When setting up profiling in an environment using Cisco ISE for network access control, an organization must use non-proprietary protocols for collecting the information at layer 2. Which two probes will provide this information without forwarding SPAN packets to Cisco ISE? {Choose two.)

The RADIUS and SNMP query probes are standard, non-proprietary methods for collecting endpoint information without relying on SPAN. The RADIUS probe gathers Layer 2 data, specifically the endpoint's MAC address, from the Calling-Station-Id attribute within RADIUS authentication and accounting packets sent by the network access device. The SNMP query probe allows Cisco ISE to actively poll network devices and read their Management Information Bases (MIBs). By querying MIBs such as the BRIDGE-MIB, ISE can retrieve the device's MAC address table, providing essential Layer 2 visibility. Both methods meet the criteria of being non-proprietary and not requiring SPAN.

A. DHCP SPAN probe: This probe explicitly requires network traffic to be mirrored using a Switched Port Analyzer (SPAN) port, which the question disallows.
C. NetFlow probe: NetFlow is primarily designed to collect Layer 3 and Layer 4 information about IP traffic flows, not Layer 2 MAC address details.
E. DNS probe: This probe collects application-layer (Layer 7) information by analyzing the Fully Qualified Domain Names (FQDNs) in DNS lookups, not Layer 2 data.

1. Cisco Identity Services Engine Administrator Guide

Release 3.2

"Profiling Probes" section:

RADIUS Probe: "The RADIUS probe collects endpoint attributes that are sent from the network access device (NAD) in the RADIUS authentication and accounting packets." It lists Calling-Station-ID (the MAC address) as a key attribute.

SNMP Query Probe: "The SNMP query probe uses SNMP to query network devices for data about endpoints connected to them... ISE can query the following MIBs: ... BRIDGE-MIB". The BRIDGE-MIB contains the MAC address forwarding table.

DHCP SPAN Probe: "The DHCP SPAN probe is a passive probe that listens to DHCP packets that are spanned from a switch." This explicitly confirms its reliance on SPAN.

2. Cisco Live Presentation

BRKSEC-3699 - "Advanced ISE Services

Tips and Tricks"

2019

"Profiling Probes" slide: This presentation details the various ISE probes. It describes the RADIUS probe as collecting attributes from AAA packets and the SNMP Query probe as polling network devices for MIB data

including ARP and MAC tables. It contrasts these with probes like DHCP SPAN that require a SPAN/mirror port.

3. IETF RFC 2865

"Remote Authentication Dial In User Service (RADIUS)"

Section 5.31: This standard defines the Calling-Station-Id attribute

which is used to convey the MAC address of the connecting endpoint

confirming RADIUS as a source for Layer 2 information.

4. IETF RFC 4188

"Definitions of Managed Objects for Bridges"

Section 7: This standard defines the dot1dTpFdbTable within the BRIDGE-MIB

which contains "information about unicast entries for which the bridge has forwarding and/or filtering information." This is the MAC address table that the SNMP query probe can access.