Hello everyone,
I had a requirement to trigger a script on a switch using Cisco ISE upon successful authorization of an endpoint. For this, i used the Cisco Autosmart port feature and the script looks like below. The requirement was that by default all the switchports on the switch will be configured for VLAN 106 (access) and VLAN 107 (voice). But depending upon the type of endpoint being connected, there would be a change in the switchport configuration. This requirement perfectly works when we have a single switch but in a dual stack switch environment we would have VLAN 108 and VLAN 109 on the secondary switch. Just wondering if there is a way in IOS shell scripting i can leverage to add an additional condition to the same script check the interface number before applying the configuration. For example: Switch1 in a stack will have Gi1/0/x while the Switch 2 in a stack will have Gi2/0/x..
Any insights will be highly appreciated.
macro auto execute ISE_AP_CONFIG {
if [[ $LINKUP == YES ]]; then
conf t
default interface $INTERFACE
interface $INTERFACE
macro description $TRIGGER
description Wireless
switchport trunk native vlan 112
switchport mode trunk
device-tracking attach-policy IPDT_POLICY
ip access-group ACL-DEFAULT in
authentication event fail action next-method
authentication event server dead action authorize vlan 112
authentication host-mode multi-host
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate 28800
authentication timer inactivity 180
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout tx-period 10
storm-control broadcast level 10.00
storm-control multicast level 10.00
spanning-tree bpduguard enable
exit
fi
if [[ $LINKUP == NO ]]; then
conf t
default interface $INTERFACE
interface $INTERFACE
no macro description
description User_Segment_1
switchport access vlan 106
switchport mode access
switchport voice vlan 107
device-tracking attach-policy IPDT_POLICY
ip access-group ACL-DEFAULT in
load-interval 30
authentication event fail action next-method
authentication event server dead action authorize vlan 206
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-domain
authentication open
authentication order mab dot1x
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate 28800
authentication timer inactivity 180
authentication violation replace
mab
no snmp trap link-status
dot1x pae authenticator
dot1x timeout tx-period 10
storm-control broadcast level 1.00
no mdix auto
spanning-tree portfast
spanning-tree bpduguard enable
end
