Hello all,
I'm trying to configure auto-smart-port macros triggered via ISE (no CDP), to configure dynamically my access ports for FlexConnect access-points connection.
I created a macro, which is the following:
macro auto execute CISCO_FLEX_AP {
if [[ $LINKUP == YES ]]
then conf t
interface $INTERFACE
macro description $TRIGGER
switchport trunk allowed vlan 200,2700-2799
switchport trunk native vlan 200
switchport mode trunk
authentication host-mode multi-host
spanning-tree portfast trunk
exit
fi
if [[ $LINKUP == NO ]]
then conf t
interface $INTERFACE
no macro description $TRIGGER
no switchport trunk allowed vlan
no switchport trunk native vlan
authentication host-mode multi-auth
switchport mode access
no spanning-tree portfast trunk
exit
fi
}
The macro is correctly triggered by the ISE when my AP is authenticated (via MAB, for now).
Unfortunately, even if the port is converted to trunk mode with native VLAN 200, my access-point MAC address remains on the base access VLAN (1905) :
Access#sh mac add int gI1/0/28
Mac Address Table
-------------------------------------------
Vlan Mac Address Type Ports
---- ----------- -------- -----
1905 ecbd.1da3.xxxx STATIC Gi1/0/28
Total Mac Addresses for this criterion: 1
I also tried to combine this macro with the "NEAT" parameter on ISE (thus removing the "switchport mode trunk" from the macro and returning both the macro name an the NEAT attribute from ISE), but the result is the same...
The switchport config is the following:
interface GigabitEthernet1/0/28
switchport access vlan 1905
switchport mode access
switchport voice vlan 300
switchport port-security maximum 5
switchport port-security
ip device tracking maximum 0
authentication control-direction in
authentication event fail retry 1 action next-method
authentication event server dead action authorize vlan 1905
authentication event server dead action authorize voice
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication timer inactivity server
authentication violation restrict
mab
mls qos trust cos
dot1x pae authenticator
dot1x timeout quiet-period 300
dot1x timeout server-timeout 18
dot1x timeout tx-period 3
dot1x timeout supp-timeout 5
dot1x timeout ratelimit-period 60
dot1x max-req 1
dot1x max-reauth-req 1
storm-control broadcast level 0.15
storm-control action trap
no keepalive
no cdp enable
end
Can you help me ?
(IOS : 15.2(2)E5 on WS-C2960X-48LPS-L)
Thanks !
