了解ISE 3.3上用于终端分类的Wifi分析

已更新: 2023 年 10 月 5 日

文档 ID:221050

非歧视性语言

此产品的文档集力求使用非歧视性语言。在本文档集中，非歧视性语言是指不隐含针对年龄、残障、性别、种族身份、族群身份、性取向、社会经济地位和交叉性的歧视的语言。由于产品软件的用户界面中使用的硬编码语言、基于 RFP 文档使用的语言或引用的第三方产品使用的语言，文档中可能无法确保完全使用非歧视性语言。深入了解思科如何使用包容性语言。

关于此翻译

思科采用人工翻译与机器翻译相结合的方式将此文档翻译成不同语言，希望全球的用户都能通过各自的语言得到支持性的内容。请注意：即使是最好的机器翻译，其准确度也不及专业翻译人员的水平。 Cisco Systems, Inc. 对于翻译的准确性不承担任何责任，并建议您总是参考英文原始文档（已提供链接）。

简介

本文档介绍适用于终端分类的WiFi分析的工作原理。还介绍了如何配置、验证和排除故障。

先决条件

要求

Cisco 建议您了解以下主题：

9800无线LAN控制器(WLC)配置
身份服务引擎(ISE)配置
RADIUS 身份验证.授权和记帐(AAA)数据包流和术语

本文档假设已有一个工作正常的WLAN身份验证客户端使用ISE作为RADIUS服务器。

要使用此功能，至少需要：

9800 WLC Cisco IOS® XE都柏林17.10.1
确定Services Engine v3.3。
802.11ac Wave2或802.11ax(Wi-Fi 6/6E)接入点

使用的组件

本文档中的信息基于以下软件和硬件版本：

9800 WLC Cisco IOSXE v17.12.x
身份服务引擎(ISE)v3.3
Android 13设备

本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。

背景信息

通过WiFi设备分析，Cisco 9800 WLC可以从连接到此设备的一组终端了解属性（例如型号和操作系统版本），并与ISE共享这些属性。然后，ISE可以将此信息用于终端分类（也称为分析）。

目前，以下供应商支持WiFi分析：

苹果
英特尔
三星

WLC使用RADIUS记帐数据包与ISE服务器共享属性信息。 WiFi Analytics Data Flow WiFi分析数据流

请务必记住，RADIUS AAA流上的RADIUS记帐数据包仅在RADIUS服务器发送RADIUS Access-Accept数据包作为对终端身份验证尝试的应答后发送。按照顺序排列，WLC仅在RADIUS服务器(ISE)和网络访问设备(WLC)之间建立终端的RADIUS会话后共享终端属性信息。

以下是ISE可用于终端分类和授权的所有属性：

DEVICE_INFO_FIRMWARE_VERSION
DEVICE_INFO_HW_MODEL
DEVICE_INFO_MANUFACTURER_MODEL
DEVICE_INFO_MODEL_NAME
DEVICE_INFO_MODEL_NUM
DEVICE_INFO_OS_VERSION
DEVICE_INFO_VENDOR_TYPE

注意：WLC可根据连接的终端类型发送更多属性，但只有列出的属性可用于在ISE中创建授权策略。

ISE收到记账数据包后，可以在其中处理和使用此分析数据，并使用它重新分配终端配置文件/身份组。

WiFi终端分析属性列在WiFi_Device_Analytics字典下。网络管理员可以在终端授权策略和条件中包含这些属性。

WiFi Device Analytics Dictionary WiFi设备分析词典

如果ISE为终端存储的当前属性值发生任何更改，则ISE启动授权更改(CoA)，允许对终端进行评估以计算更新的属性。

配置

WLC上的配置

步骤1:全局启用设备分类功能

导航到Configuration > Wireless > Wireless Global并选中Device Classification复选框。

Device Classification Configuration 设备分类配置

第二步：启用TLV缓存和RADIUS分析

导航到Configuration > Tags and Profiles > Policy，然后选择RADIUS客户端连接的WLAN所使用的Policy Profile。

Wireless Policy Selection 无线策略选择

单击Access Policies并选中RADIUS Profiling、HTTP TLV Caching和DHCP TLV Caching选项。由于在上一步中采取的操作，设备分类的全局状态现在显示为“已启用”状态。 RADIUS Profiling and Caching Configuration RADIUS分析和缓存配置

登录到WLC CLI并启用dot11 TLV Accounting。

vimontes-wlc#configure terminal
vimontes-wlc(config)#wireless profile policy policy-profile-name
vimontes-wlc(config-wireless-policy)#dot11-tlv-accounting

