Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Template for clearing port security on IOS switches

I am trying to create a template that our corporate help desk can use to clear port security on ports of our user switches. The script validates fine but when I test it nothing seems to happen on the switch port I am testing against. I have also created a script that performs a no shut on selected interfaces and have the same problem. Has anybody already created these scripts? If anybody would care to troubleshoot the script I created I have listed it below.

/*
.CHANGE_TEMPLATE_DESCRIPTION
        This change template clears switch port security on selected ports for switches running Cisco IOS.
.CHANGE_TEMPLATE_TAGS
        Cisco, IOS, switch port security
.PLATFORM_DESCRIPTION
        Cisco IOS

.PARAMETER_LABEL @ContextNode
NCM Node
.PARAMETER_DESCRIPTION @ContextNode
The node the template will operate on. All templates require this by default. The target node is selected during the first part of the wizard so it will not be available for selection when defining values of variables.

.PARAMETER_LABEL @TartgetPorts
Select port(s)
.PARAMETER_DESCRIPTION @TargetPorts
Select the port(s) for which you would like to clear port security.

script BaseChangeTemplate(
                             NCM.Nodes @ContextNode,
                             NCM.Interfaces[] @TargetPorts    )
{
// Enter configuration mode
CLI
{
     configure terminal
}
// Loop through selected ports
foreach (@interfaceItem in @ContextNode.Interfaces)
{
    // clear port security
      {
          //Send these CLI commands
          CLI
          {
              clear port-security dynamic interface @PortItem.InterfaceDescription
          }
      }
      CLI
      {
         exit
      }
}
// Exit configuration mode
CLI
{
exit
}

Find more posts tagged with

Accepted answers

All comments

skyline1241

Thank you so much for your post.

__________________
Watch The Eagle Online Free

pruebasrba

Any answer??

djscoot

You are executing the command in configuration terminal, You will either need to add the "do " prefix to the command (do clear port-security dynamic interface @PortItem.InterfaceDescription) or you will need to execute the command in global exec mode by removing the configure terminal CLI section.

I've done it both ways and removing configure terminal doesn't seem to work well, so I would suggest adding the "do " prefix.

rschroeder

If adding the "do" to the script while in config mode doesn't work, consider adding a little more information about your goal so we can tweak the script a little better for you.

When I read your challenge I came away thinking you wanted to not have port-security engaged on specified ports--or all ports--on a switch. You said nothing about possibly wanting to simply clear any sticky-mac entries, which appears to be pertinent to your "clear port-security" command. Is that what you want, instead of not having port-security at all?

When building scripts for Cisco devices, simply test them out manually from the CLI. If "clear port-security" works, use that command in NCM exactly you'd use it in the CLI--don't be in configuration mode, unless you want to add the "do" command before "clear port-security".

If you want to remove port-security instead of clearing sticky-macs, you could use "no switchport port-security" on the ports.

Or if you're using ISE for your port security, you'd use the "no" command prior to the "authentication" commands for the pertinent ports. ISE automatically downloads ACLs to switches and applies them to port ranges, and those ACLs include a fair number of lines.

So help us help you by defining whether you want no port-security at all, or to remove the sticky-mac entries from ports, or no ISE security on certain ports, etc.