Template

Interface templates are reusable configuration containers that define a standardized set of interface-level settings including switchport configuration, security policies, authentication parameters, QoS policies, and network access control attributes that can be consistently applied across multiple physical interfaces. They streamline network deployment and maintenance by enabling centralized definition of interface behaviors such as 802.1X authentication, MAB (MAC Authentication Bypass), port security, spanning tree settings, storm control, and device tracking policies. Interface templates are essential for maintaining configuration consistency, reducing deployment errors, and simplifying network operations in large-scale environments where standardized interface policies need to be applied across hundreds or thousands of switch ports.

Diagram

Classes

configuration (iosxe.devices)

Name	Type	Constraint	Mandatory	Default Value
templates	List	`[templates]`	No

templates (iosxe.devices.configuration)

Name	Type	Constraint	Mandatory
name	String		Yes
service_policy_type_control_subscriber	String		No
service_policy_input	String		No
service_policy_output	String		No
source_template	String		No
switchport	Class	`[switchport]`	No
spanning_tree	Class	`[spanning_tree]`	No
storm_control	Class	`[storm_control]`	No
load_interval	Integer	min: `30`, max: `600`	No
ipv4	Class	`[ipv4]`	No
subscriber_aging_inactivity_timer_value	Integer	min: `1`, max: `65535`	No
subscriber_aging_inactivity_timer_probe	Boolean	`true`, `false`	No
subscriber_aging_probe	Boolean	`true`, `false`	No
device_tracking	Boolean	`true`, `false`	No
device_tracking_attached_policies	List	`[device_tracking_attached_policies]`	No
device_tracking_vlan_range	String		No
network_access_control	Class	`[network_access_control]`	No

switchport (iosxe.devices.configuration.templates)

Name	Type	Constraint	Mandatory
mode	Choice	`access`, `trunk`	No
nonegotiate	Boolean	`true`, `false`	No
block_unicast	Boolean	`true`, `false`	No
port_security	Boolean	`true`, `false`	No
port_security_aging_static	Boolean	`true`, `false`	No
port_security_aging_time	Integer	min: `1`, max: `1440`	No
port_security_aging_type	Boolean	`true`, `false`	No
port_security_aging_type_inactivity	Boolean	`true`, `false`	No
port_security_maximum_ranges	List	`[port_security_maximum_ranges]`	No
port_security_violation_protect	Boolean	`true`, `false`	No
port_security_violation_restrict	Boolean	`true`, `false`	No
port_security_violation_shutdown	Boolean	`true`, `false`	No
access_vlan	Integer	min: `1`, max: `4094`	No
voice_vlan	Integer	min: `1`, max: `4094`	No
private_vlan_host_association_primary_range	Any	Integer[min: `2`, max: `1001`] or Integer[min: `1006`, max: `4094`] or String[Regex: `^.[\$\%]\{.$`]	No
private_vlan_host_association_secondary_range	Any	Integer[min: `2`, max: `1001`] or Integer[min: `1006`, max: `4094`] or String[Regex: `^.[\$\%]\{.$`]	No
trunk_allowed_vlans	Class	`[trunk_allowed_vlans]`	No
trunk_native_vlan_tag	Boolean	`true`, `false`	No
trunk_native_vlan_id	Integer	min: `1`, max: `4094`	No

spanning_tree (iosxe.devices.configuration.templates)

Name	Type	Constraint	Mandatory
bpduguard	Boolean	`true`, `false`	No
service_policy	Boolean	`true`, `false`	No
portfast	Boolean	`true`, `false`	No
portfast_disable	Boolean	`true`, `false`	No
portfast_edge	Boolean	`true`, `false`	No
portfast_network	Boolean	`true`, `false`	No

storm_control (iosxe.devices.configuration.templates)

Name	Type	Constraint	Mandatory
broadcast_level_pps_threshold	String		No
broadcast_level_bps_threshold	Number	min: `0`, max: `100000000000.0`	No
broadcast_level_threshold	Number	min: `0`, max: `10000`	No
multicast_level_pps_threshold	String		No
multicast_level_bps_threshold	Number	min: `0`, max: `100000000000.0`	No
multicast_level_threshold	Number	min: `0`, max: `10000`	No
action_shutdown	Boolean	`true`, `false`	No
action_trap	Boolean	`true`, `false`	No

ipv4 (iosxe.devices.configuration.templates)

