Question

A network administrator has created a custom endpoint identity group named "Corporate-Tablets" in ISE. They manually add several tablet MAC addresses to this group through the Endpoints page. The profiler policy for these tablets is configured to match the built-in "Apple-iPad" profile, which is mapped to a different endpoint identity group. After profiling runs, the administrator notices the manually added tablets remain in the "Corporate-Tablets" group and are NOT reassigned to the Apple-iPad group. What explains this behavior?

Accepted Answer

Endpoints manually added to an identity group are treated as statically assigned, and the profiler does not override static group membership with dynamic profiling results.

Answer

The profiler CoA setting must be changed to Port Bounce before dynamic group reassignment can occur for manually added endpoints.

Answer

The Apple-iPad profile has a lower certainty factor than the Corporate-Tablets group, so ISE keeps the manual assignment.

Answer

Manually added endpoints are only reassigned after the endpoint purge policy deletes and re-learns them via a probe.