Restrictions for Policy Classification Engine
Interface templates are not valid on wireless sessions.
The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
Interface templates are not valid on wireless sessions.
The Policy Classification Engine feature helps configure device-based policies and client (network endpoint) profiling and enforces a per user or per device policy on a network.
You can configure sets of different policies that can be used for lookup and sequential matching. A policy is matched based on the configured policy statement. Use policies to profile devices based on the Dynamic Host Control Protocol (DHCP) or HTTP to identify end devices in a network. You can enforce specific policies at network endpoints.
The device (switch; for example, Cisco Catalyst 3850 Wireless LAN Controller) uses these attributes and predefined classification profiles to identify devices.
Policies are configured based on the following parameters:
Device—Types of end devices. Examples are Windows machines, smart phones, Apple device like iPads, iPhones, and so on.
Regular expressions
User role—The user type or user group to which an user belongs. Examples are students, employees, and so on.
Username—Login credentials entered by users.
Time-of-day—The time-of-day when endpoints are allowed into a network.
OUI—The MAC address that identifies the Organizational Unique Identifier (OUI).
MAC address—The MAC address of the endpoint.
Once the device (switch) has a match corresponding to the policy parameters per end point, a policy is added. Policy enforcement is based on the following session attributes:
VLAN—User-defined VLAN
Access control list (ACL)
Session timeout value—User-defined timeout for client sessions
Quality of service (QoS)
You can configure policies and based on the session attributes, enforce these policies on end points.
To configure policies, perform the following tasks:
Configure a service template.
Configure an interface template.
Create a parameter map.
Create a policy map.
Apply the policy on a wireless LAN (WLAN).
Command or Action | Purpose | |
---|---|---|
Step 1 |
enable Example:
|
Enables privileged EXEC mode.
|
Step 2 |
configure terminal Example:
|
Enters global configuration mode. |
Step 3 |
parameter-map type subscriber attribute-to-service parameter-map-name Example:
|
Configures a subscriber parameter map and enters parameter-map filter configuration mode. |
Step 4 |
priority-number map device-type eq device-type oui eq MAC-address Example:
|
Maps the priority and the Organizationally Unique Identifier (OUI) of the configured device, and enters parameter-map filter submode configuration mode. |
Step 5 |
action-number interface-template interface-template-name Example:
|
Maps the action number to an interface template. |
Step 6 |
end Example:
|
Exits parameter-map filter submode configuration mode and returns to privileged EXEC mode. |
Step 7 |
show parameter-map type subscriber attribute-to-service parameter-map-name Example:
|
Displays information about the specified parameter map. |
The following is sample output from the show parameter-map type subscriber attribute-to-service command:
Device# show parameter-map type subscriber attribute-to-service param-map
Parameter-map name: param-map
Map: 1 map device-type eq "Cisco-IP-Phone-9971" oui eq "08.cc.68"
Action(s):
2 interface-template IP-PHONE-INTERFACE-TEMPLATE
Command or Action | Purpose | |
---|---|---|
Step 1 |
enable Example:
|
Enables privileged EXEC mode.
|
Step 2 |
configure terminal Example:
|
Enters global configuration mode. |
Step 3 |
policy-map type control subscriber policy-map-name Example:
|
Defines a control policy for subscriber sessions and enters control policy-map event configuration mode. |
Step 4 |
event identity-update {match-all | match-first} Example:
|
Specifies the event type that triggers actions in a control policy if conditions are met, and enters control policy-map class configuration mode. |
Step 5 |
priority-number class always {do-all | do-until-failure | do-until-success} Example:
|
Associates a control class with one or more actions in a control policy and enters control policy-map action configuration mode. |
Step 6 |
action-number map attribute-to-service table parameter-map-name Example:
|
Maps identity-update attribute to an autoconf template. |
Step 7 |
end Example:
|
Exits control policy-map action configuration mode and returns to privileged EXEC mode. |
Step 8 |
show policy-map type control subscriber policy-map-name Example:
|
Displays information and statistics about the control policies. |
The following is sample output from the show policy-map type control subscriber command:
Device# show policy-map type control subscriber pmap
show policy-map type control subscriber pmap
policy-map
event identity-update match-all
1 class always do-until-failure
1 map attribute-to-service table param-map
Device# configure terminal
Device(config)# parameter-map type subscriber attribute-to-service param-map
Device(config-parameter-map-filter)# 1 map device-type eq “Cisco-IP-Phone-9971” oui “eq 08.cc.68”
Device(config-parameter-map-filter-submode)# 2 interface-template IP-PHONE-INTERFACE-TEMPLATE
Device(config-parameter-map-filter-submode)# end
Device# configure terminal
Device(config)# policy-map type control subscriber pmap
Device(config-event-control-policymap)# event identity-update match-all
Device(config-class-control-policymap)# 1 class always do-until-failure
Device(config-action-control-policymap)# 2 map attribute-to-service table param-map
Device(config-action-control-policymap)# end
This table provides release and related information for the features explained in this module.
These features are available in all the releases subsequent to the one they were introduced in, unless noted otherwise.
Release |
Feature Name |
Feature Information |
---|
Use the Cisco Feature Navigator to find information about platform and software image support. To access Cisco Feature Navigator, go to https://cfnng.cisco.com.