Device Tracking

Device Tracking (also known as SISF, Switch Integrated Security Features) is a Layer 2 security mechanism that builds a binding table of connected hosts by monitoring ARP, DHCP, NDP, and DHCPv6 traffic. It is the foundational feature behind IP Source Guard, Dynamic ARP Inspection, and 802.1X address assignment validation. Device Tracking policies define per-port or per-VLAN behavior including which protocols to glean, trusted port designation, tracking state management, security levels, and address limits.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
device_tracking	Class	`[device_tracking]`	No

device_tracking (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
logging_theft	Boolean	`true`, `false`	No
tracking_auto_source_fallback_ipv4	IP		No
tracking_auto_source_fallback_mask	IP		No
tracking_auto_source_fallback_override	Boolean	`true`, `false`	No
tracking_retry_interval	Integer	min: `1`, max: `3600`	No
binding_reachable_lifetime	Integer	min: `1`, max: `86400`	No
policies	List	`[policies]`	No

policies (iosxe.devices.configuration.device_tracking)

Name	Type	Constraint	Mandatory
name	String		Yes
trusted_port	Boolean	`true`, `false`	No
device_role	Choice	`node`, `switch`, `router`	No
device_role_node_legacy	Boolean	`true`, `false`	No
device_role_switch_legacy	Boolean	`true`, `false`	No
device_role_router_legacy	Boolean	`true`, `false`	No
data_glean_log_only	Boolean	`true`, `false`	No
data_glean_recovery_dhcp	Boolean	`true`, `false`	No
data_glean_recovery_ndp	Boolean	`true`, `false`	No
prefix_glean	Boolean	`true`, `false`	No
prefix_glean_only	Boolean	`true`, `false`	No
destination_glean_log_only	Boolean	`true`, `false`	No
destination_glean_recovery_dhcp	Boolean	`true`, `false`	No
protocol_arp	Boolean	`true`, `false`	No
protocol_arp_prefix_list	String		No
protocol_dhcp4	Boolean	`true`, `false`	No
protocol_dhcp4_prefix_list	String		No
protocol_dhcp6	Boolean	`true`, `false`	No
protocol_dhcp6_prefix_list	String		No
protocol_ndp	Boolean	`true`, `false`	No
protocol_ndp_prefix_list	String		No
tracking_enable	Boolean	`true`, `false`	No
tracking_enable_reachable_lifetime_seconds	Integer	min: `1`, max: `86400`	No
tracking_enable_reachable_lifetime_infinite	Boolean	`true`, `false`	No
tracking_disable	Boolean	`true`, `false`	No
tracking_disable_stale_lifetime	String		No
limit_address_count	Integer	min: `1`, max: `32000`	No
security_level_glean	Boolean	`true`, `false`	No
security_level_guard	Boolean	`true`, `false`	No
security_level_inspect	Boolean	`true`, `false`	No
medium_type_wireless	Boolean	`true`, `false`	No

Sample Configuration

Global Device Tracking Settings

The following configuration enables theft logging, sets the tracking retry interval, configures auto-source fallback for device-tracking probes, and sets the binding reachable lifetime.

device-tracking logging theft
device-tracking tracking retry-interval 30
device-tracking tracking auto-source fallback 10.0.0.1 255.255.255.0 override
device-tracking binding reachable-lifetime 7200

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          logging_theft: true
          tracking_retry_interval: 30
          tracking_auto_source_fallback_ipv4: 10.0.0.1
          tracking_auto_source_fallback_mask: 255.255.255.0
          tracking_auto_source_fallback_override: true
          binding_reachable_lifetime: 7200

Trunk Port Policy

A policy for trunk ports that disables all protocol gleaning, enables tracking with a reachable lifetime, marks the port as trusted, sets the security level to glean, and enables data-glean and destination-glean recovery.

device-tracking policy DT_TRUNK_POLICY
 trusted-port
 device-role switch
 limit address-count 100
 security-level glean
 data-glean recovery ndp dhcp
 destination-glean recovery dhcp
 prefix-glean
 no protocol arp
 no protocol dhcp4
 no protocol dhcp6
 no protocol ndp
 tracking enable reachable-lifetime 300

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_TRUNK_POLICY
              trusted_port: true
              device_role: switch
              limit_address_count: 100
              security_level_glean: true
              data_glean_recovery_dhcp: true
              data_glean_recovery_ndp: true
              destination_glean_recovery_dhcp: true
              prefix_glean: true
              protocol_arp: false
              protocol_dhcp4: false
              protocol_dhcp6: false
              protocol_ndp: false
              tracking_enable: true
              tracking_enable_reachable_lifetime_seconds: 300

Access Port Policy

A minimal policy for access ports with default protocol gleaning, tracking enabled, and a lower address limit.

device-tracking policy DT_ACCESS_POLICY
 limit address-count 10
 tracking enable

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_ACCESS_POLICY
              tracking_enable: true
              limit_address_count: 10

Policy with Tracking Disabled

A policy that disables tracking and sets a stale lifetime for entries.

device-tracking policy DT_NO_TRACK
 tracking disable stale-lifetime 3600

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_NO_TRACK
              tracking_disable: true
              tracking_disable_stale_lifetime: "3600"

Comprehensive Policy with All Options

A policy demonstrating all available attributes including legacy device-role syntax, protocol prefix-lists, security levels, data-glean logging, and wireless medium type.

device-tracking policy DT_FULL_POLICY
 trusted-port
 device-role node
 limit address-count 50
 security-level guard
 data-glean log-only
 data-glean recovery ndp dhcp
 destination-glean log-only
 destination-glean recovery dhcp
 prefix-glean only
 protocol arp prefix-list ARP_PFXLIST
 protocol dhcp4 prefix-list DHCP4_PFXLIST
 protocol dhcp6 prefix-list DHCP6_PFXLIST
 protocol ndp prefix-list NDP_PFXLIST
 tracking enable reachable-lifetime infinite
 medium-type wireless

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_FULL_POLICY
              trusted_port: true
              device_role: node
              device_role_node_legacy: true
              device_role_switch_legacy: false
              device_role_router_legacy: false
              data_glean_log_only: true
              data_glean_recovery_dhcp: true
              data_glean_recovery_ndp: true
              prefix_glean: true
              prefix_glean_only: true
              destination_glean_log_only: true
              destination_glean_recovery_dhcp: true
              protocol_arp: true
              protocol_arp_prefix_list: ARP_PFXLIST
              protocol_dhcp4: true
              protocol_dhcp4_prefix_list: DHCP4_PFXLIST
              protocol_dhcp6: true
              protocol_dhcp6_prefix_list: DHCP6_PFXLIST
              protocol_ndp: true
              protocol_ndp_prefix_list: NDP_PFXLIST
              tracking_enable: true
              tracking_enable_reachable_lifetime_infinite: true
              limit_address_count: 50
              security_level_glean: false
              security_level_guard: true
              security_level_inspect: false
              medium_type_wireless: true