Name	Type	Constraint	Mandatory
dhcp_snooping_limit_rate	Integer	min: `1`, max: `2048`	No
dhcp_snooping_trust	Boolean	`true`, `false`	No
access_group_in	String		No
access_group_out	String		No

device_tracking_attached_policies (iosxe.devices.configuration.templates)

Name	Type	Constraint	Mandatory	Default Value
name	String		No
vlan_range	String		Yes

network_access_control (iosxe.devices.configuration.templates)

Name	Type	Constraint	Mandatory
dot1x_pae	Choice	`authenticator`, `both`, `supplicant`	No
dot1x_max_reauth_req	Integer	min: `1`, max: `10`	No
dot1x_max_req	Integer	min: `1`, max: `10`	No
dot1x_timeout_tx_period	Integer	min: `1`, max: `65535`	No
mab	Boolean	`true`, `false`	No
mab_eap	Boolean	`true`, `false`	No
access_session_closed	Boolean	`true`, `false`	No
access_session_monitor	Boolean	`true`, `false`	No
access_session_port_control	Choice	`auto`, `force-authorized`, `force-unauthorized`	No
access_session_control_direction	Choice	`both`, `in`	No
access_session_host_mode	Choice	`multi-auth`, `multi-domain`, `multi-host`, `single-host`	No
access_session_interface_template_sticky	Boolean	`true`, `false`	No
access_session_interface_template_sticky_timer	Integer	min: `1`, max: `65535`	No
authentication_periodic	Boolean	`true`, `false`	No
authentication_timer_reauthenticate_server	Boolean	`true`, `false`	No
authentication_timer_reauthenticate_range	Integer	min: `1`, max: `65535`	No
cts_manual	Boolean	`true`, `false`	No
cts_manual_policy_static_sgt	Integer	min: `2`, max: `65519`	No
cts_manual_policy_static_trusted	Boolean	`true`, `false`	No
cts_manual_propagate_sgt	Boolean	`true`, `false`	No
cts_role_based_enforcement	Boolean	`true`, `false`	No

port_security_maximum_ranges (iosxe.devices.configuration.templates.switchport)

Name	Type	Constraint	Mandatory
range	Integer	min: `1`, max: `3072`	Yes
vlan	Boolean	`true`, `false`	No
vlan_access	Boolean	`true`, `false`	No

trunk_allowed_vlans (iosxe.devices.configuration.templates.switchport)

Name	Type	Constraint	Mandatory	Default Value
ids	List	Integer[min: `1`, max: `4094`]	No
ranges	List	`[ranges]`	No

ranges (iosxe.devices.configuration.templates.switchport.trunk_allowed_vlans)

Name	Type	Constraint	Mandatory	Default Value
from	Integer	min: `1`, max: `4094`	Yes
to	Integer	min: `1`, max: `4094`	Yes

By centralizing interface configuration, templates ensure consistency, reduce errors, and simplify network operations for large-scale deployments.

Template Parameters

Key Components:

Template Name (name): The identifier for the interface template.
Service Policies (service_policy_input, service_policy_output): Apply input/output QoS policies to interfaces.
Load Interval (load_interval): Sets the statistics collection interval.
Subscriber Aging Timer (subscriber_aging_inactivity_timer_value): Configures inactivity timer for subscriber sessions.
Device Tracking (device_tracking): Enables device tracking on the interface.
Switchport Settings (switchport): Defines switchport mode, native VLAN, allowed VLANs, negotiation, port security, voice VLAN, and related attributes.
Network Access Control (network_access_control): Configures 802.1X, MAB, access session, authentication, CTS, and related security policies.
Spanning Tree (spanning_tree): Sets BPDU guard, portfast, and related spanning tree settings.
Storm Control (storm_control): Configures broadcast/multicast thresholds and actions.
IPv4 Settings (ipv4): Sets DHCP snooping, access groups, and trust settings.

Key Parameters Briefly Explained:

name: Template identifier.
service_policy_input, service_policy_output: QoS policy application.
load_interval: Statistics interval.
subscriber_aging_inactivity_timer_value: Subscriber inactivity timer.
device_tracking: Enables device tracking.
switchport: Switchport configuration (mode, VLANs, port security, voice VLAN).
network_access_control: Security and authentication settings.
spanning_tree: Spanning tree features.
storm_control: Storm control thresholds and actions.
ipv4: IPv4-specific settings.

