Autoconf uses the Device Classifier to identify the end devices that are connected to a port.
The Autoconf feature uses the device classification information gleaned from Cisco Discovery Protocol, LLDP, DHCP, MAC addresses,
and the Organizationally Unique Identifier (OUI) that is identified by the Device Classifier.
The Device Classifier provides improved device classification capabilities and accuracy, and increased device visibility for
enhanced configuration management.
Device classification is enabled when you enable the Autoconf feature using autoconf enable command in global configuration mode .
The device detection acts as an event trigger, which in turn applies the appropriate automatic template to the interface.
The Autoconf feature is based on a three-tier hierarchy.
-
A policy map identifies the trigger type for applying the Autoconf feature.
-
A parameter map identifies the appropriate template that must be applied, based on the end device.
-
The templates contain the configurations to be applied.
The Autoconf built-in templates and triggers perform the these three steps automatically.
The Autoconf feature provides the following built-in templates:
-
AP_INTERFACE_TEMPLATE
-
DMP_INTERFACE_TEMPLATE
-
IP_CAMERA_INTERFACE_TEMPLATE
-
IP_PHONE_INTERFACE_TEMPLATE
-
LAP_INTERFACE_TEMPLATE
-
MSP_CAMERA_INTERFACE_TEMPLATE
-
MSP_VC_INTERFACE_TEMPLATE
-
PRINTER_INTERFACE_TEMPLATE
-
ROUTER_INTERFACE_TEMPLATE
-
SWITCH_INTERFACE_TEMPLATE
-
TP_INTERFACE_TEMPLATE
Note
|
By default built-in templates are not displayed under running configuration. The built-in templates show in the running configuration
only if you edit them.
|
The template that is selected is based on parameter map information applied to an interface. This information can be based
on the following criteria:
-
End Device type
-
MAC address
-
OUI
-
Platform type
-
User role
-
Username
The Autoconf feature provides one built-in parameter map BUILTIN_DEVICE_TO_TEMPLATE with the following configuration:
Parameter-map name: BUILTIN_DEVICE_TO_TEMPLATE
Map: 10 map device-type regex "Cisco-IP-Phone"
Action(s):
20 interface-template IP_PHONE_INTERFACE_TEMPLATE
Map: 20 map device-type regex "Cisco-IP-Camera"
Action(s):
20 interface-template IP_CAMERA_INTERFACE_TEMPLATE
Map: 30 map device-type regex "Cisco-DMP"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 40 map oui eq "00.0f.44"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 50 map oui eq "00.23.ac"
Action(s):
20 interface-template DMP_INTERFACE_TEMPLATE
Map: 60 map device-type regex "Cisco-AIR-AP"
Action(s):
20 interface-template AP_INTERFACE_TEMPLATE
Map: 70 map device-type regex "Cisco-AIR-LAP"
Action(s):
20 interface-template LAP_INTERFACE_TEMPLATE
Map: 80 map device-type regex "Cisco-TelePresence"
Action(s):
20 interface-template TP_INTERFACE_TEMPLATE
Map: 90 map device-type regex "Surveillance-Camera"
Action(s):
10 interface-template MSP_CAMERA_INTERFACE_TEMPLATE
Map: 100 map device-type regex "Video-Conference"
Action(s):
10 interface-template MSP_VC_INTERFACE_TEMPLATE
Note
|
Use the show parameter-map type subscriber attribute-to-service All command to view the configuration for the built-in parameter map.
|
The Autoconf feature provides one built-in policy map BUILTIN_AUTOCONF_POLICY with the following configuration: BUILTIN_AUTOCONF_POLICY
event identity-update match-all
10 class always do-until-failure
10 map attribute-to-service table BUILTIN_DEVICE_TO_TEMPLATE
Note
|
Use the show policy-map type control subscriber BUILTIN_AUTOCONF_POLICY command to view the configuration for the built-in policy map.
|
You can also manually create policy maps, parameter maps, and templates.
When a trigger is created that is based on specific user information, a local 802.1X Cisco Identity Services Engine (ISE)
server authenticates it ensuring the security of the operation.
An interface template can be dynamically activated (on an interface) using any of the following methods:
- RADIUS CoA—While Change of Authorization (CoA) commands are targeted to one or more access sessions, any referenced template
must be applied to the interface hosting the referenced session.
- RADIUS Access-Accept for client authentication or authorization—Any referenced interface template returned in an Access-Accept
must be applied to the port that is hosting the authorized access session.
- Service template—If an interface template is referenced in a service template that is either locally defined or sourced from
the AAA server, the interface template must be applied to the interface hosting any access-session on which the service template
is applied (add a new command for interface template reference from within a locally defined service template).
- Subscriber control-policy action—A mapping action under the subscriber control policy activates service and/or interface
template (as referenced in a parameter map) based on the type of filter, and removes any templates associated with a previous
policy.
- Device-to-template parameter map—A subscriber parameter map that allows the filter type to service and/or interface template
mappings to be specified in an efficient and readable manner.
Feedback