Change a policy a host has by modifying device profile rule

[heretolearn]

Currently have device profile rules not linked to any policy. 

Then changed what host role the device profile rule give in registration settings. 

Devices in this group are not updating with the new Role. 

Deleting the device and NAC relearning/profiling to the same rule does then apply the new role. 

Is there a more automated way for the devices in a rule to update their role? 

Thanks

[Hatibi]

Hello heretolearn,

you can enable the automatic registration once the device matches the rule and define the role in the rule itself.

[heretolearn]

Correct this is enabled. 

For example I have a rule that had the role 'IOT-External-Only'

I changed this role to 'IOT-Internal-Access' 

But the devices that were in this rule are still showing the role 'IOT-External-Only' 

Is there not a way to have them update other than deleting them and NAC reprofiling them?

Thanks

[Hatibi]

Apparently there is no way to update the host when devices gets the role from the device profiler.

In the device profiling rule there are these options

"Confirm Device Rule on Connect"

"Confirm Device Rule on Interval X"

I tried in my lab by changing the role in the device profiling rule and made sure the device rule was reconfirmed from both disconnect/connect and in interval. The role stays the same.

In such case you can do another thing without needing to delete and re-register the hosts.

Go to Host view and select "Custom Filter"

Select for "Adapter" category ----> Status=Online 

Select for "Host" Category --> Role=IOT-External-Only

This will list to you all online devices with the old role.

Then select all entries and right-click -> "Set Host Role".

You can then set the new "IOT-Internal-Access" role to all those hosts.

 

[ebilcari]

If the devices share the same vendor (or similar MAC addresses) the Client tool can also be used from CLI:

$ client -mac 00:03:04* -op setRole Contractor
processing 2 operations: setRole Contractor
Found 1 matches for client
Set preferred Role for client Win10 to Contractor

Updated Client:

Win10
DBID = 4
MAC = 00:03:04:00:00:01
IP = null
Medium = Wired
Description = manually created
Status = Disconnected
State = Initial
Type = DynamicClient
Ident = null
UserID = null
ParentID = null
Role = Contractor