Script for Switches Cisco

[ConcentrixIT]

Hello Community,

I am looking a script for switches cisco for block interfaces with APs connected , the reason is because we receive daily port changes and sometimes the engineers change the vlan Wi-Fi by another and the Wi-Fi environment is affected by those changes. the objective of the script if it detects special character *AP* not allow configs or changes and refuse it and the engineer know that port cannot be changed.

Thanks 

[Leo Laohoo]

We have an EEM script that changes the description of the interfaces.  The EEM script determines if the device is a Cisco AP.  If it is an AP, it changes the description of the interface.  If it is not an AP, it leaves the description alone. 

[ConcentrixIT]

this is a example interface 

!
interface GigabitEthernet1/0/5
description Link_to_AP
switchport access vlan 92
switchport mode access
end

the objetive if any engineer apply a script for block for refuse the changes , let me know ..!

[Leo Laohoo]

As far as I am aware, this is not possible. The logic is absolutely "wild".  Think about it.  Anyone can assign ports to any VLAN but no one can change the port VLAN assignment if said port is already in VLAN 92.

The issue is not the implementation.  The problem lies in the governance.  

If there is no proper Change Management process in place, no amount of automation is going to fix this.  If an "engineer" blindly changed the configuration without checking and someone has approved the Change Control, it is not the fault of lack of automation or scripting.  It lies in the governance and Change Control.

Start with labelling the interface description accurately.  

[paul driver]

Hello
Sounds like you dont have any change control whatsoever on your network, as such network changes are made on the fly without are proper consideration of the affects it may incurr.

I suggest you apply some central authentication/authorisation/accounting (aaa) to manged network access/monitor and record any changes made by the engineers.