注意：使用此命令之前，必须禁用无线策略配置文件。此命令仅在Cisco IOS XE Dublin 17.10.1版本及更高版本上可用。

ISE上的配置

步骤1:在部署的PSN中启用分析服务

导航到Administration > Deployment，然后点击PSN的名称。

ISE PSN Node Selection ISE PSN节点选择

向下滚动到Policy Service部分并标记Enable Profiling Service复选框。点击保存按钮。

Profiler Services Configuration 分析器服务配置

第二步：在ISE PSN上启用RADIUS分析探测

向上滚动到页面顶部，然后点击Profiling Configuration选项卡。这将显示可在ISE上使用的所有分析探测。启用RADIUS Probe，然后单击Save。

RADIUS Profiling Probe Configuration RADIUS分析探测配置

第三步：设置CoA类型和终端属性过滤器

导航到Administration > System > Settings > Profiling。将CoA Type设置为Reauth，并确保Endpoint Attribute Filter复选框未选中。

CoA类型和属性过滤器配置

第四步：使用WiFi Analytics数据属性配置授权策略

导航到Policy > Policy Sets菜单，然后选择您的无线网络使用的Policy Set。

Policy Set Selection 策略集选择

单击Authorization Policies并配置授权条件以包括Endpoint Policy和WiFi Device Analytics字典属性。 Authorization Policy Configuration 授权策略配置

验证

在ISE GUI上，导航到操作> RADIUS >实时日志。您可以使用多个字段过滤此窗口中的条目并查找测试终端记录。

ISE Live Logs for Testing Endpoint 用于测试终端的ISE实时日志

a.初始终端身份验证请求到达ISE。终端配置文件字段为空，因为此会话的记帐数据包此时未到达ISE。

b.CoA从ISE发送到NAD，因为现在已收到包含终端属性的记帐数据包。

c.成功发送CoA后，终端会重新进行身份验证。这次，您可以观察新的已分配终端配置文件，并看到已分配了不同的授权结果。

注意：CoA数据包始终具有空身份字段，但终端ID与第一个身份验证数据包中的相同。

点击位于授权更改记录上的详细信息列中的图标。

Access to CoA Packet Details 访问CoA数据包详细信息

CoA详细信息显示在新的浏览器选项卡中。向下滚动到其他属性部分。

CoA源组件显示为分析器。CoA Reason在授权策略中使用的终端身份组/策略/逻辑配置文件中显示为Change。

CoA Triggering Component and Reason CoA触发组件和原因

导航到情景可视性>终端>身份验证选项卡。在此选项卡上，使用过滤器定位测试终端。

点击终端MAC地址以访问终端属性。

Endpoint on Context Visibility 情景可视性上的终端

此操作显示ISE存储的有关此终端的所有信息。单击Attributes部分，然后选择Other Attributes。

Endpoint Other Attribute Selection on Context Visibility 基于情景可视性的终端其他属性选择

向下滚动，直到找到WiFi_Device_Analytics词典属性。在此部分查找这些属性意味着ISE通过记帐数据包成功接收这些属性，并且可用于终端分类。

WiFi Analytics Attributes on Context Visibility WiFi分析属性与情景可视性

下面是Windows 10和iPhone属性示例，供您参考：

Example of Windows 10 Endpoint Attributes Windows 10终端属性示例 Example of iPhone Endpoint Attributes iPhone终端属性示例

故障排除

步骤1:计费数据包到达ISE

在WLC CLI上，确保在策略配置文件配置上启用DOT11 TLV记帐、DHCP TLV缓存和HTTP TLV缓存。

vimontes-wlc#show running-config | section wireless profile policy policy-profile-name
wireless profile policy policy-profile-name
 aaa-override
 accounting-list AAA-LIST
 dhcp-tlv-caching
 dot11-tlv-accounting
 http-tlv-caching
 radius-profiling
 no shutdown

连接终端时，收集WLC或ISE终端上的数据包捕获。您可以使用任何众所周知的数据包分析工具(如Wireshark)来分析收集的文件。

按RADIUS记帐数据包和呼叫站ID（测试终端MAC地址）进行过滤。例如，可以使用以下过滤器：

radius.code == 4 && radius.Calling_Station_Id == "xx-xx-xx-xx-xx-xx"

找到后，展开Cisco-AVPair字段以查找Accounting数据包中的WiFi Analytics数据。

Endpoint TLV Attributes within an Accounting Packet 记账数据包中的终端TLV属性

第二步：ISE解析具有终端属性的记帐数据包

在ISE端，可以将这些组件设置为调试级别，以确保由发送的RADIUS记帐数据包到达ISE并正确处理。

然后，您可以收集ISE支持包以收集日志文件。有关如何收集支持捆绑包的更多信息，请参阅相关信息部分。

Components to Debug for Troubleshoot 要调试的组件以进行故障排除

注意：仅在验证终端的PSN上启用组件以调试级别。

在iseLocalStore.log上，Accounting-Start消息被记录，而无需将任何组件启用为DEBUG级别。此处，ISE必须看到包含WiFi Analytics属性的传入记帐数据包。

