Cisco ISE Default Profiling Probes
Short answer
AB The HTTP and RADIUS profiling probes are enabled by default in Cisco ISE to passively identify endpoints using web traffic and authentication data.
Question
Key Takeaways
The question tests knowledge of Cisco ISE's out-of-the-box security posture; passive probes (HTTP/RADIUS) are enabled by default for immediate visibility, whereas active or dependent probes (NMAP/NetFlow) are disabled.
Identify the two profiling probes enabled by default in Cisco ISE: HTTP and RADIUS. Learn why these passive probes are standard while active tools like NMAP are not.
Common mistake: Candidates often incorrectly choose NMAP because it is highly effective at fingerprinting devices. However, NMAP is an active scanner that can cause network load and is disabled by default, making it a distractor.
Expert Analysis
Default Profiling Probes in Cisco ISE
Cisco Identity Services Engine (ISE) uses profiling probes to collect endpoint identity information. When the Profiling service is enabled, certain probes are activated automatically to ensure broad visibility without requiring manual configuration.
Why HTTP and RADIUS Are Correct
The two probes enabled by default are HTTP and RADIUS.
- RADIUS Probe: This probe analyzes authentication packets (Access-Request/Access-Accept) sent to ISE. Since ISE relies on RADIUS for network access control, this probe is always active to gather attributes like vendor-specific information (VSA), MAC address, and other identifiers from the authentication exchange. It is fundamental to how ISE identifies endpoints during login attempts.
- HTTP Probe: This probe captures HTTP traffic passing through the network (typically via SPAN or TAP interfaces configured for profiling). It extracts user-agent strings, host headers, and other HTTP metadata which are critical for identifying device types (e.g., iOS vs. Android vs. Windows). Because web traffic is ubiquitous, enabling this probe by default provides immediate value in device identification.
Why Other Options Are Incorrect
- NMAP (Option D): NMAP performs active scanning of IP addresses to discover open ports and services. Due to its intrusive nature and potential impact on network performance, it is disabled by default and must be explicitly enabled with caution. Comments often mistakenly select this due to its high accuracy, but it is not a default setting.
- NETFLOW (Option C): NetFlow probes require specific flow data collection configurations on upstream devices (like switches or routers). While powerful, they are not enabled out-of-the-box because they depend on external infrastructure support.
- DHCPSPAN (Option E): This probe requires DHCP monitoring via SPAN/port mirroring. Like NetFlow, it depends on specific network topology and switch configuration, so it is disabled by default to avoid unnecessary overhead on unsupported setups.
Exam Strategy
When studying Cisco ISE profiling, distinguish between passive and active probes. Passive probes like HTTP and RADIUS rely on existing traffic flows and are typically enabled by default for immediate operational visibility. Active probes like NMAP or dependency-based probes like NetFlow require explicit enablement due to their resource intensity or infrastructure prerequisites. Memorize the 'default' list to quickly eliminate options that sound too aggressive or complex.
Frequently Asked Questions
Why is NMAP not enabled by default in Cisco ISE?
Do I need to configure SPAN ports for HTTP profiling?
Community Votes
50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 2 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 2
-
ArchyinVa 👍 1The correct options are A. HTTP and B. RADIUS (the question on the page has an incorrect answer key showing B and D; the community vote correctly identifies A and B). ### Why HTTP and RADIUS Are the Correct Choices RADIUS Probe (Option B): The RADIUS probe runs by default even on nodes where the Profiling Service is not explicitly toggled. Cisco ISE requires RADIUS data collection to track endpoint authentication, authorization, session lifetimes, and device sensor data for Context Visibility. HTTP Probe (Option A): The HTTP probe is enabled by default to evaluate browser User-Agent strings. Several native ISE services—such as Central Web Authentication (CWA), Hotspot, Client Provisioning, and BYOD onboarding flows—rely directly on parsing the HTTP User-Agent header from redirected web browser traffic to identify client OS and device types. ### Why the Other Options Are Incorrect C. NETFLOW: NetFlow collection requires explicit network export configuration on switches/routers and must be manually enabled on the Cisco ISE Policy Service Node (PSN). D. NMAP: NMAP is an active network scanner that probes endpoints via port scanning and OS fingerprinting. Because active scanning can trigger IDS/IPS alarms, disrupt sensitive endpoints (like medical devices or printers), and add significant overhead, it is strictly disabled by default and requires administrative activation. * E. DHCPSPAN: DHCP SPAN (listening to mirrored DHCP traffic on a dedicated network interface) requires manual configuration of both the physical interface on the ISE appliance and port mirroring (SPAN/RSPAN/ERSPAN) on the network switches.
-
Cname 👍 1As per the Cisco documentation, NetFlow, DHCP SPAN, and NMAP probes are disabled by default. Some people suggest NMAP as a possible answer, but I believe that's incorrect because NMAP performs active endpoint scans and is not enabled by default. Based on the documentation, RADIUS and HTTP are the better choices.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.