Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About derek_shnosh
Stats
Member since
11-16-2012
30
Posts
35
Helpful
2
Solutions
Created by
derek_shnosh
in Networking Documents
in Networking Documents
03-19-2019
01:08 AM
03-19-2019
01:08 AM
Preamble
This was created for and used with FreeZTP, but can likely be used with any Jinja2 templating system.
When this snippet (located at the bottom of this document) is added to a Jinja2 template it will automatically build out an EEM applet that will set switch priorities and renumber all switches in the stack according to how they were allocated in the FreeZTP keystore.
All switches in the stack can be powered on simultaneously; i.e. there is no need to do the 2-minute-tango between powering up switches. After the election processes are complete, the stack will continue booting and then perform the smart-install procedure where it will receive this applet as part of the templated configuration.
In this use-case, FreeZTP's idarray variables are being used to define stack member serial numbers. When the template is merged with the keystore, an action sequence is generated for each serial number ( idarray_# ) associated with the hostname ( keystore_id ). Switch serial numbers should be assigned to idarray_# 's as they're meant to be numbered in the stack (see the CSV example below).
Example
In this example, there are four switches allocated to the stack ASW-TR01-01;
FOC11111111 ( idarray_1 ) should be switch 1 in the stack, with a priority of 15.
FOC22222222 ( idarray_2 ) should be switch 2 in the stack, with a priority of 14.
FOC33333333 ( idarray_3 ) should be switch 3 in the stack, with a priority of 13.
FOC44444444 ( idarray_4 ) should be switch 4 in the stack, with a priority of 12.
CSV
Variables defined in the keystore (FreeZTP);
keystore_id = Hostname of the switch.
association = J2 template configured in FreeZTP.
idarray_# = Switch serial number(s).
Populate the idarray_# fields with serial numbers as they are to be ordered in the stack.
keystore_id,association,idarray_1,idarray_2,idarray_3,idarray_4,idarray_5,idarray_6,idarray_7,idarray_8,idarray_9
ASW-TR01-01,TEST,FOC11111111,FOC22222222,FOC33333333,FOC44444444,,,,,
Switch Priorities
The default priority for all switches (out of the box) is 1; these priorities do not change during the election process.
Notice that all switches have a priority of 1 in the output below. The priority range is 1-15; the (online) switch with highest priority will be chosen as the active 'supervisor' switch during any election processes/failure events.
ASW-TR01-01#show switch
Switch/Stack Mac Address : abcd.ef22.2222 - Local Mac Address
Mac persistency wait time: Indefinite
H/W Current
Switch# Role Mac Address Priority Version State
------------------------------------------------------------
*1 Active abcd.ef22.2222 1 V02 Ready
2 Standby abcd.ef44.4444 1 V02 Ready
3 Member abcd.ef11.1111 1 V02 Ready
4 Member abcd.ef33.3333 1 V02 Ready
Switch Numbers
The default number for all switches (out of the box) is also 1; as the switches boot they detect stack neighbors and perform an election process which renumbers the switches automatically.
The election process for this example resulted in the switches being numbered as follows...
ASW-TR01-01#show module
Switch Ports Model Serial No. MAC address Hw Ver. Sw Ver.
------ ----- --------- ----------- -------------- ------- --------
1 62 WS-C3850-12X48U-S FOC22222222 abcd.ef22.2222 V02 03.07.04E
2 62 WS-C3850-12X48U-S FOC44444444 abcd.ef44.4444 V02 03.07.04E
3 62 WS-C3850-12X48U-S FOC11111111 abcd.ef11.1111 V02 03.07.04E
4 62 WS-C3850-12X48U-S FOC33333333 abcd.ef33.3333 V02 03.07.04E
Process/Explanation
Switches are connected via stack cables and powered up simultaneously.
An interface on only one of the switches needs to be connected to the provisioning network.
Switches complete the election process and stack initiates smart-install.
Stack requests config, FreeZTP gives a (merged) config containing the code.
J2 variable sw_count is set during the merge process by counting serial numbers found in idarray .
Stack applies configuration and a syslog message is generated; sw_stack applet is triggered.
[EEM Applet sw_stack loaded to memory.]
Waits 120 seconds for the stack redundancy operations to complete.
Executes command show module | inc ^.[1-9] (output as read by EEM for current example);
This output is what EEM stores as $stack for parsing. All line numbers correlate with the stack's current switch allocation numbers; i.e. first line contains information for switch 1, second line contains information for switch 2, etc...
1 62 WS-C3850-12X48U-S FOC22222222 abcd.ef22.2222 V02 03.07.04E
2 62 WS-C3850-12X48U-S FOC44444444 abcd.ef44.4444 V02 03.07.04E
3 62 WS-C3850-12X48U-S FOC11111111 abcd.ef11.1111 V02 03.07.04E
4 62 WS-C3850-12X48U-S FOC33333333 abcd.ef33.3333 V02 03.07.04E
ASW-TR01-01#
[J2 Loop] For each switch, searches the entire output for its serial number;
If not found, a syslog message will be generated and the applet will move onto the next switch.
