Cisco Catalyst 2960 Series, Configuration Manual

Page: 1536 / 2288

The Auto Identity feature uses the Cisco Common Classification Policy Language-based configuration that
significantly reduces the number of commands used to configure both authentication methods and interface-level
commands. The Auto Identity feature provides a set of built-in policies that are based on policy maps, class
maps, parameter maps, and interface templates.
In global configuration mode, the source template AI_GLOBAL_CONFIG_TEMPLATE command
enables the Auto Identity feature. In interface configuration mode, configure the AI_MONITOR_MODE,
AI_LOW_IMPACT_MODE, or AI_CLOSED_MODE interface templates to enable the feature on interfaces.
You can configure multiple templates; however, you must bind multiple templates together using the merge
command. If you do not bind the templates, the last configured template is used. While binding templates, if
the same command is repeated in two templates with different arguments, the last configured command is
used.
You can also enable user-defined templates that are configured using the
template name
command in
global configuration mode .
Note
Use the show template interface or show template global commands to display information about built-in
templates. Built-in templates can be edited. Built-in template information is displayed in the output of the
show running-config command, if the template is edited. If you delete an edited built-in template, the built-in
template reverts to the default and is not deleted from the configuration. However; if you delete a user-defined
template, it is deleted from the configuration.
Before you delete a template, ensure that it is not attached to a device.
Note
Auto Identity Global Template
To enable the global template, configure the source template template-name command.
You must configure the RADIUS server commands, because these are not automatically configured when
the global template is enabled.
Note
The following example shows how to enable the global template:
Switch(config)#
source template AI_GLOBAL_CONFIG_TEMPLATE
Switch(config)# radius server ISE
Switch(config-radius-server)# address ipv4 172.20.254.4 auth-port 1645 acct-port 1646
Switch(config-radius-server)# key cisco
Switch(config-radius-server)#
end
The AI_GLOBAL_CONFIG_TEMPLATE automatically configures the following commands:
dot1x system-auth-control
aaa new-model
aaa authentication dot1x default group radius
aaa authorization network default group radius
aaa authorization auth-proxy default group radius
aaa accounting identity default start-stop group radius
aaa accounting system default start-stop group radius
radius-server attribute 6 on-for-login-auth
radius-server attribute 6 support-multiple
radius-server attribute 6 voice 1
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
Consolidated Platform Configuration Guide, Cisco IOS Release 15.2(4)E (Catalyst 2960-X Switches)
1454
Auto Identity