2023-09-27 18:19:23.600 +00:00 0000035538 3000 NOTICE Radius-Accounting: RADIUS Accounting start request, ConfigVersionId=1493, 
Device IP Address=172.16.5.169, UserName=bob, NetworkDeviceName=lab-wlc, User-Name=bob, NAS-IP-Address=172.16.5.169, NAS-Port=260613,
Framed-IP-Address=172.16.5.76, Class=CACS:A90510AC0000005BD7DDDAA7:iselab/484624451/303, Called-Station-ID=00-1e-f6-5c-16-ff, 
Calling-Station-ID=0a-5a-f0-b3-b5-9c, NAS-Identifier=vimontes-wlc, Acct-Status-Type=Start, Acct-Delay-Time=0, Acct-Session-Id=00000018, 
Acct-Authentic=Remote, Event-Timestamp=1695838756, NAS-Port-Type=Wireless - IEEE 802.11, cisco-av-pair=dc-profile-name=Samsung Galaxy S22+, 
cisco-av-pair=dc-device-name=Victor-s-S22, cisco-av-pair=dc-device-class-tag=Samsung Galaxy S22+, cisco-av-pair=dc-certainty-metric=40, 
cisco-av-pair=64:63:2d:6f:70:61:71:75:65:3d:01:00:00:00:00:00:00:00:00:00:00:00, cisco-av-pair=dc-protocol-map=1025, cisco-av-pair=dhcp-option=host-name=Victor-s-S22, 
cisco-av-pair=dhcp-option=dhcp-class-identifier=android-dhcp-13, cisco-av-pair=dhcp-option=dhcp-parameter-request-list=1\, 3\, 6\, 15\, 26\, 28\, 51\, 58\, 59\, 43\, 114\, 108, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_MODEL_NUM=Samsung Galaxy S22+, cisco-av-pair=dot11-device-info=DEVICE_INFO_FIRMWARE_VERSION=WH6, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_SALES_CODE=MXO, cisco-av-pair=dot11-device-info=DEVICE_INFO_DEVICE_FORM=1, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_OS_VERSION=Android 13, cisco-av-pair=dot11-device-info=DEVICE_INFO_COUNTRY_CODE=Unknown, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_VENDOR_TYPE=2, cisco-av-pair=audit-session-id=A90510AC0000005BD7DDDAA7, cisco-av-pair=vlan-id=2606, cisco-av-pair=method=dot1x, 
cisco-av-pair=cisco-wlan-ssid=VIcSSID, cisco-av-pair=wlan-profile-name=ISE-AAA, Airespace-Wlan-Id=1, AcsSessionID=iselab/484624451/304, SelectedAccessService=Default Network Access, 
RequestLatency=15, Step=11004, Step=11017, Step=15049, Step=15008, Step=22083, Step=11005, NetworkDeviceGroups=IPSEC#Is IPSEC Device#No, NetworkDeviceGroups=Location#All Locations, 
NetworkDeviceGroups=Device Type#All Device Types, CPMSessionID=A90510AC0000005BD7DDDAA7, TotalAuthenLatency=15, ClientLatency=0, Network Device Profile=Cisco, Location=Location#All Locations, 
Device Type=Device Type#All Device Types, IPSEC=IPSEC#Is IPSEC Device#No,

在prrt-server.log上，ISE解析收到的会计数据包系统日志消息，包括WiFi分析属性。使用CallingStationID和CPMSessionID字段确保跟踪正确的会话和终端。

