A university keeps seeing unknown laptops profiled as printers when a single DHCP fingerprint matches the printer rule. The team wants a profile applied only when the strongest probe evidence clears a confidence threshold, with weaker evidence falling through to the unknown category. Which profiling policy control provides that gating in ISE?
Select an answer to reveal the explanation.
Short Explanation
The minimum certainty factor sets how strong the evidence must be before you assign a profile. It’s like a bouncer at the door: endpoints that don’t meet your confidence threshold stay in the unknown category, even if one fingerprint matches.
Full Explanation
ISE calculates a certainty factor for an endpoint profile from matching profiling rules and their associated certainty factors. The minimum certainty factor setting controls whether ISE assigns the profile: endpoints below the configured minimum remain unknown. This threshold can help avoid assigning a printer profile when the evidence is insufficient, though it does not guarantee that a misleading DHCP fingerprint will be outweighed by other evidence. Matching a MAC address OUI or DHCP option 55 fingerprint alone can identify a device based on that condition, but neither is a confidence threshold. Enabling only the DHCP probe changes which evidence is collected; it does not gate profile assignment on certainty factor. The certainty factor threshold is a profiling setting, not an authorization policy condition. Check the endpoint's profile and certainty factor in the ISE endpoint details after a live probe.