When creating a custom profiling policy in Cisco ISE for a specific device - such as an IoT connector identified by its MAC address - the profiling condition must accurately match the attribute that is reliably reported by the network access device. In many scenarios, especially with Cisco devices, the Called-Station-Id attribute in RADIUS messages contains the MAC address of the connecting device. However, due to the way some devices or controllers format this attribute, extra characters or prefixes may be appended. Using the condition "ENDSSWITH" ensures that the policy will correctly match the tail end of the Called-Station-Id string to the expected MAC address, regardless of any additional formatting at the beginning.
Radius_Called_Station-ID_ENDSSWITH_<MAC ADDRESS>
This condition tells ISE to examine the Called-Station-Id attribute from RADIUS messages and check whether it ends with the specified MAC address. This is a common and reliable method for profiling devices where the MAC address might be appended to additional text.