Automatically Set Port Descriptions

[Joe Clarke]

In preparing for CiscoLive! in San Diego, I am provisioning our access layer 3560-E switches.  Since things have a tendency to change a lot at an event like CiscoLive! I thought it would be best to make sure our port descriptions are always up-to-date when it comes to reflecting what devices are connected.  To help me do that, I wrote up this small EEM applet policy.  It will update the port's description based on the CDP neighbor learned on that port.  This policy requires EEM 3.2, so you're looking at 12.2(55)SE or higher for the 3560s.  It will also work on 3750s and ISR G2 routers running 15.x code.

event manager applet update-port-description
 event neighbor-discovery interface regexp GigabitEthernet.* cdp add 
 action 1.0 cli command "enable"
 action 2.0 cli command "config t"
 action 3.0 cli command "interface $_nd_local_intf_name"
 action 4.0 cli command "description $_nd_cdp_entry_name:$_nd_port_id"

The result of this will be a description like the following on switch ports:

description SDCC_IDF_1.11:TenGigabitEthernet0/1

[Ethan Campbell]

@derek-shnosh  Can you walk me through that? It says "Debug EEM action cli debugging is on" I do a "clear cdp table" but nothing shows? 

[derek-shnosh]

After you enable debugging, you have to turn on terminal monitoring with term mon.

[Ethan Campbell]

@derek-shnosh Here you are sir. Looks like it is getting command authorization failed. 

[derek-shnosh]

Try to configure an event manager user with priv-15.

username eem_svc priv 15 algorithm-type scrypt secret <SUPER_SECRET_PASSWORD>
event manager session cli username "eem_svc"

If you're using TACACS/RADIUS, you may also need to adjust your aaa authorization priorities so the EEM user doesn't try to authorize against TACACS/RADIUS.

aaa authentication login default group ISE-TACACS local
aaa authentication login CONSOLE local
aaa authorization console
aaa authorization exec default local group ISE-TACACS if-authenticated 
aaa authorization commands 15 default local group ISE-TACACS if-authenticated 

Notice how the aaa authentication priority is ISE-TACACS > local and the aaa authorization priority is local > ISE-TACACS.