Radius,2023-09-27 18:19:23,586,DEBUG,0x7f50a2b67700,cntx=0000192474,sesn=iselab/484624451/304,
CPMSessionID=A90510AC0000005BD7DDDAA7,CallingStationID=0a-5a-f0-b3-b5-9c,FramedIPAddress=172.16.5.76,RADIUS PACKET:: 
Code=4(AccountingRequest) Identifier=39 Length=934
     [1] User-Name - value: [bob] 
     [4] NAS-IP-Address - value: [172.16.5.169] 
     [5] NAS-Port - value: [260613] 
     [8] Framed-IP-Address - value: [172.16.5.76] 
     [25] Class - value: [****] 
     [30] Called-Station-ID - value: [00-1e-f6-5c-16-ff] 
     [31] Calling-Station-ID - value: [0a-5a-f0-b3-b5-9c] 
     [32] NAS-Identifier - value: [vimontes-wlc] 
     [40] Acct-Status-Type - value: [Start] 
     [41] Acct-Delay-Time - value: [0] 
     [44] Acct-Session-Id - value: [00000018] 
     [45] Acct-Authentic - value: [Remote] 
     [55] Event-Timestamp - value: [1695838756] 
     [61] NAS-Port-Type - value: [Wireless - IEEE 802.11] 
     [26] cisco-av-pair - value: [dc-profile-name=Samsung Galaxy S22+] 
     [26] cisco-av-pair - value: [dc-device-name=Victor-s-S22] 
     [26] cisco-av-pair - value: [dc-device-class-tag=Samsung Galaxy S22+] 
     [26] cisco-av-pair - value: [dc-certainty-metric=40] 
     [26] cisco-av-pair - value: [dc-opaque=<01><00><00><00><00><00><00><00><00><00><00><00>] 
     [26] cisco-av-pair - value: [dc-protocol-map=1025] 
     [26] cisco-av-pair - value: [dhcp-option=<00><0c><00><0c>Victor-s-S22] 
     [26] cisco-av-pair - value: [dhcp-option=<00><<00><0f>android-dhcp-13] 
     [26] cisco-av-pair - value: [dhcp-option=<00>7<00><0c><01><03><06><0f><1a><1c>3:;+rl] 
     [26] cisco-av-pair - value: [dot11-device-info=<00><00><00><13>Samsung Galaxy S22+] 
     [26] cisco-av-pair - value: [dot11-device-info=<00><01><00><03>WH6] 
     [26] cisco-av-pair - value: [dot11-device-info=<00><02><00><03>MXO] 
     [26] cisco-av-pair - value: [dot11-device-info=<00><03><00><01>1] 
     [26] cisco-av-pair - value: [dot11-device-info=<00><04><00>
Android 13] 
     [26] cisco-av-pair - value: [dot11-device-info=<00><05><00><07>Unknown] 
     [26] cisco-av-pair - value: [dot11-device-info=<00>
<00><01>2] 
     [26] cisco-av-pair - value: [audit-session-id=A90510AC0000005BD7DDDAA7] 
     [26] cisco-av-pair - value: [vlan-id=2606] 
     [26] cisco-av-pair - value: [method=dot1x] 
     [26] cisco-av-pair - value: [cisco-wlan-ssid=VIcSSID] 
     [26] cisco-av-pair - value: [wlan-profile-name=ISE-AAA] 
     [26] Airespace-Wlan-Id - value: [<00><00><00><01>] ,RADIUSHandler.cpp:2453

