ACTIVE TIMER WHEN USING NETFLOW MAC

To discover and profile neighbor devices connected to the switch or controllerĪddress Resolution Protocol (ARP) information read from the networkĭevices. This table contains one or more rows per physical network connection known to this agent readįrom LLDP (Link Layer Discovery Protocol)-capable devices. To discover neighbor devices connected to the switch or controller configured Provides the cached information obtained via receiving CDP (Cisco Discovery Protocol) messages from CDP-capable devices. IP devices discovered through SNMP or subnet scans (RFC1213). Table 1: SNMP MIBs Used by the SNMP CollectorĪ textual description of the entity used both for profiling switches, controllers, and routersĬonfigured in ClearPass, and for profiling printers and other static Table 1 describes the MIBs used by the SNMP Collector. For related information, see SNMP Configuration for Wired Network Profiling. Profile static IP devices in the network. SNMP Collectorīy reading the Simple Network Management Protocol (SNMP) MIBs of network devices is used to discover and Uses the OnGuard os_type attribute to derive a profile. This agent can collectĪnd send operating system details from endpoints during authentication. Profiler uses dictionaries to derive profilesĪgent performs advanced endpoint posture assessment. These attributes are collected by the ActiveSync plug-in Sync protocol, the device provides attributes such as device-type and user-agent. When a device communicates with an Exchange server using the Active Useful to profile devices such as printers that might be configured HTC™ Android, Samsung™ Android, or Motorola® Droid, etc.

ACTIVE TIMER WHEN USING NETFLOW MAC

This information with MAC OUI, the ClearPass Profiler can classify a device as An example is Android™ĭevices where DHCP fingerprints can only classify a device as genericĪndroid, but it cannot provide more details regarding the vendor. The MAC OUI is acquired through various authentication mechanisms, such as 802.1X and MAC address authentication. Thus, the MAC OUI indicates the specific vendor for that device. The MAC OUI (Organization Unique Identifier) is expressed in the first 24 bits of a MAC address for a network-connected device. User-agent strings are collected from the following: Īruba controller through an IF-MAP (Interface for Metadata Access Points) interface Strings sent by browsers in the HTTP protocol are useful to further Is the Apple family of smart devices for example, DHCP fingerprints cannot distinguish To rely on any other fingerprinting information.įingerprinting alone cannot fully classify a device. These devices into their appropriate category, OS family, and name without having The information collected is definitive, ClearPass Profile can directly classify Then posts this information to the ClearPass Profile. Information from all devices during the onboarding process. ClearPass Onboard CollectorĬlearPass Onboard collects authentic device Supported versions are NetFlow v5 through v9 and IPFIX (Internet Protocol Flow Information eXport). The ClearPass Policy Manager NetFlow Collector provides the ability to identify the open ports of a device connected to a network by analyzing the received NetFlow packets. By analyzing the data provided by NetFlow, a network administrator can determine things such as the source and destination of traffic, class of service, and the causes of congestion. NetFlow provides the ability to collect IP network traffic as it enters or exits an interface. You can configure multiple ip helper-address statements to send DHCP packets to servers other than the DHCP In addition to fingerprints, DHCP also provides the host nameĪruba controller and Cisco switch to send DHCP traffic to the ClearPass server, enter the following CLI commands: TheseĭHCP packets are decoded by ClearPass Policy Manager to arrive at the appropriate device category, You can configure switches and controllers to forwardĭHCP Discover, Request, and Inform packets to ClearPass. Most devices that use the DHCP mechanism to acquire an IP address List from the Discover and Request packets can uniquely fingerprint Option 55 (parameter request list), option 60 (vendor class), and the options

Dynamic Host Configuration Protocol (DHCP) attributes such as

Active timer when using netflow