Using Ansible to remove authentication open for ISE enforcement

[waqas gondal]

Hi

I am working on putting ISE into enforcement mode on production switches for 802.1x wired auth.

Currently the access interfaces all have authentication open which needs to be removed.

I have Ansible installed and ready to configure switches.

Is there anyway I could configure a playbook to find interfaces that have 'authentication open' and remove it?

This type of config would also help switch to c3pl down the road.

Thanks!

Waqas

[Arne Bier]

If you are using port profiles on the switch, then you can no longer rely on the show run-config command, since the interface statements won't contain all the commands, but will contain port profiles instead. 

Perform a show derived-config and then filter out the interfaces that contain the statement authentication open - I am no Ansible expert, but perhaps they have such logic/tools?

One other approach. If you cycle through every interface and apply the command below, it will effectively remove "authentication open" if it exists, or do nothing at all.

no authentication open

[waqas gondal]

Hi Arne
Thanks for the reply!
The show run interface command does work to display 'authentication open' under the interface.
The issue is more about being able to revert if enforcement doesn't go as planned. In this case it would be a bit more effort to put authentication open back on only the access ports and exclude the wireless access points. Doing that for many switch stacks is pretty time consuming.
Ansible playbooks do have tasks which can follow a sequence of conditions.
I should probably be asking the Ansible forum about this.
Thanks again!
Waqas

[Arne Bier]

It's definitely an interesting DevOps type of discussion and others might find themselves in the same boat. There is still the  "Neanderthal approach" would involves saving the config before the changes (save the running config to flash and name the file appropriately) - and if you need to revert, then copy flash:/emergency-file.cfg run-config