Autoconf uses the Device Classifier to identify the end devices that are connected to a port.
The Autoconf feature uses the device classification information gleaned from Cisco Discovery Protocol, LLDP, DHCP, MAC addresses,
and the Organizationally Unique Identifier (OUI) that is identified by the Device Classifier.
The Device Classifier provides improved device classification capabilities and accuracy, and increased device visibility for
enhanced configuration management.
Device classification is enabled when you enable the Autoconf feature using the autoconf enable command in global configuration mode.
The device detection acts as an event trigger, which in turn applies the appropriate automatic template to the interface.
The Autoconf feature is based on a three-tier hierarchy.
-
A policy map identifies the trigger type for applying the Autoconf feature.
-
A parameter map identifies the appropriate template that must be applied, based on the end device.
-
The templates contain the configurations to be applied.
The Autoconf built-in templates and triggers perform the above tasks automatically.
The Autoconf feature provides the following built-in templates:
-
AP_INTERFACE_TEMPLATE
-
DMP_INTERFACE_TEMPLATE
-
IP_CAMERA_INTERFACE_TEMPLATE
-
IP_PHONE_INTERFACE_TEMPLATE
-
LAP_INTERFACE_TEMPLATE
-
MSP_CAMERA_INTERFACE_TEMPLATE
-
MSP_VC_INTERFACE_TEMPLATE
-
PRINTER_INTERFACE_TEMPLATE
-
ROUTER_INTERFACE_TEMPLATE
-
SWITCH_INTERFACE_TEMPLATE
-
TP_INTERFACE_TEMPLATE
Note
|
By default, built-in templates are not displayed under running configuration. The built-in templates are displayed in the
running configuration only if you edit them.
|
The template that is selected is based on parameter map information applied to an interface. This information can be based
on the following criteria:
-
End Device type
-
MAC address
-
OUI
-
Platform type
-
User role
-
Username
The Autoconf feature provides one built-in parameter map (BUILTIN_DEVICE_TO_TEMPLATE) with the following configuration:
Parameter-map name: BUILTIN_DEVICE_TO_TEMPLATE
Map: 10 map device-type regex "Cisco-IP-Phone"
Action(s):
20 interface-template IP_PHONE_INTERFACE_TEMPLATE
Map: 20 map device-type regex "Cisco-IP-Camera"
Action(s):
20 interface-template IP_CAMERA_INTERFACE_TEMPLATE
Map: 30 map device-type regex "Cisco-DMP"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 40 map oui eq "00.0f.44"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 50 map oui eq "00.23.ac"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 60 map device-type regex "Cisco-AIR-AP"
Action(s):
20 interface-template AP_INTERFACE_TEMPLATE
Map: 70 map device-type regex "Cisco-AIR-LAP"
Action(s):
20 interface-template LAP_INTERFACE_TEMPLATE
Map: 80 map device-type regex "Cisco-TelePresence"
Action(s):
20 interface-template TP_INTERFACE_TEMPLATE
Map: 90 map device-type regex "Surveillance-Camera"
Action(s):
10 interface-template MSP_CAMERA_INTERFACE_TEMPLATE
Map: 100 map device-type regex "Video-Conference"
Action(s):
10 interface-template MSP_VC_INTERFACE_TEMPLATE
Note
|
Use the show parameter-map type subscriber attribute-to-service All command to view the configuration for the built-in parameter map.
|
The Autoconf feature provides one built-in policy map (BUILTIN_AUTOCONF_POLICY) with the following configuration: BUILTIN_AUTOCONF_POLICY
event identity-update match-all
10 class always do-until-failure
10 map attribute-to-service table BUILTIN_DEVICE_TO_TEMPLATE
Note
|
Use the show policy-map type control subscriber BUILTIN_AUTOCONF_POLICY command to view the configuration for the built-in policy map.
|
You can also manually create policy maps, parameter maps, and templates.
When a trigger is created that is based on specific user information, a local 802.1X Cisco Identity Services Engine (ISE)
server authenticates it, ensuring the security of the operation.
An interface template can be dynamically activated (on an interface) using any of the following methods:
- RADIUS CoA: While Change of Authorization (CoA) commands are targeted at one or more access sessions, any referenced template
must be applied to the interface that is hosting the referenced session.
- RADIUS Access-Accept for client authentication or authorization: Any referenced interface template returned in an Access-Accept
must be applied to the port that is hosting the authorized access session.
- Service template: If an interface template is referenced in a service template that is either locally defined or sourced
from the AAA server, the interface template must be applied to the interface hosting an access-session on which the service
template is applied. (Add a new command for interface template reference from within a locally defined service template.)
- Subscriber control-policy action: A mapping action under the subscriber control policy activates service or interface template
(as referenced in a parameter map) or both based on the type of filter, and removes templates, if any, associated with a previous
policy.
- Device-to-template parameter map: A subscriber parameter map that allows the filter type-to-service or interface template
mappings or both to be specified in an efficient and readable manner.
Feedback