Cisco Device Sensor: Руководство пользователя по CDP, LLDP, DHCP и другим протоколам (EN)

Restrictions for Device Sensor

Device Sensor The Device Sensor feature is used to gather raw endpoint data from network devices using protocols such as Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), Dynamic Host Configuration Protocol (DHCP), DHCP version 6, and multicast DNS (mDNS). The endpoint data that is gathered is made available to registered clients in the context of an access session.

Restrictions for Device Sensor, on page 1 Information About Device Sensor, on page 2 How to Configure Device Sensor, on page 3 Configuration Examples for Device Sensor , on page 9 Feature History for Device Sensor, on page 10 Restrictions for Device Sensor • Only Cisco Discovery Protocol (CDP), Link Layer Discovery Protocol (LLDP), Dynamic Host Configuration Protocol (DHCP), Dynamic Host Configuration Protocol ersion 6 (DHCPv6), and multicast DNS (mDNS) protocols are supported. • The session limit for profiling ports is 32. • The length of one Type-Length-Value (TLV) must not be more than 1024 and the total length of TLVs (combined length of TLVs) of all protocols must not be more than 4096.

• The sensor profiles devices that are only one hop away. • The Device Sensor feature is enabled by default, but cannot be disabled. Disabling device classifier using no device classifier command in global configuration mode does not disable device sensor. This is because device sensor is independent of IP device tracking and device classifier. • DHCP and DHCPv6 are supported only on access ports. • Trunk ports are not supported; only direct attachment ports are supported. Device Sensor 1

Стр. 1

Device Sensor

Information About Device Sensor Device Sensor The device sensor is used to gather raw endpoint data from network devices. The endpoint information that is gathered helps in completing the profiling capability of devices. Profiling is the determination of the endpoint type based on information gleaned from various protocol packets from an endpoint during its connection to a network. The profiling capability consists of two parts: • Collector—Gathers endpoint data from network devices. • Analyzer—Processes the data and determines the type of device. The device sensor represents the embedded collector functionality.

The illustration below shows the Cisco sensor in the context of the profiling system and also features other possible clients of the sensor. A device with sensor capability gathers endpoint information from network devices using protocols such as Cisco Discovery Protocol, LLDP, DHCPv6, mDNS and DHCP, subject to statically configured filters, and makes this information available to its registered clients in the context of an access session. An access session represents an endpoint’s connection to the network device. The device sensor has internal and external clients.

The internal clients include components such as the embedded Device Classifier (local analyzer), ATM switch processor (ASP), MSI-Proxy, and EnergyWise Device Sensor Information About Device Sensor Device Sensor 2

Стр. 2

Enabling Accounting Augmentation

(EW). The external client, that is the Identity Services Engine (ISE) analyzer, will use RADIUS accounting to receive additional endpoint data. Client notifications and accounting messages containing profiling data along with the session events and other session-related data, such as the MAC address and the ingress port, are generated and sent to the internal and external clients (ISE). By default, for each supported peer protocol, client notifications and accounting events are only generated where an incoming packet includes a TLV that has not previously been received in the context of a given session.

You can enable client notifications and accounting events for all TLV changes, where either a new TLV has been received or a previously received TLV has been received with a different value using CLI commands. The device sensor’s port security protects the switch from consuming memory and crashing during deliberate or unintentional denial-of-service (DoS) type attacks. The sensor limits the maximum device monitoring sessions to 32 per port. In case of lack of activity from hosts, the idle session time is 12 hours. How to Configure Device Sensor The device sensor is enabled by default.

The following tasks are applicable only if you want to configure the sensor based on your specific requirements. Note If you do not perform these configuration tasks, then the following TLVs are included by default: • Cisco Discovery Protocol filter—secondport-status-type and powernet-event-type (type 28 and 29). • LLDP filter—organizationally-specific (type 127). • DHCP filter—message-type (type 53). Enabling Accounting Augmentation Perform this task to add device sensor protocol data to accounting records. Before you begin • The device must be in IBNS 1.0 mode before performing this task.

• For the sensor protocol data to be added to the accounting messages, you must enable session accounting by using the standard authentication, authorization, and accounting (AAA), and RADIUS configuration commands. Procedure Device Sensor How to Configure Device Sensor Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. • Enter your password if prompted. Device Sensor 3

Стр. 3

Configuring Protocol Attributes in Access and Accounting Requests

Configuring Protocol Attributes in Access and Accounting Requests Perform this task to create an attribute filter-list and to bind an attribute filter-list with authentication and accounting requests. Before you begin The device must be in IBNS 2.0 mode before performing this task. Procedure Device Sensor Configuring Protocol Attributes in Access and Accounting Requests Command or Action Purpose Step 2 configure terminal Example: Device# configure terminal Enters global configuration mode. Step 3 device-sensor accounting Example:

Device(config)# device-sensor accounting Enables the addition of sensor protocol data to accounting records and also enables the generation of additional accounting events when new sensor data is detected. Step 4 end Example: Device(config)# end Exits global configuration mode and returns to privileged EXEC mode. Command or Action Purpose Step 1 enable Example: Device> enable Enables privileged EXEC mode. Enter your password if prompted. Step 2 configure terminal Example: Device(config)# configure terminal Enters global configuration mode. Step 3 access-session attributes filter-list list list-name Example:

Device(config)# access-session attributes filter-list list mylist Adds access-session protocol data to accounting and authentication records and enters common filter list configuration mode. The filter-list keyword configures a sensor protocol filter list to accounting and authentication records. Step 4 {cdp | dhcp | dhcpv6 | http | lldp | vlan-id} Example: Device(config-com-filter-list)# dhcp Includes the specified protocol for the attribute. Device Sensor 4

Стр. 4