Security

Hi,
Got  tac case for this  but thought I'd ask around to see if anyone else is seeing this.

We normally use  the DHCP collector to identify a device. As part of our NAC project I've enabled dhcp, lldp, snmp http on our  2MAC 930 switches and everything seems to be working from the  fingerprint point of view.  However ....

Recently I've seen  endpoint database entries where  instead of  identifying a device, I'm seeing endpoints with a category of Generic and the OS family  ifdentifies the MAC OUI manufacturer.

Looking  at individual endpoint entries, they all have "other" fingerprints ( usually windows 10) ... and these are devices that have been around for years .

Looking at clearpass  with a filter of  profile conflict=true and  device category = Generic  i can see an increasing number of conflict devices  where the primary  fingerprint is the mac oui.

Has anyone else seen this sort of thing ?

Rgds
Alex

ok so a couple of things 

1). Issue will be fixed in 6.11.3
2). There was a hot fix 2 to deal with profiling issues

but ...
i installed that HF when it came out  but  cppm didnt say i had on the master publisher or any of the  other nodes.  When i downloaded it again, the status on the master publisher changed to installed. and the logs from the update GUI showed that i had indeed installed it  back in march.

so as its still  causing problems going to upgrade to  the HF 5 thats just came out  ( needs a reboot after install) so we'll see if that fixes things
A