[EEM Loop] If found, the applet searches the output line-by-line until it finds the serial number;
The last line of the output is the switch hostname (elevated prompt), which is ignored when searching for switch serial number(s); i.e. the number of lines that the applet will search is limited by the Jinja2 sw_count variable set in the template.
If the line number where the serial number was found matches the allocated switch number ( idarray_# ), only the priority will be set.
If the line number where the serial number was found does not match the allocated switch number, the priority will be set and the switch will be renumbered.
Syslog messages are generated outlining any errors and all changes made to priorities and numbers.
Applet deletes itself from running configuration, writes the startup-config, and generates a syslog message stating that the process is complete.
The stack can now be reloaded to finish the renumbering process.
Snippet
Syslog messages are a bit ugly in the pre block due to word-wrap, copy the text out to an editor with word-wrap disabled.
!-- Variables (keys) parsed from CSV keystore.
!---- IDARRAY_1 (switch 1 serial number): {{idarray_1}}
!---- IDARRAY_2 (switch 2 serial number): {{idarray_2}}
!---- IDARRAY_3 (switch 3 serial number): {{idarray_3}}
!---- IDARRAY_4 (switch 4 serial number): {{idarray_4}}
!---- IDARRAY_5 (switch 5 serial number): {{idarray_5}}
!---- IDARRAY_6 (switch 6 serial number): {{idarray_6}}
!---- IDARRAY_7 (switch 7 serial number): {{idarray_7}}
!---- IDARRAY_8 (switch 8 serial number): {{idarray_8}}
!---- IDARRAY_9 (switch 9 serial number): {{idarray_9}}
!---- IDARRAY (all serials): {{idarray}}
!
!-- EEM applet to renumber switches accordingly (ALL SUBSEQUENT LINES ARE REQUIRED).
!---- SW_COUNT (count of serials found in IDARRAY): {%set sw_count=idarray|count%}{{sw_count}}
event manager applet sw_stack
event syslog occurs 1 pattern "%SYS-5-CONFIG_I: Configured from tftp" maxrun 60
action 00.00 syslog msg "\n ## FreeZTP configuration received via TFTP, run 'sw_stack' EEM applet in 120s."
action 00.01 wait 120
action 00.02 cli command "enable"
action 00.03 cli command "show mod | i ^.[1-9]"
action 00.04 set stack "$_cli_result"
action 00.05 syslog msg "\n ## Checking all switches' version and stack membership, adjusting where necessary.\n ## Current order;\n$stack"
action 00.06 set error_list ""
action 00.07 set change_list ""
action 00.08 set upgrade_list ""
{%for sw in idarray%}
{%- set i=loop.index%}
action 0{{i}}.00 set sw_num "{{i}}"
action 0{{i}}.01 set pri "16"
action 0{{i}}.02 decrement pri {{i}}
action 0{{i}}.03 regexp "{{sw}}" "$stack"
action 0{{i}}.04 if $_regexp_result ne "1"
action 0{{i}}.05 syslog msg "\n ## {{sw}} (Sw-{{i}} serial) not found in the stack, check 'show mod' output."
action 0{{i}}.06 append error_list "\n ## {{sw}} is allocated (idarray_{{i}}) but was not found in the stack."
action 0{{i}}.07 else
action 0{{i}}.08 set i "0"
action 0{{i}}.09 foreach line "$stack" "\n"
action 0{{i}}.10 increment i
action 0{{i}}.11 if $i le "{{sw_count}}"
action 0{{i}}.12 string trim "$line"
action 0{{i}}.13 set line "$_string_result"
action 0{{i}}.14 regexp "{{sw}}" "$line"
action 0{{i}}.15 if $_regexp_result eq "1"
action 0{{i}}.16 regexp "([0-9\.A-Z]+$)" "$line" curr_ver
action 0{{i}}.17 cli command "switch $i priority $pri" pattern "continue|#"
action 0{{i}}.18 cli command "y"
action 0{{i}}.19 if $i eq $sw_num
action 0{{i}}.20 append change_list "\n ## {{sw}} (Priority: $pri // Numbered: $sw_num // Version: $curr_ver)"
action 0{{i}}.21 else
action 0{{i}}.22 cli command "switch $i renumber $sw_num" pattern "continue|#"
action 0{{i}}.23 cli command "y"
action 0{{i}}.24 append change_list "\n ## {{sw}} (Priority: $pri // Renumbered: $i > $sw_num* // Version: $curr_ver)"
action 0{{i}}.25 end
action 0{{i}}.26 break
action 0{{i}}.27 end
action 0{{i}}.28 end
action 0{{i}}.29 end
action 0{{i}}.30 end
{%endfor%}
action 10.00 wait 5
action 10.01 if $error_list ne ""
action 10.02 syslog msg "\n ## The following errors occurred; $error_list"
action 10.03 end
action 10.04 syslog msg "\n ## Switches below have been assigned a priority and renumbered* as needed; $change_list"
action 10.05 cli command "conf t"
action 10.06 cli command "no event man app sw_stack"
action 10.07 cli command "end"
action 10.08 cli command "write mem" pattern "confirm|#"
action 10.09 cli command ""
action 10.10 syslog msg "\n ## EEM applet (sw_stack) deleted and config written, reload for changes to take effect."
