Chapter 8 Data Models and Dynamic Templates

Operational Zone Operational zone ports are likely the most common port type on the campus enterprise network. These are ports where user workstations, laptops, printers, and other end user devices connect to gain access to the network. Often these ports have some basic standards applied to them to keep them as secure as possible and to offer services such as VoIP.

This sample network has several operational zone VRFs that a VLAN can be part of. Access port templates are unaware of the VRF. Only the access VLAN needs to be set on the port to put it in a zone. Therefore, only a singular template for GREEN, RED, BLUE zones is required. Apply 802.1x to the operational zone ports for security purposes.

{%  if host_interfaces is defined %} 
{%      for host_interface in host_interfaces %} 
{%          if host_interfaces[host_interface].type is defined %} 
{%                  if host_interfaces[host_interface].type == "OPZone" %} 
interface {{ host_interface }} 
 switchport mode access 
 switchport nonegotiate 
 switchport access vlan {{ host_interfaces[host_interface].vlan }} 
{%                      if host_interfaces[host_interface].voice_vlan is defined %} 
 switchport voice vlan {{ host_interfaces[host_interface].voice_vlan }} 
{%                          if platform_defaults.type == 3750 %} 
 mls qos trust device cisco-phone 
 mls qos trust cos 
{%                          endif %} 
{%                          if platform_defaults.type == 3850 %} 
 trust device cisco-phone 
{%                          endif %} 
{%                      endif %} 
{%                      if host_interfaces[host_interface].voice_vlan is defined %} 
{%                      else %} 
 power inline never 
{%                      endif %} 
 authentication event server dead action authorize vlan {{ 
host_interfaces[host_interface].vlan }} 
 authentication event server dead action authorize voice 
 authentication host-mode multi-domain 
 authentication open 
 authentication order dot1x mab 
 authentication priority dot1x mab 
 authentication port-control auto 
 authentication periodic 
 mab 
 dot1x pae authenticator 
 dot1x timeout quiet-period 2 
 dot1x timeout tx-period 10 
{%                      if host_interfaces[host_interface].voice_vlan is defined or 
host_interfaces[host_interface].cdp_enable is defined %} 
{%                      else %} 
 no cdp enable 
{%                      endif %}