Connect. Secure. Manage.
Cisco ISE Device Profiling
Identify connected device types with Cisco ISE and turn reliable profiling evidence into appropriate access policies and managed exceptions.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco ISE device profiling uses observed details to help classify connected equipment. That can improve inventory and inform access rules, especially for devices without a normal user login. We check which evidence is available and how much trust it warrants. Looking like a printer is useful context, but it is not strong proof of identity.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Establish the question profiling should answer
We start with the operational problem. The customer may need to find unmanaged equipment, separate phones from workstations or prepare for a network-access rollout. A profiling project should have a defined use for its results rather than simply enabling every available data source and collecting attributes indefinitely.
We find the endpoint groups that matter and the decisions that will depend on them. Some classifications may be useful only for reporting, while others may influence a restricted access policy. Those uses require different confidence and testing. The design records where classification remains advisory and where an incorrect result could interrupt a business process.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Review the available evidence sources
Profiling depends on the observations that reach ISE. We examine the supported probes, network-device information and relevant infrastructure integrations for the chosen release. DHCP attributes, discovery information and other endpoint characteristics can be incomplete or altered by network boundaries. So the absence of an attribute does not necessarily mean the endpoint lacks that property.
The collection path is documented from the access network to the policy service. Firewalls, relay behaviour and admin permissions can affect visibility. We prefer a deliberate set of useful sources to indiscriminate collection. Any active discovery is separately authorised and assessed against the sensitivity of connected equipment, particularly building systems or operational devices that may not tolerate routine scanning.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Build a representative endpoint sample
A useful pilot includes known examples of the equipment that should be distinguished. We compare the observed classification with an independently confirmed inventory, including model variations and firmware changes. Similar devices may present different attributes, while unrelated devices may share a manufacturer identifier.
We also include unknown and ambiguous endpoints. The aim is not to force every device into a confident-looking category. An honest unknown result can be safer than a misleading classification that triggers privileged access. The report identifies which attributes are dependable enough for the intended use and where further inventory or authentication work is needed.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Keep classification separate from authentication
Profiling complements access control. It does not replace a cryptographic credential or an authorised identity record. We consider how a classification might be imitated and what an attacker would gain if that happened. A policy for a non-authenticating device should therefore grant only the services required for that device's purpose.
Where profiling informs authorisation, we agree the resulting network restrictions and check them on the enforcement device. A profile label alone does not block traffic. The design may combine the classification with a registered endpoint, location or another available condition, provided the relevant platform supports the combination and the customer can maintain its underlying records.
Control changes and reclassification
Profiles can change when new observations arrive or vendor definitions are updated. We review the effect of reclassification on current sessions and any supported authorisation-change behaviour. A device should not move unexpectedly between access levels without the service owner understanding why that transition can occur.
Custom profiling rules need ownership and a review process. We document the reason for each rule, the evidence it uses and the devices against which it was tested. Rules created to solve one unusual endpoint should not silently override broader classifications or remain indefinitely after that endpoint has been replaced.
Make the results useful to operations
The output should help engineers answer practical questions: which endpoints are unknown, which changed classification and which are using an exception? We agree reporting views and a route for correcting inventory records. A long list of profile names is not a useful handover unless someone knows what action to take from it.
We also define data access and retention. Endpoint attributes, addresses and associated user information can be sensitive. Collection is limited to the approved purpose, and troubleshooting exports are handled through a protected channel. The project does not assume that infrastructure metadata is anonymous merely because it is technical.
Validate before enforcing
Acceptance compares expected classifications with observed results and tests any policy consequence. We include a deliberately ambiguous device and a change in an observed attribute where safe. Findings distinguish an identification gap from an enforcement defect so that remediation reaches the right owner.
MCI can provide profiling as an inventory-led review or as part of a wider Cisco ISE programme. The deliverable is an evidence-backed classification approach, with limitations and support duties visible, rather than an assurance that every connected device can be identified perfectly.
Technical references
- Cisco ISE overview — Cisco / Cisco Meraki
- Cisco ISE compliance and posture — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.