!
Merged Config Example
Merged configuration that is pushed to the switch from FreeZTP for this example;
J2 templating functions do not print; i.e. anything enclosed with {% %} will not appear in the merged config.
Any line starting with a ! will be ignored by the switch.
!-- Variables (keys) parsed from CSV keystore.
!---- IDARRAY_1 (switch 1 serial number): FOC11111111
!---- IDARRAY_2 (switch 2 serial number): FOC22222222
!---- IDARRAY_3 (switch 3 serial number): FOC33333333
!---- IDARRAY_4 (switch 4 serial number): FOC44444444
!---- IDARRAY_5 (switch 5 serial number):
!---- IDARRAY_6 (switch 6 serial number):
!---- IDARRAY_7 (switch 7 serial number):
!---- IDARRAY_8 (switch 8 serial number):
!---- IDARRAY_9 (switch 9 serial number):
!---- IDARRAY (all serials): ['FOC11111111', 'FOC22222222', 'FOC33333333', 'FOC44444444']
!
!-- EEM applet to renumber switches accordingly (ALL SUBSEQUENT LINES ARE REQUIRED).
!---- SW_COUNT (count of serials found in IDARRAY): 4
event manager applet sw_stack
event syslog occurs 1 pattern "%SYS-5-CONFIG_I: Configured from tftp" maxrun 60
action 00.00 syslog msg "\n ## FreeZTP configuration received via TFTP, run 'sw_stack' EEM applet in 120s."
action 00.01 wait 120
action 00.02 cli command "enable"
action 00.03 cli command "show mod | i ^.[1-9]"
action 00.04 set stack "$_cli_result"
action 00.05 syslog msg "\n ## Checking all switches' version and stack membership, adjusting where necessary.\n ## Current order;\n$stack"
action 00.06 set error_list ""
action 00.07 set change_list ""
action 00.08 set upgrade_list ""
action 01.00 set sw_num "1"
action 01.01 set pri "16"
action 01.02 decrement pri 1
action 01.03 regexp "FOC11111111" "$stack"
action 01.04 if $_regexp_result ne "1"
action 01.05 syslog msg "\n ## FOC11111111 (Sw-1 serial) not found in the stack, check 'show mod' output."
action 01.06 append error_list "\n ## FOC11111111 is allocated (idarray_1) but was not found in the stack."
action 01.07 else
action 01.08 set i "0"
action 01.09 foreach line "$stack" "\n"
action 01.10 increment i
action 01.11 if $i le "4"
action 01.12 string trim "$line"
action 01.13 set line "$_string_result"
action 01.14 regexp "FOC11111111" "$line"
action 01.15 if $_regexp_result eq "1"
action 01.16 regexp "([0-9\.A-Z]+$)" "$line" curr_ver
action 01.17 cli command "switch $i priority $pri" pattern "continue|#"
action 01.18 cli command "y"
action 01.19 if $i eq $sw_num
action 01.20 append change_list "\n ## FOC11111111 (Priority: $pri // Numbered: $sw_num // Version: $curr_ver)"
action 01.21 else
action 01.22 cli command "switch $i renumber $sw_num" pattern "continue|#"
action 01.23 cli command "y"
action 01.24 append change_list "\n ## FOC11111111 (Priority: $pri // Renumbered: $i > $sw_num* // Version: $curr_ver)"
action 01.25 end
action 01.26 break
action 01.27 end
action 01.28 end
action 01.29 end
action 01.30 end
action 02.00 set sw_num "2"
action 02.01 set pri "16"
action 02.02 decrement pri 2
action 02.03 regexp "FOC22222222" "$stack"
action 02.04 if $_regexp_result ne "1"
action 02.05 syslog msg "\n ## FOC22222222 (Sw-2 serial) not found in the stack, check 'show mod' output."
action 02.06 append error_list "\n ## FOC22222222 is allocated (idarray_2) but was not found in the stack."
action 02.07 else
action 02.08 set i "0"
action 02.09 foreach line "$stack" "\n"
action 02.10 increment i
action 02.11 if $i le "4"
action 02.12 string trim "$line"
action 02.13 set line "$_string_result"
action 02.14 regexp "FOC22222222" "$line"
action 02.15 if $_regexp_result eq "1"
action 02.16 regexp "([0-9\.A-Z]+$)" "$line" curr_ver
action 02.17 cli command "switch $i priority $pri" pattern "continue|#"
action 02.18 cli command "y"
action 02.19 if $i eq $sw_num
action 02.20 append change_list "\n ## FOC22222222 (Priority: $pri // Numbered: $sw_num // Version: $curr_ver)"
action 02.21 else
action 02.22 cli command "switch $i renumber $sw_num" pattern "continue|#"
action 02.23 cli command "y"
action 02.24 append change_list "\n ## FOC22222222 (Priority: $pri // Renumbered: $i > $sw_num* // Version: $curr_ver)"
action 02.25 end
action 02.26 break
action 02.27 end
action 02.28 end
action 02.29 end
action 02.30 end
action 03.00 set sw_num "3"
action 03.01 set pri "16"
action 03.02 decrement pri 3
action 03.03 regexp "FOC33333333" "$stack"
action 03.04 if $_regexp_result ne "1"
action 03.05 syslog msg "\n ## FOC33333333 (Sw-3 serial) not found in the stack, check 'show mod' output."