第三步：终端属性已更新且终端已分类

然后与分析器组件共享此syslog消息。Profiler.log接收解析的系统日志消息并提取终端属性。

2023-09-27 18:19:23,601 DEBUG  [SyslogListenerThread][[]] cisco.profiler.probes.radius.SyslogMonitor -:::::- Radius Packet Received 1266
2023-09-27 18:19:23,601 DEBUG  [SyslogListenerThread][[]] cisco.profiler.probes.radius.SyslogDefragmenter -:::::- parseHeader inBuffer=<181>Sep 27 18:19:23 iselab 
CISE_RADIUS_Accounting 0000000297 3 0 2023-09-27 18:19:23.600 +00:00 0000035538 3000 NOTICE Radius-Accounting: RADIUS Accounting start request, ConfigVersionId=1493, Device IP Address=172.16.5.169, 
UserName=bob, NetworkDeviceName=lab-wlc, User-Name=bob, NAS-IP-Address=172.16.5.169, NAS-Port=260613, Framed-IP-Address=172.16.5.76, Class=CACS:A90510AC0000005BD7DDDAA7:iselab/484624451/303, 
Called-Station-ID=00-1e-f6-5c-16-ff, Calling-Station-ID=0a-5a-f0-b3-b5-9c, NAS-Identifier=vimontes-wlc, Acct-Status-Type=Start, Acct-Delay-Time=0, Acct-Session-Id=00000018, Acct-Authentic=Remote, 
Event-Timestamp=1695838756, NAS-Port-Type=Wireless - IEEE 802.11, cisco-av-pair=dc-profile-name=Samsung Galaxy S22+, cisco-av-pair=dc-device-name=Victor-s-S22, 
cisco-av-pair=dc-device-class-tag=Samsung Galaxy S22+, cisco-av-pair=dc-certainty-metric=40, 
cisco-av-pair=64:63:2d:6f:70:61:71:75:65:3d:01:00:00:00:00:00:00:00:00:00:00:00, cisco-av-pair=dc-protocol-map=1025,
2023-09-27 18:19:23,601 DEBUG  [SyslogListenerThread][[]] cisco.profiler.probes.radius.SyslogMonitor -:::::- Radius Packet Received 1267
2023-09-27 18:19:23,601 DEBUG  [SyslogListenerThread][[]] cisco.profiler.probes.radius.SyslogDefragmenter -:::::- parseHeader inBuffer=<181>Sep 27 18:19:23 iselab CISE_RADIUS_Accounting 0000000297 3 1  
cisco-av-pair=dhcp-option=host-name=Victor-s-S22, cisco-av-pair=dhcp-option=dhcp-class-identifier=android-dhcp-13, cisco-av-pair=dhcp-option=dhcp-parameter-request-list=1\, 3\, 6\, 15\, 26\, 28\, 51\, 58\, 59\, 43\, 114\, 108, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_MODEL_NUM=Samsung Galaxy S22+, cisco-av-pair=dot11-device-info=DEVICE_INFO_FIRMWARE_VERSION=WH6, cisco-av-pair=dot11-device-info=DEVICE_INFO_SALES_CODE=MXO, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_DEVICE_FORM=1, cisco-av-pair=dot11-device-info=DEVICE_INFO_OS_VERSION=Android 13, cisco-av-pair=dot11-device-info=DEVICE_INFO_COUNTRY_CODE=Unknown, 
cisco-av-pair=dot11-device-info=DEVICE_INFO_VENDOR_TYPE=2, cisco-av-pair=audit-session-id=A90510AC0000005BD7DDDAA7, cisco-av-pair=vlan-id=2606, cisco-av-pair=method=dot1x, cisco-av-pair=cisco-wlan-ssid=VIcSSID, 
cisco-av-pair=wlan-profile-name=ISE-AAA, Airespace-Wlan-Id=1, AcsSessionID=iselab/484624451/304,

终端属性信息已更新。

2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Device Analytics data  1: DEVICE_INFO_FIRMWARE_VERSION=[WH6]
2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Device Analytics data  1: DEVICE_INFO_SALES_CODE=[MXO]
2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Device Analytics data  1: DEVICE_INFO_DEVICE_FORM=[1]
2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Device Analytics data  1: DEVICE_INFO_OS_VERSION=[Android 13]
2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Device Analytics data  1: DEVICE_INFO_COUNTRY_CODE=[Unknown]
2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Device Analytics data  1: DEVICE_INFO_VENDOR_TYPE=[2]

