Cisco ISE Switch Template

[sejelmohajj]

Guys, attached my Cisco ISE Switch Template, please let me know if I am missing anything.

[Rahul Govindan]

I would reference the following doc if you are not already using it:
https://communities.cisco.com/docs/DOC-68171
Just a quick run through and I noticed that "ip device tracking" was missing. If you need dACL, redirect URL etc, then this is essential. Also, I did not see any ACL's in the template. If you are using ACL's for port authorization , you might want to add it there.

[sejelmohajj]

 help me to write Cisco Switch Port ISE Configuration using MAB for Cisco Access Points.

Regards 

[agrissimanis]

The config for access points would depend on whether you are using APs in local mode or Flexconnect. Nothing specific is needed for APs in local mode (that is tunneling all client traffic to the WLC). On ISE, just use profiling or add the AP MAC address to one of the endpoint groups.

If the AP is running in Flexconnect mode (switching client traffic locally), one option is to use "authentication host-mode multi-host" interface config command. That will cause AP to authenticate, but the wireless client MAC addresses that appear on the same port later, would not be authenticated (they would already have been authenticated by the WLC in some form anyway).

For a full port config check the attachment of this post, that is a good example.

[agrissimanis]

In terms of logging, I would say that you don't need the "epm logging" under normal operation, just if you are troubleshooting.

Also, you may find these three commands helpful (this causes switch not to log successful authentications, just failures):

no authentication logging verbose
no dot1x logging verbose
no mab logging verbose