action 03.06 append error_list "\n ## FOC33333333 is allocated (idarray_3) but was not found in the stack."
action 03.07 else
action 03.08 set i "0"
action 03.09 foreach line "$stack" "\n"
action 03.10 increment i
action 03.11 if $i le "4"
action 03.12 string trim "$line"
action 03.13 set line "$_string_result"
action 03.14 regexp "FOC33333333" "$line"
action 03.15 if $_regexp_result eq "1"
action 03.16 regexp "([0-9\.A-Z]+$)" "$line" curr_ver
action 03.17 cli command "switch $i priority $pri" pattern "continue|#"
action 03.18 cli command "y"
action 03.19 if $i eq $sw_num
action 03.20 append change_list "\n ## FOC33333333 (Priority: $pri // Numbered: $sw_num // Version: $curr_ver)"
action 03.21 else
action 03.22 cli command "switch $i renumber $sw_num" pattern "continue|#"
action 03.23 cli command "y"
action 03.24 append change_list "\n ## FOC33333333 (Priority: $pri // Renumbered: $i > $sw_num* // Version: $curr_ver)"
action 03.25 end
action 03.26 break
action 03.27 end
action 03.28 end
action 03.29 end
action 03.30 end
action 04.00 set sw_num "4"
action 04.01 set pri "16"
action 04.02 decrement pri 4
action 04.03 regexp "FOC44444444" "$stack"
action 04.04 if $_regexp_result ne "1"
action 04.05 syslog msg "\n ## FOC44444444 (Sw-4 serial) not found in the stack, check 'show mod' output."
action 04.06 append error_list "\n ## FOC44444444 is allocated (idarray_4) but was not found in the stack."
action 04.07 else
action 04.08 set i "0"
action 04.09 foreach line "$stack" "\n"
action 04.10 increment i
action 04.11 if $i le "4"
action 04.12 string trim "$line"
action 04.13 set line "$_string_result"
action 04.14 regexp "FOC44444444" "$line"
action 04.15 if $_regexp_result eq "1"
action 04.16 regexp "([0-9\.A-Z]+$)" "$line" curr_ver
action 04.17 cli command "switch $i priority $pri" pattern "continue|#"
action 04.18 cli command "y"
action 04.19 if $i eq $sw_num
action 04.20 append change_list "\n ## FOC44444444 (Priority: $pri // Numbered: $sw_num // Version: $curr_ver)"
action 04.21 else
action 04.22 cli command "switch $i renumber $sw_num" pattern "continue|#"
action 04.23 cli command "y"
action 04.24 append change_list "\n ## FOC44444444 (Priority: $pri // Renumbered: $i > $sw_num* // Version: $curr_ver)"
action 04.25 end
action 04.26 break
action 04.27 end
action 04.28 end
action 04.29 end
action 04.30 end
action 10.00 wait 5
action 10.01 if $error_list ne ""
action 10.02 syslog msg "\n ## The following errors occurred; $error_list"
action 10.03 end
action 10.04 syslog msg "\n ## Switches below have been assigned a priority and renumbered* as needed; $change_list"
action 10.05 cli command "conf t"
action 10.06 cli command "no event man app sw_stack"
action 10.07 cli command "end"
action 10.08 cli command "write mem" pattern "confirm|#"
action 10.09 cli command ""
action 10.10 syslog msg "\n ## EEM applet (sw_stack) deleted and config written, reload for changes to take effect."
!
Validation
This has been confirmed functional on stacked C3850-12X48U-S switches running the following IOS-XE versions;
IOS-XE 3.7.4E
IOS-XE 16.3.6, 16.3.7
Logs
Below is an abbreviated and sanitized log output from 4 stacked switches, real serial numbers have been replaced by those in this example.
Would you like to enter the initial configuration dialog? [yes/no]:
Loading network-confg from 172.17.251.251 (via Vlan1): !
[OK - 94 bytes]
Loading ZTP-23D9F46EC4-confg from 172.17.251.251 (via Vlan1): !
[OK - 154241 bytes]
...
*Oct 17 2018 12:45:34.347 PDT: %SYS-5-CONFIG_I: Configured from tftp://172.17.251.251/ZTP-23D9F46EC4-confg by console
*Oct 17 2018 12:45:34.365 PDT: %HA_EM-6-LOG: sw_stack:
## FreeZTP configuration received via TFTP, run 'sw_stack' EEM applet in 120s.
...