2023-09-27 18:19:23,602 DEBUG  [RADIUSParser-1-thread-2][[]] cisco.profiler.probes.radius.RadiusParser -:A90510AC0000005BD7DDDAA7::::- Endpoint: EndPoint[id=,name=]
MAC: 0A:5A:F0:B3:B5:9C
	Attribute:AAA-Server	 value:iselab
	Attribute:Acct-Authentic	 value:Remote
	Attribute:Acct-Delay-Time	 value:0
	Attribute:Acct-Session-Id	 value:00000018
	Attribute:Acct-Status-Type	 value:Start
	Attribute:AcsSessionID	 value:iselab/484624451/304
	Attribute:Airespace-Wlan-Id	 value:1
	Attribute:BYODRegistration	 value:Unknown
	Attribute:CPMSessionID	 value:A90510AC0000005BD7DDDAA7
	Attribute:Called-Station-ID	 value:00-1e-f6-5c-16-ff
	Attribute:Calling-Station-ID	 value:0a-5a-f0-b3-b5-9c
	Attribute:Class	 value:CACS:A90510AC0000005BD7DDDAA7:iselab/484624451/303
	Attribute:ClientLatency	 value:0
	Attribute:DEVICE_INFO_COUNTRY_CODE	 value:Unknown
	Attribute:DEVICE_INFO_DEVICE_FORM	 value:PHONE
	Attribute:DEVICE_INFO_FIRMWARE_VERSION	 value:WH6
	Attribute:DEVICE_INFO_MODEL_NUM	 value:Samsung Galaxy S22+
	Attribute:DEVICE_INFO_OS_VERSION	 value:Android 13
	Attribute:DEVICE_INFO_SALES_CODE	 value:MXO
	Attribute:DEVICE_INFO_VENDOR_TYPE	 value:SAMSUNG
	Attribute:Device IP Address	 value:172.16.5.169
	Attribute:Device Type	 value:Device Type#All Device Types
	Attribute:DeviceRegistrationStatus	 value:NotRegistered
	Attribute:EndPointPolicy	 value:Unknown
	Attribute:EndPointPolicyID	 value:
	Attribute:EndPointSource	 value:RADIUS Probe
	Attribute:Event-Timestamp	 value:1695838756
	Attribute:Framed-IP-Address	 value:172.16.5.76
	Attribute:IPSEC	 value:IPSEC#Is IPSEC Device#No
	Attribute:Location	 value:Location#All Locations
	Attribute:MACAddress	 value:0A:5A:F0:B3:B5:9C
	Attribute:MatchedPolicy	 value:Unknown
	Attribute:MatchedPolicyID	 value:
	Attribute:MessageCode	 value:3000
	Attribute:NAS-IP-Address	 value:172.16.5.169
	Attribute:NAS-Identifier	 value:vimontes-wlc
	Attribute:NAS-Port	 value:260613
	Attribute:NAS-Port-Type	 value:Wireless - IEEE 802.11
	Attribute:Network Device Profile	 value:Cisco
	Attribute:NetworkDeviceGroups	 value:IPSEC#Is IPSEC Device#No, Location#All Locations, Device Type#All Device Types
	Attribute:NetworkDeviceName	 value:lab-wlc
	Attribute:NmapSubnetScanID	 value:0
	Attribute:OUI	 value:UNKNOWN
	Attribute:PolicyVersion	 value:0
	Attribute:PortalUser	 value:
	Attribute:PostureApplicable	 value:Yes
	Attribute:RequestLatency	 value:15
	Attribute:StaticAssignment	 value:false
	Attribute:StaticGroupAssignment	 value:false
	Attribute:Total Certainty Factor	 value:0
	Attribute:TotalAuthenLatency	 value:15
	Attribute:User-Name	 value:bob
	Attribute:cisco-av-pair	 value:dc-profile-name=Samsung Galaxy S22+, dc-device-name=Victor-s-S22, dc-device-class-tag=Samsung Galaxy S22+, dc-certainty-metric=40, 64:63:2d:6f:70:61:71:75:65:3d:01:00:00:00:00:00:00:00:00:00:00:00, dc-protocol-map=1025, dhcp-option=host-name=Victor-s-S22, dhcp-option=dhcp-class-identifier=android-dhcp-13, dhcp-option=dhcp-parameter-request-list=1\, 3\, 6\, 15\, 26\, 28\, 51\, 58\, 59\, 43\, 114\, 108, dot11-device-info=DEVICE_INFO_MODEL_NUM=Samsung Galaxy S22+, dot11-device-info=DEVICE_INFO_FIRMWARE_VERSION=WH6, dot11-device-info=DEVICE_INFO_SALES_CODE=MXO, dot11-device-info=DEVICE_INFO_DEVICE_FORM=1, dot11-device-info=DEVICE_INFO_OS_VERSION=Android 13, dot11-device-info=DEVICE_INFO_COUNTRY_CODE=Unknown, dot11-device-info=DEVICE_INFO_VENDOR_TYPE=2, audit-session-id=A90510AC0000005BD7DDDAA7, vlan-id=2606, method=dot1x, cisco-wlan-ssid=VIcSSID, wlan-profile-name=ISE-AAA
	Attribute:dhcp-class-identifier	 value:android-dhcp-13
	Attribute:dhcp-parameter-request-list	 value:1, 3, 6, 15, 26, 28, 51, 58, 59, 43, 114, 108
	Attribute:host-name	 value:Victor-s-S22
	Attribute:ip	 value:172.16.5.76
	Attribute:SkipProfiling	 value:false

属性更新会触发新的终端分析事件。分析策略将再次评估，并分配新的配置文件。

2023-09-27 18:19:24,098 DEBUG  [pool-533-thread-35][[]] cisco.profiler.infrastructure.profiling.ProfilerManager -:A90510AC0000005BD7DDDAA7::62cc7a10-5d62-11ee-bf1f-b6bb1580ab0d:Profiling:- Policy Android matched 0A:5A:F0:B3:B5:9C (certainty 30)
2023-09-27 18:19:24,098 DEBUG  [pool-533-thread-35][[]] cisco.profiler.infrastructure.profiling.ProfilerManager -:A90510AC0000005BD7DDDAA7::62cc7a10-5d62-11ee-bf1f-b6bb1580ab0d:Profiling:- EndPoint is profiled by Admin First: ADMINFIRST
2023-09-27 18:19:24,098 DEBUG  [pool-533-thread-35][[]] cisco.profiler.infrastructure.profiling.ProfilerManager -:A90510AC0000005BD7DDDAA7::62cc7a10-5d62-11ee-bf1f-b6bb1580ab0d:Profiling:- Policy Android matched 0A:5A:F0:B3:B5:9C (certainty 30)com.cisco.profiler.infrastructure.profiling.ProfilerManager$MatchingPolicyInternal@14ec7800

