ip device tracking on 6880

[Leroy Plock]

Hello. We are trying to configure a C6880-X-LE for ISE. The "ip device tracking" commands are not available. What are we doing wrong? Thanks.

[Leroy Plock]

So we've gotten this far: the device tracking configuration commands have completely changed. To configure device tracking you configure a device-tracking policy then apply it to the interface. We are still having some issues and need a reference guide, but can't find one. Can anyone point me to a command reference and/or configuration guide for device-tracking on a 6880-X? We are running 15.2(1)SY

[jcockburn]

Hi Leroy,

I got this info from a Cisco Eng but I agree we really need more info...

If you have something to share please update as well...

To configure enable device tracking on 15.2(1)SY and use the default configured settings, see below:

 -----start config-----

Switch_IPDT(config)#device-tracking policy Default 

Switch_IPDT(config-device-tracking)#exit

You can then attach the policy to an interface or a VLAN as shown below:

Switch_IPDT(config)#int g1/1

Switch_IPDT(config-if)#device-tracking attach-policy Default 

Switch_IPDT(config-if)#end

Switch_IPDT(config)#vlan configuration 1

Switch_IPDT(config-vlan-config)#device-tracking attach-policy Default

Once the policy is attached to a VLAN or interface, you can then view the device-tracking database using "show device-tracking database".

-----end config-----

Let me know if you implement this.

Hope this helps

Ciao

JC

[Leroy Plock]

JC,

That's basically it. The commands and behavior have changed. As you say, you define a policy and attach it to an interface or SVI. Also, turning on dot1x on an interface (authentication port-control auto) will automatically apply the "BUILT-IN-SISF-POLICY" policy to the interface, though this can't be seen in the "show run" output.

We ran into a couple of issues along the way. First, we uncovered a bug (CSCuu47026) that caused some device tracking entries to age out, the ARP probe to refresh them wasn't working. This has been fixed with release 152-1.SY1a (and other releases according to bug tracker.)

Also, you now must have an SVI for the VLAN or the ARP probes won't work. Previously you could turn this on "using the ip device tracking probe use-svi" command, now it is the default behavior and can't be turned off.

We had to work with a TAC engineer to figure all this out, we never did find good documentaiton.

[jcockburn]

Hi Leroy,

Thanks for the update...that will be very helpfull.

Documentation on this product is very sketchy at best...

Ciao

JC