*Oct 17 2018 12:47:34.376 PDT: %HA_EM-6-LOG: sw_stack:
## Checking all switches' version and stack membership, adjusting where necessary.
*Oct 17 2018 12:47:44.755 PDT: %HA_EM-6-LOG: sw_stack:
## Switches below have been assigned a priority and renumbered* as needed;
## FOC11111111 (Priority: 15 // Renumbered: 3 > 1* // Version: 03.07.04E )
## FOC22222222 (Priority: 14 // Renumbered: 1 > 2* // Version: 03.07.04E )
## FOC33333333 (Priority: 13 // Renumbered: 4 > 3* // Version: 03.07.04E )
## FOC44444444 (Priority: 12 // Renumbered: 2 > 4* // Version: 03.07.04E )
*Oct 17 2018 12:47:52.732 PDT: %SYS-5-CONFIG_I: Configured from console by eem_svc on vty0 (EEM:post_ztp_1)
*Oct 17 2018 12:47:52.756 PDT: %HA_EM-6-LOG: sw_stack:
## EEM applet `sw_stack` deleted and config written, reload for changes to take effect.
...
... View more
Labels:
Re: CSCux70815 - EEM event neighbor-dis...
in Cisco Bug Discussions
01-21-2019
02:25 PM
01-21-2019
02:25 PM
Adding my name to the hat...
(config-applet)# event neighbor-discovery interface ethernet regex Ethernet[0-8]/[0-9]+
Max Limit for CDP EEM events reached !!
... View more
Created by
derek_shnosh
in Network Management
in Network Management
01-03-2019
11:10 AM
01-03-2019
11:10 AM
Thanks Joe - any thoughts on defining two different events/triggers to run a separate set of actions? The cdp_desc applet works well but I'd also like to be able to apply descriptions for other interfaces where CDP (or LLDP) info is not available.
All interfaces are going to auth so I can work through how I want to build the description text, my issue is that if the cdp_desc applet triggers then I don't want the other event or actions (int_desc applet) to run their course.
... View more
Created by
derek_shnosh
in Network Management
in Network Management
01-02-2019
12:01 PM
01-02-2019
12:01 PM
This ED, has ED? 🤣 Sorry inappropriate way to start my 2019 posting history.
I did try to debug event manager detector identity , but nothing shows up when an interface auth's a connected device. The only time messages show up is when I type show run or edit the config of an applet with an identity trigger while that debug is enabled.
I want to avoid spamming the switch syslog with dot1x/mab auth messages, we're using ISE and getting all of the logging/accounting we need there.
My current workaround is to use %LINEPROTO-5-UPDOWN.*changed state to up$ as follows;
Triggered by syslog...
[00.00 - 00.07] Checks the MAC address table of the interface every 2 seconds until a MAC is present, stores the vlan as $vlan and the last four digits of the MAC address as $macaddr ...
[01.00 - 01.10] If the MAC address is in a certain VLAN (Note: {{vl.egm.id}} is from my J2 switch template)...
Checks the auth session on the interface every 2 seconds until a valid IP address is present, grabs the last octet as $ipaddr and sets $newdesc as [EGM]$ipaddr/$macaddr , example [EGM].91/abcd.
[02.xx - 98.xx] Reserved for other VLANs to prepend the description accordingly.
[99.00 - 99.28] Checks the current interface description as $olddesc , only updates if $newdesc is different.
event manager applet int_desc
!-- `event identity interface regexp Ethernet.* authz-complete`
event syslog occurs 1 pattern "%LINEPROTO-5-UPDOWN.*changed state to up$" maxrun 60
action 00.00 cli command "enable"
action 00.01 regexp "([^\ ][A-Za-z]+)([/0-9]+), changed state to up$" "$_syslog_msg" match type int
action 00.02 while 1 eq 1
action 00.03 wait 2
action 00.04 cli command "show mac addr int $type$int | inc $int\ *$"
action 00.05 regexp "^\ *([0-9]+)\ *[a-f0-9]+\.[a-f0-9]+\.([a-f0-9]+)" "$_cli_result" match vlan macaddr
action 00.06 if $_regexp_result eq "1" goto 01.00
action 00.07 end
!-- Use actions 01.xx - 98.xx for different VLAN/client types.
action 01.00 if $vlan eq "{{vlan.egm.id}}"
action 01.01 while 1 eq 1
action 01.02 wait 2
action 01.03 cli command "show auth sess int $type$int det | i IPv4"
action 01.04 regexp "IPv4 Address:\ *[0-9]+\.[0-9]+\.[0-9]+(\.[0-9]+)" "$_cli_result" match ipaddr
action 01.05 if $_regexp_result eq "1"
action 01.06 set newdesc "[EGM]$ipaddr/$macaddr"
action 01.07 break
action 01.08 end
action 01.09 end
action 01.10 end
!-- Check current interface description, only update if $newdesc is different.
action 99.00 if $newdesc ne ""
action 99.01 cli command "show int $type$int | i ^[\ ]*[Dd]escription"
action 99.02 set output "$_cli_result"
action 99.03 regexp "^\ *[Dd]escription" "$output"
action 99.04 if $_regexp_result ne "1"
action 99.05 set olddesc "<none>"
action 99.06 else
action 99.07 set i "0"
action 99.08 foreach line "$output" "\n"
action 99.09 increment i
action 99.10 if $i eq "1"
action 99.11 string trim "$line"
action 99.12 set line "$_string_result"
action 99.13 regexp "^\ *[Dd]escription:\ *(.*)" "$line" match olddesc
action 99.14 end
action 99.15 end
action 99.16 end
action 99.17 if $newdesc eq $olddesc
action 99.18 syslog msg " ## Authed client on $type$int ($newdesc), description does not require updating."
