Unable to get EEM scripting to detect MAC

[reinier]

I have created a simple EEM script to detect certain devices that should be put into a special VLAN and rename the port.  I have tested it with the first 6 characters of my laptop MAC and nothing triggers:

event manager environment my_mac_oui 00:05:1b
event manager applet detect-mac
 event mat mac-address "^$my_mac_oui"
 action 001 cli command "enable"
 action 002 cli command "config t"
 action 003 cli command "interface $_mat_intf_name"
 action 004 if $_mat_notification eq "add"
 action 005  cli command "switchport access vlan 207"
 action 006  cli command "desc Exterity"
 action 007 else
 action 008 cli command "switchport access vlan 999"
 action 009 end
 action 010 cli command "end"

I have tried to run the code replacing the variable with my full MAC, still with no joy.  I found this script somewhere on this forum to simply lookup the MAC and name the port and it does nothing either:

event manager applet detect-mac
 event mat interface regexp GigabitEthernet.* type add
 action 001 cli command "enable"
 action 002 wait 3
 action 003 cli command "show cdp neigh $_mat_intf_name detail"
 action 004 regexp "Device ID:" $_cli_result
 action 005 if $_regexp_result eq 0
 action 006  cli command "config t"
 action 007  cli command "int $_mat_intf_name"
 action 008  cli command "description Device: $_mat_mac_address"
 action 009  cli command "end"
 action 010 end

Any ideas?  This code is running on a 3560CG running  15.2(2)E6.

[Joe Clarke]

First, Cisco uses MACs in the xxxx.xxxx.xxxx format.  The second policy looks like it should work.  Do you see it running when you do "show event manager history events"?  If so, you may want to enable "debug event manager action cli" to see if there's an issue (like AAA command authorization) that prevents CLI commands from running correctly.

[reinier]

My first script I took from an older post I found on here and the OUI was in that format.  Here is the current script that I put on the switch.  Nothing shows up when I do "show event manager history events".  I have tried the script on my 3850 running 03.07.02E and I have the same results.

event manager applet detect-mac
 event mat mac-address 847b.eb59.8194
 action 001 syslog msg "PLUGGED IN!"
 action 002 cli command "enable"
 action 003 cli command "config t"
 action 004 cli command "interface $_mat_intf_name"
 action 005 if $_mat_notification eq "add"
 action 006  cli command "switchport access vlan 207"
 action 007  cli command "desc Exterity"
 action 008 else
 action 009 cli command "switchport access vlan 999"
 action 010 end
 action 010 cli command "end"

I have verified that my MAC shows up:

 999    847b.eb59.8194    STATIC      Gi1/0/1

I have tried to shut/no shut the port, remove the VLAN completely, delete and re-add the script.  Both switches work with the other applets I created to change ports for APs and trunked switches, with no issues.  It's just the MAT applets that I can't seem to get to work.

[Joe Clarke]

There was a bug, but it is fixed in your version of code, at least in 15.2(2)E6.  Can you try this applet on your 3560 switch:

event manager applet matt

 event mat interface regexp GigabitEthernet.*

 action 1.0 syslog msg "FOUND MAC $_mat_mac_address"

[reinier]

I have applied the matt applet to both the 3850 and 3650 and it still does not appear to be working.

[Joe Clarke]

This might be a regression of the bug then.  I suggest you open a TAC service request so that this can be analyzed further.