Device Tracking

Device Tracking (also known as SISF, Switch Integrated Security Features) is a Layer 2 security mechanism that builds a binding table of connected hosts by monitoring ARP, DHCP, NDP, and DHCPv6 traffic. It is the foundational feature behind IP Source Guard, Dynamic ARP Inspection, and 802.1X address assignment validation. Device Tracking policies define per-port or per-VLAN behavior including which protocols to glean, trusted port designation, tracking state management, security levels, and address limits.

Diagram

Classes

iosxe

Name	Type	Constraint	Mandatory	Default Value
devices	List	devices	No
device_groups	List	device_groups	No
global	Class	global	No

devices (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

device_groups (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

global (iosxe)

Name	Type	Constraint	Mandatory	Default Value
configuration	Class	configuration	No

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
device_tracking	Class	device_tracking	No

device_tracking (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory	Default Value
logging_theft	Boolean	true, false	No
tracking_auto_source_fallback_ipv4	IP		No
tracking_auto_source_fallback_mask	IP		No
tracking_auto_source_fallback_override	Boolean	true, false	No
tracking_retry_interval	Integer	min: 1, max: 3600	No
binding_reachable_lifetime	Integer	min: 1, max: 86400	No
policies	List	policies	No

policies (iosxe.devices.configuration.device_tracking)

Name	Type	Constraint	Mandatory	Default Value
name	String		Yes
trusted_port	Boolean	true, false	No
device_role	Choice	node, switch, router	No
device_role_node_legacy	Boolean	true, false	No
device_role_switch_legacy	Boolean	true, false	No
device_role_router_legacy	Boolean	true, false	No
data_glean_log_only	Boolean	true, false	No
data_glean_recovery_dhcp	Boolean	true, false	No
data_glean_recovery_ndp	Boolean	true, false	No
prefix_glean	Boolean	true, false	No
prefix_glean_only	Boolean	true, false	No
destination_glean_log_only	Boolean	true, false	No
destination_glean_recovery_dhcp	Boolean	true, false	No
protocol_arp	Boolean	true, false	No
protocol_arp_prefix_list	String		No
protocol_dhcp4	Boolean	true, false	No
protocol_dhcp4_prefix_list	String		No
protocol_dhcp6	Boolean	true, false	No
protocol_dhcp6_prefix_list	String		No
protocol_ndp	Boolean	true, false	No
protocol_ndp_prefix_list	String		No
tracking_enable	Boolean	true, false	No
tracking_enable_reachable_lifetime_seconds	Integer	min: 1, max: 86400	No
tracking_enable_reachable_lifetime_infinite	Boolean	true, false	No
tracking_disable	Boolean	true, false	No
tracking_disable_stale_lifetime	String		No
limit_address_count	Integer	min: 1, max: 32000	No
security_level_glean	Boolean	true, false	No
security_level_guard	Boolean	true, false	No
security_level_inspect	Boolean	true, false	No
medium_type_wireless	Boolean	true, false	No

Sample Configuration

Global Device Tracking Settings

The following configuration enables theft logging, sets the tracking retry interval, configures auto-source fallback for device-tracking probes, and sets the binding reachable lifetime.

device-tracking logging theft
device-tracking tracking retry-interval 30
device-tracking tracking auto-source fallback 10.0.0.1 255.255.255.0 override
device-tracking binding reachable-lifetime 7200

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          logging_theft: true
          tracking_retry_interval: 30
          tracking_auto_source_fallback_ipv4: 10.0.0.1
          tracking_auto_source_fallback_mask: 255.255.255.0
          tracking_auto_source_fallback_override: true
          binding_reachable_lifetime: 7200

Trunk Port Policy

A policy for trunk ports that disables all protocol gleaning, enables tracking with a reachable lifetime, marks the port as trusted, sets the security level to glean, and enables data-glean and destination-glean recovery.

device-tracking policy DT_TRUNK_POLICY
 trusted-port
 device-role switch
 limit address-count 100
 security-level glean
 data-glean recovery ndp dhcp
 destination-glean recovery dhcp
 prefix-glean
 no protocol arp
 no protocol dhcp4
 no protocol dhcp6
 no protocol ndp
 tracking enable reachable-lifetime 300

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_TRUNK_POLICY
              trusted_port: true
              device_role: switch
              limit_address_count: 100
              security_level_glean: true
              data_glean_recovery_dhcp: true
              data_glean_recovery_ndp: true
              destination_glean_recovery_dhcp: true
              prefix_glean: true
              protocol_arp: false
              protocol_dhcp4: false
              protocol_dhcp6: false
              protocol_ndp: false
              tracking_enable: true
              tracking_enable_reachable_lifetime_seconds: 300

Access Port Policy

A minimal policy for access ports with default protocol gleaning, tracking enabled, and a lower address limit.

device-tracking policy DT_ACCESS_POLICY
 limit address-count 10
 tracking enable

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_ACCESS_POLICY
              tracking_enable: true
              limit_address_count: 10

Policy with Tracking Disabled

A policy that disables tracking and sets a stale lifetime for entries.

device-tracking policy DT_NO_TRACK
 tracking disable stale-lifetime 3600

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_NO_TRACK
              tracking_disable: true
              tracking_disable_stale_lifetime: "3600"

Comprehensive Policy with All Options

A policy demonstrating all available attributes including legacy device-role syntax, protocol prefix-lists, security levels, data-glean logging, and wireless medium type.

device-tracking policy DT_FULL_POLICY
 trusted-port
 device-role node
 limit address-count 50
 security-level guard
 data-glean log-only
 data-glean recovery ndp dhcp
 destination-glean log-only
 destination-glean recovery dhcp
 prefix-glean only
 protocol arp prefix-list ARP_PFXLIST
 protocol dhcp4 prefix-list DHCP4_PFXLIST
 protocol dhcp6 prefix-list DHCP6_PFXLIST
 protocol ndp prefix-list NDP_PFXLIST
 tracking enable reachable-lifetime infinite
 medium-type wireless

iosxe:
  devices:
    - name: Switch1
      configuration:
        device_tracking:
          policies:
            - name: DT_FULL_POLICY
              trusted_port: true
              device_role: node
              device_role_node_legacy: true
              device_role_switch_legacy: false
              device_role_router_legacy: false
              data_glean_log_only: true
              data_glean_recovery_dhcp: true
              data_glean_recovery_ndp: true
              prefix_glean: true
              prefix_glean_only: true
              destination_glean_log_only: true
              destination_glean_recovery_dhcp: true
              protocol_arp: true
              protocol_arp_prefix_list: ARP_PFXLIST
              protocol_dhcp4: true
              protocol_dhcp4_prefix_list: DHCP4_PFXLIST
              protocol_dhcp6: true
              protocol_dhcp6_prefix_list: DHCP6_PFXLIST
              protocol_ndp: true
              protocol_ndp_prefix_list: NDP_PFXLIST
              tracking_enable: true
              tracking_enable_reachable_lifetime_infinite: true
              limit_address_count: 50
              security_level_glean: false
              security_level_guard: true
              security_level_inspect: false
              medium_type_wireless: true