action 99.19 else
action 99.20 syslog msg " ## Authed client on $type$int ($newdesc), updating description (was: $olddesc)."
action 99.21 cli command "conf t"
action 99.22 cli command "int $type$int"
action 99.23 cli command "desc $newdesc"
action 99.24 cli command "end"
action 99.25 cli command "write mem" pattern "confirm|#"
action 99.26 cli command ""
action 99.27 end
action 99.28 end
This all works, but I have a separate applet for CDP neighbors, triggered by event neighbor-discovery interface regexp Ethernet.* cdp add as well and they both trigger simultaneously. I looked into tagging and correlating the events but wasn't successful, I'm pretty new to all of this.
Anyways, my preference/goal would be for the int_desc applet trigger only if the cdp_desc applet does not trigger.
Expand spoiler for my cdp_desc applet for reference...
event manager applet cdp_desc
event neighbor-discovery interface regexp Ethernet.* cdp add
action 00.00 cli command "enable"
action 00.01 string range "$_nd_local_intf_name" 0 1
action 00.02 set type "$_string_result"
action 00.03 regexp "[/0-9]+$" "$_nd_local_intf_name" int
action 00.04 regexp "[/0-9]+$" "$_nd_port_id" neiint
action 00.05 regexp "AIR|Phone|ATA" "$_nd_cdp_platform" neiplat
action 00.06 if $_regexp_result ne "1"
action 00.07 regexp "^[^\.\(]+" "$_nd_cdp_entry_name" nei
action 00.08 set newdesc "$nei:$neiint"
action 00.09 else
action 00.10 if $neiplat eq "AIR"
action 00.11 set capwap_vl "{{vlan.mgmt_ap.id}}"
action 00.12 regexp "AIR-AP([A-Z0-9]+)" "$_nd_cdp_platform" match model
action 00.13 cli command "show mac addr int $type$int | i ^\ *$capwap_vl"
action 00.14 regexp "^\ *[0-9]+\ *[a-f0-9]+\.[a-f0-9]+\.([a-f0-9]+)" "$_cli_result" match macaddr
action 00.15 set newdesc "[AP]$model/$macaddr"
action 00.20 elseif $neiplat eq Phone
action 00.21 regexp "[0-9]+$" "$_nd_cdp_platform" model
action 00.22 regexp "....$" "$_nd_cdp_entry_name" macaddr
action 00.23 set newdesc "[SEP]$model/$macaddr"
action 00.30 elseif $neiplat eq ATA
action 00.31 regexp "[0-9]+$" "$_nd_cdp_platform" model
action 00.32 regexp "....$" "$_nd_cdp_entry_name" macaddr
action 00.33 set newdesc "[ATA]$model/$macaddr"
action 00.98 end
action 00.99 end
action 01.00 cli command "show int $_nd_local_intf_name | i ^\ *[Dd]escription"
action 01.01 set output "$_cli_result"
action 01.02 regexp "^\ *[Dd]escription" "$output"
action 01.03 if $_regexp_result ne "1"
action 01.04 set olddesc "<none>"
action 01.05 else
action 01.06 set i "0"
action 01.07 foreach line "$output" "\n"
action 01.08 increment i
action 01.09 if $i eq "1"
action 01.10 string trim "$line"
action 01.11 set line "$_string_result"
action 01.12 regexp "^\ *[Dd]escription:\ *(.*)" "$line" match olddesc
action 01.13 end
action 01.14 end
action 01.15 end
action 02.00 if $newdesc eq "$olddesc"
action 02.01 syslog msg " ## New CDP neighbor on $type$int ($newdesc), description does not require updating."
action 02.02 else
action 02.03 syslog msg " ## New CDP neighbor on $type$int ($newdesc), updating description (was: $olddesc)."
action 02.04 cli command "conf t"
action 02.05 cli command "int $_nd_local_intf_name"
action 02.06 cli command "desc $newdesc"
action 02.07 cli command "end"
action 02.08 cli command "write mem" pattern "confirm|#"
action 02.09 cli command ""
action 02.10 end
... View more
Created by
derek_shnosh
in Network Management
in Network Management
01-01-2019
12:53 AM
01-01-2019
12:53 AM
My goal is to build out an applet to assign a dynamic description to any interface with an authenticated host, whether it be dot1x or MAB. I think this sounds like a great use case for event identity interface regexp Ethernet.* , but I can't even get a syslog msg or puts to display a message.
Here is what I've tried...
event manager applet int_desc
event identity interface regexp Ethernet.*
action 00.00 syslog msg " ## Auth event on: $_identity_interface
action 00.01 cli command "enable"
action 00.02 cli command "conf t"
action 00.03 cli command "int $_identity_interface"
action 00.03 cli command "desc AUTH"
action 00.04 exit
I have tried this on a C3850-12X48U-S and a C3650-48FQM-S, both running IOS-XE 16.3.6, here is the output from show event man version (same from both switches).
