A hospital's medical devices sit on a VLAN whose SVI relays DHCP to a central server, and profiling must use the DHCP fingerprint plus the HTTP User-Agent string from that same VLAN. The PSN serving these sessions is 10.5.20.15. Which DHCP helper and SPAN setup feeds both profiling probes?
Select an answer to reveal the explanation.
Short Explanation
Set the SVI’s extra DHCP helper to 10.5.20.15, mirror HTTP traffic from the device VLAN to that PSN, and enable both DHCP and HTTP probes on the serving node. You’re giving each profiling signal its own lane: DHCP fingerprints arrive through the helper, while HTTP User-Agent strings arrive through SPAN.
Full Explanation
The DHCP probe needs DHCP packets delivered to ISE; a standard method is adding the PSN as an extra helper address on the SVI so the relay forwards a copy of client requests alongside the copy sent to the central DHCP server. DHCP options such as parameter request lists and vendor class identifiers can provide profiling data. The HTTP probe parses headers such as User-Agent from live traffic, so a SPAN session sourced on the device VLAN and delivered to a PSN interface feeds it. Enable both probes on the serving node; a disabled probe does not process its corresponding data. The SNMP query probe does not substitute for the HTTP probe because it obtains information by querying network devices rather than parsing HTTP headers. A mirror sent to a separate RSPAN collector does not feed the PSN unless the mirrored traffic is also delivered to a PSN interface. LLDP and CDP do not provide the required DHCP fingerprint, so they cannot replace the DHCP probe. Probe enablement is configured per node, so verify it on every PSN that might handle the session.