cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

IBNS 2.0 - Built-In Templates for Auto Identity (AI) feature

1023
Views
15
Helpful
2
Comments
Arne Bier
VIP Advisor

Hello

 

I somehow stumbled upon Cisco's IBNS 2.0 Auto Identity (AI) templates in my CML/VIRL IOSv layer2 image (IOS 15.2(6)).

 

I find these templates great, because these are the best practices that we tend to hard-code manually - e.g there are templates for Monitor Mode, Closed Mode etc. - it's great. IBNS configuration is a commonly asked topic on these forums and I don't blame anyone for getting it wrong - we end up creating text file snippets that we use over and over. But with AI there is no need for this - you cannot get it wrong and there is nothing to remember.

 

You start off with the switch in legacy display mode and then perform the IBNS 1.0 to IBNS 2.0 conversion. When I do this on an IOS-XE 9300 device I don't get any AI templates.

 

I have been looking for this feature in IOS-XE. Does anyone know if it exists in IOS XE 16.12.x

 

I found this obscure Cisco Live presentation, but not much else on official Cisco web.

 

SW1#show ver
Cisco IOS Software, vios_l2 Software (vios_l2-ADVENTERPRISEK9-M), Version 15.2(CML_NIGHTLY_20190423)FLO_DSGS7, EARLY DEPLOYMENT DEVELOPMENT BUILD, synced to  V152_6_0_81_E
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2019 by Cisco Systems, Inc.
Compiled Tue 23-Apr-19 04:48 by mmen


ROM: Bootstrap program is IOSv

 

 

Below is more detail about these built-in templates. The good thing is that the commands don't appear in the show-run - less config clutter. You simply use them.

 

Does this look familiar?

 

Switch#show template brief

Interface Templates
===================

Template-Name                                    Source            Bound-to-Interface
-------------                                    ------            ------------------
AI_CLOSED_MODE                                   Built-in          No
AI_LOW_IMPACT_MODE                               Built-in          No
AI_MONITOR_MODE                                  Built-in          No
AI_VISIBILITY_MODE                               Built-in          No

Service Templates
=================

Template-Name                                    Source            Bound-To-Session
-------------                                    ------            ----------------
webauth-global-inactive                          Built-in          No
webauth-global-absolute                          Built-in          No
DEFAULT_LINKSEC_POLICY_MUST_SECURE               Built-in          No
DEFAULT_LINKSEC_POLICY_SHOULD_SECURE             Built-in          No
DEFAULT_CRITICAL_VOICE_TEMPLATE                  Built-in          No
AI_INACTIVE_TIMER                                Built-in          No
AI_CRITICAL_ACL                                  Built-in          No

 

 

And even the global stuff no longer needs to be memorised (or asked about on these forums!!) - you use this one in your global config with the command source template AI_GLOBAL_CONFIG_TEMPLATE

 

Switch#show template global source built-in all
Building configuration...

Global Template Name       : AI_GLOBAL_CONFIG_TEMPLATE
Modified                   : No
Global Template Definition : global
 dot1x system-auth-control
 aaa new-model
 aaa authentication dot1x default group radius
 aaa authorization network default group radius
 aaa authorization auth-proxy default group radius
 aaa accounting identity default start-stop group radius
 aaa accounting system default start-stop group radius
 radius-server attribute 6 on-for-login-auth
 radius-server attribute 6 support-multiple
 radius-server attribute 6 voice 1
 radius-server attribute 8 include-in-access-req
 radius-server attribute 25 access-request include
!
end

 

 

And even more stuff we all use ... Service and Interface Templates:

 

Switch#show template interface source built-in all
Building configuration...

Template Name       : AI_CLOSED_MODE
Modified            : No
Template Definition :
 dot1x pae authenticator
 switchport mode access
 mab
 access-session closed
 access-session port-control auto
 service-policy type control subscriber AI_DOT1X_MAB_POLICIES
!
Template Name       : AI_LOW_IMPACT_MODE
Modified            : No
Template Definition :
 dot1x pae authenticator
 switchport mode access
 mab
 access-session port-control auto
 service-policy type control subscriber AI_DOT1X_MAB_POLICIES
 ip access-group AI_PORT_ACL in
!
Template Name       : AI_MONITOR_MODE
Modified            : No
Template Definition :
 dot1x pae authenticator
 switchport mode access
 mab
 access-session port-control auto
 service-policy type control subscriber AI_DOT1X_MAB_POLICIES
!
Template Name       : AI_VISIBILITY_MODE
Modified            : No
Template Definition :
 switchport mode access
 access-session port-control auto
 service-policy type control subscriber AI_VISIBILITY_POLICY
!
end



Switch#show template service source built-in all
Building configuration...

Built-In Service-Template
=========================

Service-Template : webauth-global-inactive
Template Definition:
 idle-timeout 3600
!
Service-Template : webauth-global-absolute
Template Definition:
!
Service-Template : DEFAULT_LINKSEC_POLICY_MUST_SECURE
Template Definition:
 linksec-policy Must-secure
!
Service-Template : DEFAULT_LINKSEC_POLICY_SHOULD_SECURE
Template Definition:
 linksec-policy Should-secure
!
Service-Template : DEFAULT_CRITICAL_VOICE_TEMPLATE
Template Definition:
 voice vlan
!
Service-Template : AI_INACTIVE_TIMER
Template Definition:
 idle-timeout 3600
!
Service-Template : AI_CRITICAL_ACL
Template Definition:
 access-group AI_PORT_ACL
!
end

 

 

2 Comments
bkengineer
Beginner

Hi. Did you get a solution for this? I am facing the same dilema.

Been looking for such and I have not found any headway!

 

Arne Bier
VIP Advisor

Hi @bkengineer 

 

Nope. Nobody has replied. I think this concept may have been swept under the rug - either that, or the solution is that Cisco want us to now worry ourselves with the details, and use DNAC and SDA instead. 

 

I have not seen AI (Auto Identity) in any IOS release other than the one that comes with CML (Cisco Modelling Lab).

 

I just take whatever useful information I can get from the AI templates and try to use that for customers that don't have DNAC.

Create
Recognize Your Peers
Content for Community-Ad