Cisco ISE Profiling Wrong: Endpoint Profile When a Phone Becomes a Workstation

Cisco ISE · Techclick CLI troubleshooting lab

A Cisco phone gets the data VLAN. Profile says Windows Workstation. Voice is dead.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Cisco ISE for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

Profiling feeds (DHCP, CDP/LLDP, HTTP) decide the profile. If those probes are missing, ISE guesses wrong and authorization follows the guess.

Why this ticket shows up

Authorization often uses profile as a condition. A wrong profile is a wrong VLAN.

Symptoms operators actually see

• Phone in data VLAN

• Profile is Workstation

• DHCP probe disabled

• Switch not sending device-sensor

CLI first — copy this block

Run these on the Cisco ISE device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show device-sensor cache interface Gi1/0/4
show lldp neighbors Gi1/0/4
show cdp neighbors Gi1/0/4 detail
show authentication sessions interface Gi1/0/4 details

How to read that output

If the switch has no LLDP/CDP attributes, ISE never saw a phone. Profiling then uses MAC OUI and may call it a PC.

Triage order

1. Check device-sensor / LLDP on the switch

2. Enable the missing probe on ISE

3. Re-profile the endpoint

4. Confirm authorization uses the phone profile

5. Reseat the phone once

Classic traps

What you see	Real cause	Fix
Hardcode voice VLAN on all ports	One probe is off	Fix profiling
Create a MAC exception forever	Next phone will fail too	Fix probes
Disable profiling	Auth conditions need it	Repair feeds

Proof the ticket is closed

• Profile is Cisco-Device / IP-Phone

• Voice VLAN assigned

• Phone registers

Say this in an interview

A phone in the data VLAN is a profiling-feed problem until device-sensor proves ISE saw CDP/LLDP.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/