Autoconf uses the
Device Classifier to identify the end devices that are connected to a port.
The Autoconf feature
uses the device classification information gleaned from Cisco Discovery
Protocol, LLDP, DHCP, MAC addresses, and the Organizationally Unique Identifier
(OUI) that is identified by the Device Classifier.
The Device
Classifier provides improved device classification capabilities and accuracy,
and increased device visibility for enhanced configuration management.
Device
classification is enabled when you enable the Autoconf feature using
autoconf
enable command in global configuration mode .
The device
detection acts as an event trigger, which in turn applies the appropriate
automatic template to the interface.
The Autoconf
feature is based on a three-tier hierarchy.
-
A policy map
identifies the trigger type for applying the Autoconf feature.
-
A parameter map
identifies the appropriate template that must be applied, based on the end
device.
-
The templates
contain the configurations to be applied.
The Autoconf
built-in templates and triggers perform the these three steps automatically.
The Autoconf feature
provides the following built-in templates:
-
AP_INTERFACE_TEMPLATE
-
DMP_INTERFACE_TEMPLATE
-
IP_CAMERA_INTERFACE_TEMPLATE
-
IP_PHONE_INTERFACE_TEMPLATE
-
LAP_INTERFACE_TEMPLATE
-
MSP_CAMERA_INTERFACE_TEMPLATE
-
MSP_VC_INTERFACE_TEMPLATE
-
PRINTER_INTERFACE_TEMPLATE
-
ROUTER_INTERFACE_TEMPLATE
-
SWITCH_INTERFACE_TEMPLATE
-
TP_INTERFACE_TEMPLATE
Note |
By default
built-in templates are not displayed under running configuration. The built-in
templates show in the running configuration only if you edit them.
|
The template that
is selected is based on parameter map information applied to an interface. This
information can be based on the following criteria:
-
End Device type
-
MAC address
-
OUI
-
User role
-
Username
The Autoconf
feature provides one built-in parameter map BUILTIN_DEVICE_TO_TEMPLATE with the
following configuration:
Parameter-map name: BUILTIN_DEVICE_TO_TEMPLATE
Map: 10 map device-type regex "Cisco-IP-Phone"
Action(s):
20 interface-template IP_PHONE_INTERFACE_TEMPLATE
Map: 20 map device-type regex "Cisco-IP-Camera"
Action(s):
20 interface-template IP_CAMERA_INTERFACE_TEMPLATE
Map: 30 map device-type regex "Cisco-DMP"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 40 map oui eq "00.0f.44"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 50 map oui eq "00.23.ac"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 60 map device-type regex "Cisco-AIR-AP"
Action(s):
20 interface-template AP_INTERFACE_TEMPLATE
Map: 70 map device-type regex "Cisco-AIR-LAP"
Action(s):
20 interface-template LAP_INTERFACE_TEMPLATE
Map: 80 map device-type regex "Cisco-TelePresence"
Action(s):
20 interface-template TP_INTERFACE_TEMPLATE
Map: 90 map device-type regex "Surveillance-Camera"
Action(s):
10 interface-template MSP_CAMERA_INTERFACE_TEMPLATE
Map: 100 map device-type regex "Video-Conference"
Action(s):
10 interface-template MSP_VC_INTERFACE_TEMPLATE
Note |
Use the
show parameter-map type
subscriber attribute-to-service All command to view the
configuration for the built-in parameter map.
|
The Autoconf feature
provides one built-in policy map BUILTIN_AUTOCONF_POLICY with the following
configuration:
BUILTIN_AUTOCONF_POLICY
event identity-update match-all
10 class always do-until-failure
10 map attribute-to-service table BUILTIN_DEVICE_TO_TEMPLATE
Note |
Use the
show policy-map type
control subscriber BUILTIN_AUTOCONF_POLICY command to view the
configuration for the built-in policy map.
|
You can also
manually create policy maps, parameter maps, and templates.
When a trigger is
created that is based on specific user information, a local 802.1X Cisco
Identity Services Engine (ISE) server authenticates it ensuring the security of
the operation.
An interface
template can be dynamically activated (on an interface) using any of the
following methods:
- RADIUS CoA—While Change of
Authorization (CoA) commands are targeted to one or more access sessions, any
referenced template must be applied to the interface hosting the referenced
session.
- RADIUS Access-Accept for
client authentication or authorization—Any referenced interface template
returned in an Access-Accept must be applied to the port that is hosting the
authorized access session.
- Service template—If an
interface template is referenced in a service template that is either locally
defined or sourced from the AAA server, the interface template must be applied
to the interface hosting any access-session on which the service template is
applied (add a new command for interface template reference from within a
locally defined service template).
- Subscriber control-policy
action—A mapping action under the subscriber control policy activates service
and/or interface template (as referenced in a parameter map) based on the type
of filter, and removes any templates associated with a previous policy.
- Device-to-template
parameter map—A subscriber parameter map that allows the filter type to service
and/or interface template mappings to be specified in an efficient and readable
manner.
Feedback