The Cisco Identity-Based Networking Services (IBNS) solution provides a policy and identity-based framework in which edge devices can deliver flexible and scalable services to subscribers. IBNS allows the concurrent operation of IEEE 802.1x (dot1x), MAC authentication bypass (MAB), and web authentication methods, making it possible to invoke multiple authentication methods in parallel, on a single subscriber session. These authentication methods, dot1x, authentication, authorization, and accounting (AAA), and RADIUS are available in global configuration and interface configuration modes.

The Auto Identity feature uses the Cisco Common Classification Policy Language-based configuration that significantly reduces the number of commands used to configure both authentication methods and interface-level commands. The Auto Identity feature provides a set of built-in policies that are based on policy maps, class maps, parameter maps, and interface templates.

In global configuration mode, the source template AI_GLOBAL_CONFIG_TEMPLATE command enables the Auto Identity feature. In interface configuration mode, configure the AI_MONITOR_MODE, AI_LOW_IMPACT_MODE, or AI_CLOSED_MODE interface templates to enable the feature on interfaces.

You can configure multiple templates; however, you must bind multiple templates together using the merge command. If you do not bind the templates, the last configured template is used. While binding templates, if the same command is repeated in two templates with different arguments, the last configured command is used.

Note	You can also enable user-defined templates that are configured using the template name command in global configuration mode .

Use the show template interface or show template global commands to display information about built-in templates. Built-in templates can be edited. Built-in template information is displayed in the output of the show running-config command, if the template is edited. If you delete an edited built-in template, the built-in template reverts to the default and is not deleted from the configuration. However; if you delete a user-defined template, it is deleted from the configuration.

Note	Before you delete a template, ensure that it is not attached to a device.

The following interface templates are available in the Auto Identity feature:

• AI_MONITOR_MODE—Passively monitors sessions that have authentication in open mode.

• AI_LOW_IMPACT_MODE—Similar to monitor mode, but with a configured static policy such as a port access control list (PACL).

• AI_CLOSED_MODE—Secure mode in which data traffic is not allowed into the network, until authentication is complete. This mode is the default.

Note	Multi-auth host mode is not supported with the LAN Lite license.

switchport mode access
 access-session port-control auto
 access-session host-mode multi-auth
 dot1x pae authenticator
 mab
 service-policy type control subscriber AI_DOT1X_MAB_POLICIES

switchport mode access
 access-session port-control auto
 access-session host-mode multi-auth
 dot1x pae authenticator
 mab
 ip access-group AI_PORT_ACL in
 service-policy type control subscriber AI_DOT1X_MAB_POLICIES

switchport mode access
 access-session closed
 access-session port-control auto
 access-session host-mode multi-auth
 dot1x pae authenticator
 mab
 service-policy type control subscriber AI_DOT1X_MAB_POLICIES

The following five built-in policies are available in the Auto Identity feature:

• AI_DOT1X_MAB_AUTH—Enables flexible authentication with dot1x, and then MAC Address Bypass (MAB).
• AI_DOT1X_MAB_POLICIES—Enables flexible authentication with dot1x, and then MAB. Applies critical VLAN in case the Authentication, Authorization, and Accounting (AAA) server is not reachable.
• AI_DOT1X_MAB_WEBAUTH—Enables flexible authentication with dot1x, MAB, and then web authentication.
• AI_NEXTGEN_AUTHBYBASS—Skips authentication if an IP phone device is detected. Enables the device classifier command in global configuration mode and the voice-vlan command in interface configuration mode to detect the device. This is a reference policy map, and users can copy the contents of this policy map to other policy maps.
• AI_STANDALONE_WEBAUTH—Defines standalone web authentication.

The following built-in parameter map templates are supported by the Auto Identity feature:

• AI_NRH_PMAP—Starts nonresponsive host (NRH) authentication.

  AI_WEBAUTH_PMAP—Starts web authentication.

Service templates are available inside builit-in policy maps. The following built-in service templates are supported by the Auto Identity feature:

• AI_INACTIVE_TIMER—Template to start the inactivity timer.
• AI_CRITICAL_ACL—Dummy template; users can configure this template as per their requirements.