Is there a way to automatically have unused ports disable?

Question

Like many others I can see how to display ports that have no traffic flowing through them and go through and disable them but we have hundreds of cisco switches.

I like the idea of being able to see ports that have not seen activity in the last 6 weeks like I found here:

show int | i proto.*notconnect|proto.administratively down|Last in. [6-9]w|Last in.* [0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never

but I have not been able to make this work.

sh int count | i 0 + 0 + 0 works quiet well for identifying the ports.

Found here:

How can I see which switchports are not in use?

Is there a way to maybe use like port security or anything to turn ports off that have not see traffic for 90 days?

Answer 1

15.1T introduced show interface history. This might work for you.

The ports go into down state for both status and protocol by default when no endpoint NIC is connected (link down). You could syslog these events to a server and roll some script to correlate down vs up dates per port.

Cisco EEM could be utilized to automatically disable a port once it goes down, but I don't think this would be a good idea as it would be difficult to administer/manage. Look at 802.1X Port-Based Authentication if security is the concern.