpoint visibility puts your entire network at risk. Endpoints are prime attack targets because they often contain sensitive information and are unpatched and vulnerable. As more endpoints and types of endpoints access your network resources, your network attack surface exponentially expands. The ISE Profiler service provides dynamic detection and classification of endpoints connected to the network. Classification makes it easier to grant and maintain the appropriate access to your network, which, in turn, greatly improves overall network security.

ISE is capable of collecting device information from a variety of places, using DHCP, HTTP traffic, NetFlow, NMAP scans, probes, and more. Those are “probes,” and each one scrutinizes a different aspect of the device’s network activity to piece together a clear picture of what it is.

An ISE Policy Service Node with the profiler service enabled collects probes from the network. The probes contain endpoint attributes that can be mapped back to the endpoint MAC address and can be analyzed by ISE to determine the endpoint profile.

The Profiler service runs only on Cisco ISE nodes that provide the policy service. In a distributed deployment, the profiler service does not run on Cisco ISE nodes that only provide other services, such as administration and monitoring.

The profiler service is composed of the following components:

The Sensor: The sensor collects data from several probes and obtains information on the endpoints. The sensor then forwards the attributes and their attribute values to the analyzer. The probe manager within the sensor supports the profiler service, initializing and controlling various probes that run on the sensor. The probe manager allows you to configure probes and to start and stop collecting the attributes and their values from the endpoints. An event manager within the sensor can communicate events between the probes and the probe manager. A forwarder stores endpoints in the Cisco ISE database along with their attribute data. Cisco ISE then notifies the analyzer of newly detected endpoints.

The Analyzer: The analyzer evaluates endpoints by using the configured policies. It then classifies the endpoints with the matched endpoint profile in the Cisco ISE database.

All profiling activities are controlled in the Profiler Work Center. It provides a place where administrators can examine endpoint information as well as set up probes and profiling policies all in one, centralized position within the ISE interface.

It captures DHCP packets from a mirrored port, such as from Switched Port Analyzer (SPAN), Remote Switched Port Analyzer (RSPAN), and Encapsulated Remote Switched Port Analyzer (ERSPAN). A dedicated Cisco ISE interface is strongly recommended for this probe type. Be sure to enable the Cisco ISE interface from the CLI and make any necessary physical connections to the SPAN port.

Profiling allows network managers to see every device that connects to their enterprise, whether a laptop, printer, or phone. Knowing what’s connected lets you apply the right security policies, identify unauthorized devices, and keep it secure and compliant.

Profiling is useful in situations where certain corporate assets must be differentiated from non-corporate assets. It may be used to help regulate network access and assign additional network authorization permissions. This usage is based on the policy group of the device.

Enterprises deploy the profiler service for two main reasons:

Create a learned inventory: The profiler service provides a contextual inventory of all endpoints that are using network resources. It discovers connected endpoints and where they exist on the network.

Determine the applicable Endpoint Identity Group: The profiler service matches endpoints to a profiler policy. These profiler policies can be used to determine which identity group the endpoint should be assigned to. The identity group specified by the device profile can then be used as a condition in the authorization policy. In this way, you can affect the endpoint network permissions.