第四步：CoA和重新身份验证

当WiFi设备分析属性发生更改时，ISE必须为终端会话发送CoA。

2023-09-27 18:19:24,103 DEBUG  [pool-533-thread-35][[]] cisco.profiler.infrastructure.profiling.ProfilerManager -:A90510AC0000005BD7DDDAA7::62cc7a10-5d62-11ee-bf1f-b6bb1580ab0d:Profiling:- Endpoint 0A:5A:F0:B3:B5:9C IdentityGroup / Logical Profile Changed/ WiFi device analytics attribute changed. Issuing a Conditional CoA
2023-09-27 18:19:24,103 DEBUG  [pool-533-thread-35][[]] cisco.profiler.infrastructure.profiling.ProfilerManager -:A90510AC0000005BD7DDDAA7::62cc7a10-5d62-11ee-bf1f-b6bb1580ab0d:Profiling:- ConditionalCoAEvent with Endpoint Details : EndPoint[id=62caa550-5d62-11ee-bf1f-b6bb1580ab0d,name=]
MAC: 0A:5A:F0:B3:B5:9C
	Attribute:AAA-Server	 value:iselab
	Attribute:Airespace-Wlan-Id	 value:1
	Attribute:AllowedProtocolMatchedRule	 value:Default
	Attribute:AuthenticationIdentityStore	 value:Internal Users
	Attribute:AuthenticationMethod	 value:MSCHAPV2
	Attribute:AuthenticationStatus	 value:AuthenticationPassed
	Attribute:AuthorizationPolicyMatchedRule	 value:Catch Policy
	Attribute:BYODRegistration	 value:Unknown
	Attribute:CLASSIFICATION_FLOW	 value:none
	Attribute:CacheUpdateTime	 value:1695838764086
	Attribute:Called-Station-ID	 value:00-1e-f6-5c-16-ff
	Attribute:Calling-Station-ID	 value:0a-5a-f0-b3-b5-9c
	Attribute:ClientLatency	 value:0
	Attribute:DEVICE_INFO_COUNTRY_CODE	 value:Unknown
	Attribute:DEVICE_INFO_DEVICE_FORM	 value:PHONE
	Attribute:DEVICE_INFO_FIRMWARE_VERSION	 value:WH6
	Attribute:DEVICE_INFO_MODEL_NUM	 value:Samsung Galaxy S22+
	Attribute:DEVICE_INFO_OS_VERSION	 value:Android 13
	Attribute:DEVICE_INFO_SALES_CODE	 value:MXO
	Attribute:DEVICE_INFO_VENDOR_TYPE	 value:SAMSUNG
	Attribute:DTLSSupport	 value:Unknown
	Attribute:DestinationIPAddress	 value:172.16.5.112
	Attribute:DestinationPort	 value:1812<
	Attribute:Device IP Address	 value:172.16.5.169
	Attribute:Device Type	 value:Device Type#All Device Types
	Attribute:DeviceRegistrationStatus	 value:NotRegistered
	Attribute:DoReplicate	 value:false
	Attribute:EnableFlag	 value:Enabled
	Attribute:EndPointMACAddress	 value:0A-5A-F0-B3-B5-9C
	Attribute:EndPointPolicy	 value:Android
	Attribute:EndPointPolicyID	 value:ffafa000-8bff-11e6-996c-525400b48521
	Attribute:EndPointProfilerServer	 value:iselab.vimontes.cisco.com
	Attribute:EndPointSource	 value:RADIUS Probe
	Attribute:EndPointVersion	 value:4
	Attribute:FailureReason	 value:-
	Attribute:FirstCollection	 value:1695838763963
	Attribute:Framed-IP-Address	 value:172.16.5.76
	Attribute:IPSEC	 value:IPSEC#Is IPSEC Device#No
	Attribute:IdentityGroup	 value:Android
	Attribute:IdentityGroupID	 value:ffa36b00-8bff-11e6-996c-525400b48521
	Attribute:IdentityPolicyMatchedRule	 value:Default
	Attribute:IdentitySelectionMatchedRule	 value:Default
	Attribute:IsThirdPartyDeviceFlow	 value:false
	Attribute:LastActivity	 value:1695838764083
	Attribute:LastNmapScanTime	 value:0
	Attribute:Location	 value:Location#All Locations
	Attribute:LogicalProfile	 value:
	Attribute:MACAddress	 value:0A:5A:F0:B3:B5:9C
	Attribute:MatchedPolicy	 value:Android
	Attribute:MatchedPolicyID	 value:ffafa000-8bff-11e6-996c-525400b48521