#show eve man ver
Embedded Event Manager Version 4.00
Component Versions:
eem: (dev10)1.1.5
eem-gold: (rel1)1.0.2
eem-call-home: (rel2)1.0.5
Event Detectors:
Name Version Node Type
application 01.00 node0/0 RP
rf 01.00 node0/0 RP
identity 01.00 node0/0 RP
mat 01.00 node0/0 RP
neighbor-discovery 01.00 node0/0 RP
generic-xed 01.00 node0/0 RP
syslog 01.00 node0/0 RP
generic 01.00 node0/0 RP
routing 03.00 node0/0 RP
rpc 01.00 node0/0 RP
cli 01.00 node0/0 RP
counter 01.00 node0/0 RP
interface 01.00 node0/0 RP
ioswdsysmon 01.00 node0/0 RP
none 01.00 node0/0 RP
oir 01.00 node0/0 RP
snmp 01.00 node0/0 RP
snmp-object 01.00 node0/0 RP
snmp-notification 01.00 node0/0 RP
timer 01.00 node0/0 RP
test 01.00 node0/0 RP
config 01.00 node0/0 RP
env 01.00 node0/0 RP
ds 01.00 node0/0 RP
crash 01.00 node0/0 RP
gold 01.00 node0/0 RP
... View more
- Tags:
- eem
- event identity
Labels:
Created by
derek_shnosh
in Networking Documents
in Networking Documents
12-13-2018
03:38 PM
12-13-2018
03:38 PM
Is this still not possible on Nexus, specifically 9000? I see that `event neighbor-discovery` is valid now, but I don't see `action string` or `action set ` options.
... View more
Created by
derek_shnosh
in Networking Events
in Networking Events
12-05-2018
10:30 AM
12-05-2018
10:30 AM
I feel like I'm missing something; clicking the Register Today button simply redirects me to Cisco Community / Technology and Support / Networking / Network Management. I am not presented with event information/details, or a way to actually register for the event.
... View more
Created by
derek_shnosh
in Network Management
in Network Management
10-04-2018
01:57 PM
10-04-2018
01:57 PM
Apologies for the delayed response, and thanks for the link @Joe Clarke! I'm going to dig around that site a bit when time permits.
For now, I've worked around the issue with a couple simple applets as outlined here.
Disclaimer: I'm very new to scripting in any language, there is likely a more optimal way to accomplish this but this is what I came up with my very limited experience and short time frame.
... View more
Created by
derek_shnosh
in Network Management
in Network Management
09-29-2018
01:50 AM
09-29-2018
01:50 AM
@balaji.bandi wrote:
In you case, after i look fresh mind. here is my suggestions.
If this is Zero touch provision, and you want parse the EEM Script, that means you have Device Access.
If you have already have device access then you do if statement to check what device and parse the image name based on the model.
https://github.com/PackeTsar/freeztp/blob/v1.0.1/ztp.py
That is exactly what I'm asking for assistance with, building the IF statements for the EEM applet to parse the output of show version.
... View more
Created by
derek_shnosh
in Network Management
in Network Management
09-28-2018
04:19 PM
09-28-2018
04:19 PM
@balaji.bandi wrote:
APIC-EM is FREEE ! that is good part. and it is easy i did in 2 hours time. all works charm.
With all due respect; I'd like to keep this discussion on topic. Do you have any suggestions in regards to the question as it was outlined?
... View more
Created by
derek_shnosh
in Network Management
in Network Management
09-28-2018
04:11 PM
09-28-2018
04:11 PM
@balaji.bandi wrote:
So you looking Auto provision the switch ? Why not consider Cisco APIC-EM 1.6 it is free and it does the work for you.
I looked into APIC-EM, but due to resource limitations and the fact that we're already well invested in this solution, making the change for this project isn't feasible.
... View more
Created by
derek_shnosh
in Network Management
in Network Management
09-28-2018
04:03 PM
09-28-2018
04:03 PM
@balaji.bandi wrote:
More curious to understand what is the use case for this example ?
ZTP... in short, see the ladder diagram here; for details scroll up to the ZTP Process - Step 3 section.
The switches are coming out of the box with 3.7.4E on them, unfortunately our use-case requires 16.3.6.
The issue is that smart-install cannot upgrade from 3.7.4E to 16.3.x (per bug CSCvd49193). Since that bug redirects to another bug, below is a screenshot as provided by TAC.
Anyways, my intent is to put this applet into the initial_config to see if I can interrupt the smart-install process with no vstack , but I only want it to interrupt if its a 3850 running version 3.x.
... View more
Created by
derek_shnosh
in Network Management
in Network Management
09-28-2018
03:39 PM
09-28-2018
03:39 PM
Is there an elegant way to obtain the switch software version using an EEM applet?
