topic Using AV-Pairs to add a description to a port based on the authe in Network Access Control

Using AV-Pairs to add a description to a port based on the authenticated user?

SHANNON WYATT — Mon, 11 Mar 2019 03:25:02 GMT

I recently saw a Cisco demo of ISE with a customer and the Cisco SE was setting the port description to the logged in username (dot1x). I can't find any docs on doing this. I did find some old ACS docs that mention using an AV pair and sending aaa:suplicant-name in the result, but that isn't working. I'm trying this on a 3750. and using ISE.

Using AV-Pairs to add a description to a port based on the authe

Marcin Latosiewicz — Fri, 10 May 2013 09:55:35 GMT

Shannon,

What version of IOS do you have on 3750 and can we see "debug radius" from there to see what ISE is sending?

Using AV-Pairs to add a description to a port based on the authe

jwmolenaar — Sat, 11 May 2013 12:23:50 GMT

Hi Shannon,

Using the command "show aaa attribute" shows an attributed named "rm-port-description" on my switches.

Perphaps you can use this attribute for the requested functionality, but I suspect that it will also depend on your hardware/software version details.

J.W. Molenaar

Using AV-Pairs to add a description to a port based on the authe

SHANNON WYATT — Sat, 11 May 2013 14:23:43 GMT

Thanks for the suggestion. A former co-worker, now a Cisco SE told me to do it with a macro and assign the macro with the cisco-av-pair=auto-smart-port=dot1x-port-description (dot1x-port-description is the name I gave it). It isn't getting applied though. Below is the macro:

User defined triggers

---------------------

Trigger Id: dot1x-port-description

Trigger description: dot1x-port-description

Trigger environment:

Trigger mapping function: {

if [[ $LINKUP == YES ]]

then conf t

interface $INTERFACE

macro description $TRIGGER

description suplicant-name

exit

if [[ $LINKUP == NO ]]

then conf t

interface $INTERFACE

no macro description $TRIGGER

description dynamic 802.1X port

exit

}

Re: Using AV-Pairs to add a description to a port based on the authe

Halyna — Fri, 13 Apr 2018 14:37:58 GMT

Hello! Did this configuration work for you? I'd like to add description with username to the running config after 802.1X authentication. But this config permanently adds - "desction supplicant-name", not "description {username}".

Thanks