topic Re: Cisco ISE and Cisco 9300 Auto Smartports in Network Access Control

Cisco ISE and Cisco 9300 Auto Smartports

Chris Terry — Fri, 23 Feb 2024 17:30:18 GMT

I'm testing a config change for FlexConnect APs after they authenticate with ISE. We have a base config that is a normal access port config with 802.1x. Once the FlexConnect AP authenticates with ISE I'm having it send the cisco-av-pair for the auto smartport to the switch. I have the macro set up on the switch side. The macro changes it to the trunk port with a native VLAN and not 802.1x config

The issues I'm running into is that the macro is not applying to the port. I can get it to work after a reboot of the switch, but it doesn't work anytime after that. Is there anything that I may be missing? Is there an alternative to smartports to change the port config while the AP is connected and revert the port once it is disconnected?

ISE: Version 3.2 Patch 4
Switch: Cisco 9300 16.9.4

Re: Cisco ISE and Cisco 9300 Auto Smartports

ahollifield — Fri, 23 Feb 2024 19:33:50 GMT

My first thought would be a switch issue. 16.9.4 is quite old at this point. I would start with upgrading the switch to IOS-XE 17.9 before spending any additional time troubleshooting.

Re: Cisco ISE and Cisco 9300 Auto Smartports

Arne Bier — Fri, 23 Feb 2024 20:08:24 GMT

Hi @Chris Terry

This has been discussed in the past - check this thread out - and I can't recall whether or not folks had success - but instead of smartports, have you tried Interface Templates?

@ahollifield does have a point about the IOS code version

Re: Cisco ISE and Cisco 9300 Auto Smartports

Chris Terry — Mon, 26 Feb 2024 18:41:31 GMT

Upgraded to 17.9.4a. No change. Works after a reboot, doesn't work anytime after.

Re: Cisco ISE and Cisco 9300 Auto Smartports

ahollifield — Mon, 26 Feb 2024 18:47:33 GMT

Do you see anything in the switch logs when ISE responds with the Smart Port name? If not, my next suggestion would be a TAC case.

Re: Cisco ISE and Cisco 9300 Auto Smartports

Chris Terry — Sun, 03 Mar 2024 19:59:22 GMT

It ended up being a license issue with the switch. The DNA essentials license was not active. It's a lab switch that isn't used too often and the config for the smart licensing needed to be updated.

I wasn't able to get templates to work very well, but I didn't spend too much time on that. After fixing the license issue, the smart ports work pretty consistently now and do exactly what we need.