On a 3850 running 3.7.4E, event manager info;
#show event man ver
Embedded Event Manager Version 4.00
Component Versions:
eem: (rel9)1.2.8
eem-gold: (rel1)1.0.2
eem-call-home: (rel2)1.0.4
Output from show version | i universal ;
* 1 62 WS-C3850-12X48U 03.07.04E cat3k_caa-universalk9 INSTALL
2 62 WS-C3850-12X48U 03.07.04E cat3k_caa-universalk9 INSTALL
Here's a gist of what I'm looking for;
event manager applet get_version
event none
action 1.00 cli command "enable"
action 2.00 cli command "show version | i universal" action 3.00 if model is 3850
action 4.00 if version is 3.x.x
action 4.01 cli command "some-command"
action 4.02 cli command "write erase"
action 4.03 cli command ""
action 4.04 cli command "reload"
action 4.05 cli command ""
action 5.00 end action 6.00 end
Edit/Update: I did find the SNMP OID for the switch version, not sure if this can be used at all in the applet.
snmpwalk -v1 -c testing 172.17.250.6 iso.3.6.1.4.1.9.9.249.1.1.1.1.7.1000
... View more
Labels:
Created by
derek_shnosh
in Switching
in Switching
08-10-2018
01:49 PM
08-10-2018
01:49 PM
I just went through this yesterday on a new 3650 running IOS-XE 16.3.6. Using the same configuration, the switch was using the CON method list for login authentication, but using the VTY method list for authorization; i.e. sending exec and command authorizations to TACACS (ISE).
Ultimately I ended up with the following config to meet my requirements;
Config
line con 0 exec-timeout 15 0 logging synchronous login authentication CON line vty 0 15 exec-timeout 30 0 logging synchronous transport input ssh
!
aaa authentication login CON local
aaa authentication login default group ISE-TACACS local
aaa authorization console
aaa authorization exec default local group ISE-TACACS if-authenticated
Results
Console connections use the CON method list to authenticate and the default method list to authorize against local switch user(s) privileges.
SSH connections use the default method list to authenticate and authorize against ISE/TACACS policies.
The default authorization method list includes local and the ISE-TACACS group; the users authorize to whichever credential/method they authenticated with.
... View more
Created by
derek_shnosh
in Community Feedback Forum
in Community Feedback Forum
08-10-2018
10:32 AM
08-10-2018
10:32 AM
The Twitter entry under My Settings > Personal > Social Accounts requests the full URL, but actually requires that only the twitter user name is specified.
Obviously not a huge deal, it just threw me off since the LinkedIn entry requires the full URL.
... View more
Labels:
Created by
derek_shnosh
in Networking Documents
03-19-2019
03-19-2019
PreambleExampleCSVSwitch PrioritiesSwitch
NumbersProcess/ExplanationSnippetMerged Config ExampleVali...
Created by
derek_shnosh
in Cisco Bug Discussions
01-21-2019
01-21-2019
Adding my name to the hat... (config-applet)# event neighbor-discovery
interface ethernet regex Ethe...
Created by
derek_shnosh
in Network Management
01-03-2019
01-03-2019
Thanks Joe - any thoughts on defining two different events/triggers to
run a separate set of actions...
Created by
derek_shnosh
in Network Management
01-02-2019
01-02-2019
This ED, has ED? 藍 Sorry inappropriate way to start my 2019 posting
history. I did try to debug even...
Created by
derek_shnosh
in Network Management
01-01-2019
01-01-2019
My goal is to build out an applet to assign a dynamic description to any
interface with an authentic...
12-13-2018
Is this still not possible on Nexus, specifically 9000? I see that
`event neighbor-discovery` is val...
12-05-2018
I feel like I'm missing something; clicking the Register Today button
simply redirects me to Cisco C...
10-04-2018
Apologies for the delayed response, and thanks for the link @Joe Clarke!
I'm going to dig around tha...
09-29-2018
@balaji.bandi wrote: In you case, after i look fresh mind. here is my
suggestions. If this is Zero t...
09-28-2018
@balaji.bandi wrote: APIC-EM is FREEE ! that is good part. and it is
easy i did in 2 hours time. all...
09-28-2018
@balaji.bandi wrote: So you looking Auto provision the switch ? Why not
consider Cisco APIC-EM 1.6 i...
09-28-2018
@balaji.bandi wrote: More curious to understand what is the use case for
this example ? ZTP... in sh...
09-28-2018
Is there an elegant way to obtain the switch software version using an
EEM applet? On a 3850 running...
08-10-2018
I just went through this yesterday on a new 3650 running IOS-XE 16.3.6.
Using the same configuration...
Created by
derek_shnosh
in Community Feedback Forum
08-10-2018
08-10-2018
The Twitter entry under My Settings > Personal > Social Accounts
requests the full URL, but actually...
Public Statistics
| Date Registered | 11-16-2012 11:17 AM |
| Date Last Visited | 08-02-2019 12:41 AM |
| Total Messages Posted | 30 |
| Total Helpful Votes Received | 35 |
Helpful Votes Given To
| User | Helpful Count |
|---|---|
| 25 | |
| 5 | |
| 5 | |
| 10 | |
| 5 |
.jpg "Hall of Fame Cisco Employee"){kind=icon}
Helpful Votes From
