The Switch Integrated Security Features based (SISF-primarily based) gadget tracking function is a part of the suite of first-hop security options. The principle function of the feature is to trace the presence, location, and movement of end-nodes in the network. SISF snoops site visitors received by the switch, extracts device identity (MAC and IP address), iTagPro portable and shops them in a binding table. Many features, comparable to, IEEE 802.1X, web authentication, Cisco TrustSec and LISP and so on., rely on the accuracy of this data to operate properly. SISF-based mostly system monitoring supports each IPv4 and IPv6. Even with the introduction of SISF-primarily based device monitoring, the legacy system monitoring CLI (IP Device Tracking (IPDT) and IPv6 Snooping CLI) continues to be available. The IPDT and IPv6 Snooping commands are deprecated, however proceed to be available. We suggest that you improve to SISF-based mostly system tracking. If you're using the IPDT and IPv6 Snooping CLI and need to migrate to SISF-based system tracking, see Migrating from legacy IPDT and IPv6 Snooping to SISF-Based Device Tracking, for extra info.

SISF-primarily based gadget tracking may be enabled manually (by using gadget-monitoring commands), or iTagPro smart device programmatically (which is the case when providing machine tracking providers to other options). SISF-based system monitoring is disabled by default. You'll be able to allow it by defining a device monitoring coverage and attaching the policy to a particular goal. The target could possibly be an interface or a VLAN. Option 1: Apply the default gadget monitoring policy to a target. Enter the system-monitoring command in the interface configuration mode or within the VLAN configuration mode. The system then attaches the default policy it to the interface or ItagPro VLAN. The default coverage is a constructed-in policy with default settings; you can't change any of the attributes of the default coverage. In order to be able to configure system monitoring policy attributes you will need to create a customized policy. See Option 2: Create a custom policy with custom settings. Option 2: Create a customized coverage with custom settings. Enter the gadget-tracking policy command in world configuration mode and enter a custom coverage name.

The system creates a coverage with the title you specify. You'll be able to then configure the accessible settings, within the machine tracking configuration mode (config-machine-monitoring), and attach the policy to a specified goal. Some features rely on gadget tracking and utilize the trusted database of binding entries that SISF-primarily based gadget tracking builds and maintains. These options, additionally known as system monitoring purchasers, allow system tracking programmatically (create and attach the device tracking coverage). The exceptions here are IEEE 802.1X, web authentication, Cisco TrustSec, and IP Source Guard (IPSG) - in addition they rely on device tracking, but they do not enable it. For these device monitoring shoppers, you could enter the ip dhcp snooping vlan vlan command, to programmatically enable gadget tracking on a selected target. A device monitoring client requires system monitoring to be enabled. There are a number of gadget tracking shoppers, due to this fact, a number of programmatic insurance policies might be created. The settings of each coverage differ relying on the device tracking client that creates the coverage.

The coverage that's created, and its settings, are system-defined. Configurable coverage attributes can be found in the device monitoring configuration mode (config-system-monitoring) and vary from one release to another. Should you attempt to switch an attribute that is not configurable, the configuration change is rejected and an error message is displayed. For extra information about programmatically created policies, see Programmatically Enabling SISF-Based Device Tracking in Cisco IOS XE Fuji 16.9.x and Later Releases. Based on the legacy configuration that exists in your gadget, the system-tracking upgrade-cli command upgrades your CLI differently. Consider the following configuration scenarios and the corresponding migration results before you migrate your current configuration. You can't configure a mixture of the previous IPDT and IPv6 snooping CLI with the SISF-primarily based machine monitoring CLI. In case your machine has only IPDT configuration, iTagPro geofencing working the machine-monitoring improve-cli command converts the configuration to make use of the brand iTagPro geofencing new SISF coverage that's created and hooked up to the interface.