You can use these template parameters to define standardized interface configurations for your network devices. Customize switchport, security, authentication, spanning tree, storm control, and IPv4 settings to fit your operational requirements and ensure consistent policy enforcement across interfaces.

Sample Configuration

The following configuration describes how to set up an interface template on a Cisco IOS-XE device, including switchport settings, security policies, authentication, spanning tree, storm control, and IPv4 features.

interface template TEMPLATE1
 service-policy input input
 service-policy output output
 load-interval 90
 subscriber aging inactivity timer value 600
 device-tracking
 switchport mode trunk
 switchport trunk native vlan 100
 switchport trunk allowed vlan 10-20,30
 switchport nonegotiate
 switchport block unicast
 switchport port-security
 switchport port-security aging static
 switchport port-security aging time 600
 switchport port-security aging type inactivity
 switchport port-security maximum 10 vlan access
 switchport port-security maximum 20 vlan
 switchport port-security maximum 30
 switchport port-security violation protect
 switchport voice vlan 11
 dot1x pae supplicant
 dot1x max-reauth-req 3
 dot1x max-req 5
 dot1x timeout tx-period 600
 mab
 mab eap
 access-session closed
 access-session monitor false
 access-session port-control force-authorized
 access-session control-direction in
 access-session host-mode multi-domain
 access-session interface-template sticky
 access-session interface-template sticky timer 600
 authentication periodic
 authentication timer reauthenticate 600
 cts manual
 cts manual policy static sgt 100
 cts manual policy static trusted
 cts manual propagate sgt
 cts role-based enforcement
 spanning-tree bpduguard enable
 spanning-tree portfast
 spanning-tree portfast disable
 storm-control broadcast level 80
 storm-control multicast level 70
 storm-control action shutdown
 storm-control action trap
 ip dhcp snooping limit rate 1024
 ip dhcp snooping trust
 ip access-group ACL_IN in
 ip access-group ACL_OUT out

Example YAML Code

The following YAML code sets up an interface template on an IOS-XE device, specifying switchport, security, authentication, spanning tree, storm control, and IPv4 settings.

iosxe:
  devices:
    - name: Device1
      configuration:
        templates:
          - name: TEMPLATE1
            service_policy_input: input
            service_policy_output: output
            load_interval: 90
            subscriber_aging_inactivity_timer_value: 600
            device_tracking: true
            switchport:
              mode: trunk
              trunk_native_vlan_id: 100
              trunk_allowed_vlans:
                ids: [30, 40]
                ranges:
                  - from: 10
                    to: 20
              nonegotiate: true
              block_unicast: true
              port_security: true
              port_security_aging_static: true
              port_security_aging_time: 600
              port_security_aging_type_inactivity: true
              port_security_maximum_ranges:
                - range: 10
                  vlan: true
                  vlan_access: true
                - range: 20
                  vlan: true
                - range: 30
              port_security_violation_protect: true
              voice_vlan: 11
            network_access_control:
              dot1x_pae: supplicant
              dot1x_max_reauth_req: 3
              dot1x_max_req: 5
              dot1x_timeout_tx_period: 600
              mab: true
              mab_eap: true
              access_session_closed: true
              access_session_monitor: false
              access_session_port_control: force-authorized
              access_session_control_direction: in
              access_session_host_mode: multi-domain
              access_session_interface_template_sticky: true
              access_session_interface_template_sticky_timer: 600
              authentication_periodic: true
              authentication_timer_reauthenticate_range: 600
              cts_manual: true
              cts_manual_policy_static_sgt: 100
              cts_manual_policy_static_trusted: true
              cts_manual_propagate_sgt: true
              cts_role_based_enforcement: true
            spanning_tree:
              bpduguard: true
              portfast: true
              portfast_disable: false
            storm_control:
              broadcast_level_threshold: 80
              multicast_level_threshold: 70
              action_shutdown: true
              action_trap: true
            ipv4:
              dhcp_snooping_limit_rate: 1024
              dhcp_snooping_trust: true
              access_group_in: ACL_IN
              access_group_out: ACL_OUT