I modified this script written by Joe Clarke to better see the ISE dACL status on switch ports. However, if the switch is a large chassis switch like a 9410 with many ports, the display output stops before getting through all of the interfaces. Is there a timer that can be tweaked? Maybe something else is going on?
event manager applet SHOW_ISE_DACL authorization bypass
event cli pattern "(sh|sho|show)\s+(ise)\s+(dacl)" enter
action 001.1 cli command "enable"
action 001.2 puts "\n\nShow ISE dACL (List shows ONLY connected ports)"
action 001.3 puts "Shows Connected Ports and the dACL that is applied to the Port"
action 001.4 puts "--------------------------------------------------------------"
action 001.5 cli command "show auth sessions"
action 002.1 foreach _line "$_cli_result" "\n"
action 002.2 regexp "^([A-Z][a-z][0-9][^[:space:]]+)" "$_line" match _intf
action 002.3 if $_regexp_result eq "1"
action 003.1 cli command "show auth session interface $_intf det | i xACSACLx"
action 004.1 foreach _iline "$_cli_result" "\n"
action 004.2 regexp "^(.*xACSACLx.*)\r$" "$_iline" match _dacl
action 004.3 if $_regexp_result eq "1"
action 004.4 set string "$_dacl"
action 004.5 string trimleft "$_dacl" " "
action 004.8 puts "$_intf - $_string_result"
action 004.9 end
action 099.1 end
action 099.2 end
action 099.3 end
Thanks,
Andrew
