Cisco ISE and Cisco 9300 Auto Smartports

[Chris Terry]

I'm testing a config change for FlexConnect APs after they authenticate with ISE. We have a base config that is a normal access port config with 802.1x. Once the FlexConnect AP authenticates with ISE I'm having it send the cisco-av-pair for the auto smartport to the switch. I have the macro set up on the switch side. The macro changes it to the trunk port with a native VLAN and not 802.1x config

The issues I'm running into is that the macro is not applying to the port. I can get it to work after a reboot of the switch, but it doesn't work anytime after that. Is there anything that I may be missing? Is there an alternative to smartports to change the port config while the AP is connected and revert the port once it is disconnected? 

ISE: Version 3.2 Patch 4
Switch: Cisco 9300 16.9.4

[ahollifield]

My first thought would be a switch issue.  16.9.4 is quite old at this point.  I would start with upgrading the switch to IOS-XE 17.9 before spending any additional time troubleshooting.

[Chris Terry]

Upgraded to 17.9.4a. No change. Works after a reboot, doesn't work anytime after.

[ahollifield]

Do you see anything in the switch logs when ISE responds with the Smart Port name?  If not, my next suggestion would be a TAC case.

[Arne Bier]

Hi @Chris Terry 

This has been discussed in the past - check this thread out - and I can't recall whether or not folks had success - but instead of smartports, have you tried Interface Templates?

@ahollifield does have a point about the IOS code version 

[Chris Terry]

It ended up being a license issue with the switch. The DNA essentials license was not active. It's a lab switch that isn't used too often and the config for the smart licensing needed to be updated.

I wasn't able to get templates to work very well, but I didn't spend too much time on that. After fixing the license issue, the smart ports work pretty consistently now and do exactly what we need.