Automatically Set Port Descriptions

[Joe Clarke]

In preparing for CiscoLive! in San Diego, I am provisioning our access layer 3560-E switches.  Since things have a tendency to change a lot at an event like CiscoLive! I thought it would be best to make sure our port descriptions are always up-to-date when it comes to reflecting what devices are connected.  To help me do that, I wrote up this small EEM applet policy.  It will update the port's description based on the CDP neighbor learned on that port.  This policy requires EEM 3.2, so you're looking at 12.2(55)SE or higher for the 3560s.  It will also work on 3750s and ISR G2 routers running 15.x code.

event manager applet update-port-description
 event neighbor-discovery interface regexp GigabitEthernet.* cdp add 
 action 1.0 cli command "enable"
 action 2.0 cli command "config t"
 action 3.0 cli command "interface $_nd_local_intf_name"
 action 4.0 cli command "description $_nd_cdp_entry_name:$_nd_port_id"

The result of this will be a description like the following on switch ports:

description SDCC_IDF_1.11:TenGigabitEthernet0/1

[Ethan Campbell]

@derek-shnosh  Can you walk me through that? It says "Debug EEM action cli debugging is on" I do a "clear cdp table" but nothing shows? 

[derek-shnosh]

After you enable debugging, you have to turn on terminal monitoring with term mon.

[Ethan Campbell]

@derek-shnosh Here you are sir. Looks like it is getting command authorization failed. 

[derek-shnosh]

Try to configure an event manager user with priv-15.

username eem_svc priv 15 algorithm-type scrypt secret <SUPER_SECRET_PASSWORD>
event manager session cli username "eem_svc"

If you're using TACACS/RADIUS, you may also need to adjust your aaa authorization priorities so the EEM user doesn't try to authorize against TACACS/RADIUS.

aaa authentication login default group ISE-TACACS local
aaa authentication login CONSOLE local
aaa authorization console
aaa authorization exec default local group ISE-TACACS if-authenticated 
aaa authorization commands 15 default local group ISE-TACACS if-authenticated 

Notice how the aaa authentication priority is ISE-TACACS > local and the aaa authorization priority is local > ISE-TACACS.

[derek-shnosh]

To provide a follow up, @Ethan Campbell and I sync'ed up via discord and got an EEM applet working based on his requirements with the following script.

event manager applet cdp_desc
 event neighbor-discovery interface regexp .* cdp add
 action 00.00 cli command "enable"
 action 01.00 comment "Get shorthand for local interface..."
 action 01.01 string range "$_nd_local_intf_name" 0 2
 action 01.02 set local_type "$_string_result"
 action 01.03 regexp "[/0-9]+$" "$_nd_local_intf_name" local_int
 action 02.00 comment "Get shorthand for neighbor interface..."
 action 02.01 string range "$_nd_port_id" 0 2
 action 02.02 set nei_intf_type "$_string_result"
 action 02.03 regexp "[/0-9]+$" "$_nd_port_id" nei_int
 action 03.00 comment "Accommodate mgmt0 interfaces..."
 action 03.01 if $neiint eq "0"
 action 03.02  set nei_int "mgmt"
 action 03.03 end
 action 04.00 comment "Get shorthand for hostname (strip domain name)..."
 action 04.01 regexp "^[^\.\(]+" "$_nd_cdp_entry_name" nei
 action 05.00 comment "Build a new interface description based on neighbor information..."
 action 05.01 set newdesc "$nei:$nei_intf_type$nei_int"
 action 06.00 comment "Check current description on local interface..."
 action 06.01 cli command "show int $_nd_local_intf_name | i ^[\ ]*[Dd]escription"
 action 06.02 set output "$_cli_result"
 action 06.03 regexp "^\ *[Dd]escription" "$output"
 action 06.04 if $_regexp_result ne "1"
 action 06.05  set olddesc "<none>"
 action 06.06 else
 action 06.07  set i "0"
 action 06.08  foreach line "$output" "\n"
 action 06.09   increment i
 action 06.10   if $i eq "1"
 action 06.11    string trim "$line"
 action 06.12    set line "$_string_result"
 action 06.13    regexp "^\ *[Dd]escription:\ *(.*)" "$line" match olddesc
 action 06.14   end
 action 06.15  end
 action 06.16 end
 action 07.00 comment "Update description, if necessary..."
 action 07.01 if $newdesc eq $olddesc
 action 07.02  syslog msg "  ## New CDP neighbor on $local_type$local_int ($newdesc), description does not require updating."
 action 07.03 else
 action 07.04  syslog msg "  ## New CDP neighbor on $local_type$local_int ($newdesc), updating description (was: $olddesc)." 
 action 07.05  cli command "conf t"
 action 07.06  cli command   "int $_nd_local_intf_name"
 action 07.07  cli command   "desc $newdesc"
 action 07.08  cli command   "end"
 action 07.09  cli command "write mem" pattern "confirm|#"
 action 07.10  cli command ""
 action 07.11 end