	Attribute:MessageCode	 value:3000
	Attribute:NAS-IP-Address	 value:172.16.5.169
	Attribute:NAS-Identifier	 value:vimontes-wlc
	Attribute:NAS-Port	 value:260613
	Attribute:NAS-Port-Type	 value:Wireless - IEEE 802.11
	Attribute:Network Device Profile	 value:Cisco
	Attribute:NetworkDeviceGroups	 value:IPSEC#Is IPSEC Device#No, Location#All Locations, Device Type#All Device Types
	Attribute:NetworkDeviceName	 value:lab-wlc
	Attribute:NetworkDeviceProfileId	 value:b0699505-3150-4215-a80e-6753d45bf56c
	Attribute:NetworkDeviceProfileName	 value:Cisco
	Attribute:NmapScanCount	 value:0
	Attribute:NmapSubnetScanID	 value:0
	Attribute:OUI	 value:UNKNOWN
	Attribute:PolicyVersion	 value:0
	Attribute:PortalUser	 value:
	Attribute:PostureApplicable	 value:Yes
	Attribute:PostureAssessmentStatus	 value:NotApplicable
	Attribute:PreviousMACAddress	 value:0A:5A:F0:B3:B5:9C
	Attribute:RadiusFlowType	 value:Wireless802_1x
	Attribute:Response	 value:{Class=CACS:A90510AC0000005BD7DDDAA7:iselab/484624451/303; EAP-Key-Name=19:12:31:7e:8a:2e:d7:9f:3b:00:3e:ab:bd:27:22:2a:30:45:b8:7a:1b:ab:b6:1a:b1:e6:21:ee:bd:b1:2c:b8:f5:a8:c9:27:27:c1:0e:95:fa:a0:b6:dc:1f:a4:e6:98:2c:89:5e:b1:5c:11:56:ea:d9:93:a8:92:b0:47:57:3a:6e; MS-MPPE-Send-Key=****; MS-MPPE-Recv-Key=****; LicenseTypes=1; }
	Attribute:SSID	 value:3c-41-0e-31-77-80:VIcSSID
	Attribute:SelectedAccessService	 value:Default Network Access
	Attribute:SelectedAuthenticationIdentityStores	 value:Internal Users, All_AD_Join_Points, Guest Users
	Attribute:SelectedAuthorizationProfiles	 value:PermitAccess
	Attribute:Service-Type	 value:Framed
	Attribute:StaticAssignment	 value:false
	Attribute:StaticGroupAssignment	 value:false
	Attribute:StepData	 value:4= Normalised Radius.RadiusFlowType, 71=All_User_ID_Stores, 72=Internal Users, 95= WiFi_Device_Analytics.DEVICE_INFO_MODEL_NUM, 96= WiFi_Device_Analytics.DEVICE_INFO_MODEL_NUM, 97= WiFi_Device_Analytics.DEVICE_INFO_MODEL_NUM, 98= WiFi_Device_Analytics.DEVICE_INFO_MODEL_NUM, 99= EndPoints.EndPointPolicy, 100= EndPoints.EndPointPolicy, 101= EndPoints.EndPointPolicy
	Attribute:TLSCipher	 value:ECDHE-RSA-AES256-GCM-SHA384
	Attribute:TLSVersion	 value:TLSv1.2
	Attribute:TimeToProfile	 value:139
	Attribute:Total Certainty Factor	 value:30
	Attribute:TotalAuthenLatency	 value:15
	Attribute:UpdateTime	 value:0
	Attribute:User-Name	 value:bob
	Attribute:UserType	 value:User
	Attribute:allowEasyWiredSession	 value:false
	Attribute:dhcp-class-identifier	 value:android-dhcp-13
	Attribute:dhcp-parameter-request-list	 value:1, 3, 6, 15, 26, 28, 51, 58, 59, 43, 114, 108
	Attribute:epid	 value:epid:293810839814635520
	Attribute:host-name	 value:Victor-s-S22
	Attribute:ip	 value:172.16.5.76
	Attribute:undefined-186	 value:00:0f:ac:04
	Attribute:undefined-187	 value:00:0f:ac:04
	Attribute:undefined-188	 value:00:0f:ac:01
	Attribute:undefined-189	 value:00:0f:ac:06
	Attribute:SkipProfiling	 value:false

数据包捕获有助于确保ISE向WLC发送CoA。它还显示，在处理CoA之后收到新的访问请求数据包。

Radius CoA Packet after Endpoint Profiling 终端分析后的Radius CoA数据包

Radius CoA and New Access-Request after Endpoint Profiling 终端分析后的Radius CoA和新访问请求