# Playbook for cisco switch interface Network Access Control

**URL:** <https://forum.ansible.com/t/playbook-for-cisco-switch-interface-network-access-control/33913>\
**Category:** Ansible Project\
**Created:** [September 28, 2020, 8:16pm UTC](https://forum.ansible.com/t/playbook-for-cisco-switch-interface-network-access-control/33913 "2020-09-28T20:16:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Richard\_Lucht](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@Richard\_Lucht](https://forum.ansible.com/u/Richard_Lucht)\
**Post date:** [September 28, 2020, 8:16pm UTC](https://forum.ansible.com/t/playbook-for-cisco-switch-interface-network-access-control/33913/1 "2020-09-28T20:16:43Z")

</div>

Hello experts, I am looking for a way to automate access ports for NAC on legacy authentication. I only want to configure ports that already have “switchport mode access” and the “authentication event server dead action authorize vlan” we would like to match to the current vlan.

I need to go from  
int gi 0/1  
switchport access vlan 3216  
switchport mode access  
switchport voice vlan 120

spanning-tree portfast

to

switchport access vlan 105  
switchport mode access  
switchport voice vlan 120  
ip device tracking maximum 10  
authentication event server dead action authorize vlan 105  
authentication host-mode multi-auth  
authentication order dot1x mab webauth  
authentication priority dot1x mab  
authentication port-control auto  
authentication periodic  
authentication timer reauthenticate server  
mab  
dot1x pae authenticator  
dot1x timeout tx-period 10  
spanning-tree portfast

---

<div class="post-metadata">

**Author:** ![Mauricio\_Tavares](https://avatars.discourse-cdn.com/v4/letter/m/b5e925/32.png) [@Mauricio\_Tavares](https://forum.ansible.com/u/Mauricio_Tavares)\
**Post date:** [September 28, 2020, 8:29pm UTC](https://forum.ansible.com/t/playbook-for-cisco-switch-interface-network-access-control/33913/2 "2020-09-28T20:29:59Z")

</div>

I have never used ansible to talk to a cisco box -- I am still  
struggling with my garden-variety juniper SRX box -- but if you could  
pull the config in ansible and register that in a variable, you should  
be able to do some probulating and create a list/dict that you can  
then feed to a loop.

---

<div class="post-metadata">

**Author:** ![Heinz\_Meier](https://avatars.discourse-cdn.com/v4/letter/h/7ba0ec/32.png) [@Heinz\_Meier](https://forum.ansible.com/u/Heinz_Meier)\
**Post date:** [September 29, 2020, 11:54am UTC](https://forum.ansible.com/t/playbook-for-cisco-switch-interface-network-access-control/33913/3 "2020-09-29T11:54:52Z")

</div>

Hi,

use cisco ios config module with a jinja template. Works like a charm for me.

[https://docs.ansible.com/ansible/latest/collections/cisco/ios/ios\_config\_module.html](https://docs.ansible.com/ansible/latest/collections/cisco/ios/ios_config_module.html)

Michael

---

<div class="post-metadata">

**Author:** ![Richard\_Lucht](https://avatars.discourse-cdn.com/v4/letter/r/a8b319/32.png) [@Richard\_Lucht](https://forum.ansible.com/u/Richard_Lucht)\
**Post date:** [September 29, 2020, 1:56pm UTC](https://forum.ansible.com/t/playbook-for-cisco-switch-interface-network-access-control/33913/4 "2020-09-29T13:56:10Z")

</div>

Thank you I will check this out. Is there a GIT for example templates using this?