Security

I cannot find a document that outlines all information that can be gathered and shared using the IF-MAP protocol so hence a question about it:

If you are using the open standard IF-MAP to gather profiling information about an endpoint, is it still necessary to configure an additional IP-Helper, especially in a scenario where all traffic is tunneled to a gateway that is IF-MAP enabled?

DHCP is going to provide a quick initial profile, while IF-MAP can provide more detail about the client and potentially more granular information for the profiler.  For profiling, more information is always the better option.

I cannot find a document that outlines all information that can be gathered and shared using the IF-MAP protocol so hence a question about it:

If you are using the open standard IF-MAP to gather profiling information about an endpoint, is it still necessary to configure an additional IP-Helper, especially in a scenario where all traffic is tunneled to a gateway that is IF-MAP enabled?

Thanks Carson,

When you mention Quick Initial Profile does this mean that IF-MAP needs more time? For example, a DHCP discover that has to go through the Gateway will that result in the Gateway publishing the DHCP fingerprint through IF-MAP, or is IF-MAP a slower process looking for other information about the client? Just curious to see how it works. 

In an access request is noticed Fingerprinting details (see below), it would be great I could reconstruct the source of the fingerprint from Clearpass. I can of course test this out in my lab but maybe someone can point me to a document. 

DHCP is going to provide a quick initial profile, while IF-MAP can provide more detail about the client and potentially more granular information for the profiler.  For profiling, more information is always the better option.

I cannot find a document that outlines all information that can be gathered and shared using the IF-MAP protocol so hence a question about it:

If you are using the open standard IF-MAP to gather profiling information about an endpoint, is it still necessary to configure an additional IP-Helper, especially in a scenario where all traffic is tunneled to a gateway that is IF-MAP enabled?

As mentioned in the AOS 8 user guide, IF-MAP collects HTTP user agent and mDNS data.  Both of those items require some level of either higher level OS operation or user involvement.

Thanks Carson,

When you mention Quick Initial Profile does this mean that IF-MAP needs more time? For example, a DHCP discover that has to go through the Gateway will that result in the Gateway publishing the DHCP fingerprint through IF-MAP, or is IF-MAP a slower process looking for other information about the client? Just curious to see how it works. 

In an access request is noticed Fingerprinting details (see below), it would be great I could reconstruct the source of the fingerprint from Clearpass. I can of course test this out in my lab but maybe someone can point me to a document. 

DHCP is going to provide a quick initial profile, while IF-MAP can provide more detail about the client and potentially more granular information for the profiler.  For profiling, more information is always the better option.

I cannot find a document that outlines all information that can be gathered and shared using the IF-MAP protocol so hence a question about it:

If you are using the open standard IF-MAP to gather profiling information about an endpoint, is it still necessary to configure an additional IP-Helper, especially in a scenario where all traffic is tunneled to a gateway that is IF-MAP enabled?