Cisco SNMP v3 settings for PacketFence using clogin via Rancid

First off, could I really fit any more key words into the post title?

Secondly, I'm fairly new to scripting and linux in general. So forgive me if I get some terms or other stuff way wrong. I've recently been tasked with setting up a NAC (Network Access Control) for our network. We're starting small, only conference rooms at first. We have around 40 or so conference rooms, I think.... The goal is to use PacketFence by Inverse to allow guests and vendors access to our guest network, and employees access to our internal network.

PF will allow you to push switch vlan changes via snmp, but one of the big hurdles for me was the SNMP v3 setup since I've never set it up before. After figuring it out on a single switch I realized that I didn't want to manually make changes to all of our Cisco switches. Which lead me to clogin that comes with Rancid (Really Awesome New Cisco confIg Differ). clogin will allow you to make multiple changes using a command file to the switch(es) of your choosing.

Third, I hope you enjoy my liberal use of smudgery.

Step 1: Install Rancid: http://www.shrubbery.net/rancid/RhysEvans_overview_0.3.pdf
Step 2: Setup switch in PF:

Step 3: Setup the .cloginrc file
This file (under root) holds all of the usernames/passwords that clogin will use when attempting to auth to a device. We use ssh on everything and setup a TACACS account specifically for packetfence testing. This is what I've added to the bottom of ./cloginrc


add user * {PFTestAccount}
add userpassword * {TermPassword} {EnablePassword}
add password * {TermPassword} {EnablePassword}
add method * ssh telnet

Step 4: Send global switch commands via clogin. In the default setup clogin is located under /usr/local/rancid/bin and must be ran as the user rancid if you've followed the instructions above.

Global commands, saved in SNMPv3.txt:


snmp-server engineID local 123450000000000000000000
snmp-server group PFREADGROUP v3 priv notify *tv.00000000.00000000.00000000.0
snmp-server group PFWRITEGROUP v3 priv read PFREADVIEW write PFWRITEVIEW
snmp-server community PFREADWRITESTRING RW
snmp-server enable traps port-security
snmp-server enable traps port-security trap-rate 2
snmp-server host 172.16.x.x OtherCorpReadOnlyString
snmp-server host 172.16.x.y version 3 priv PFREADUSER port-security

Clogin command: 

 ./clogin -x /usr/local/rancid/scripts/SNMPv3.txt 172.16.x.y

Result:

Step 5: Interface config:
Now there are a couple ways we could go with this. We could include this config in with clogin as long as we could pick the same port on ever switch. I have yet to find a way to prompt for each switch with my limited knowledge. Or the way I'll be doing it, going through and finding out which port on which switch I need setup, and creating a different command file for clogin to pull from. It's probably not the best way, but still better than logging manually into each switch and running every command.


## mac-address should follow this format: fa0/1...fa0/48 = 10001...10048
## or gi0/1.....gi0/48 = 10101....10148
## vlan 311 is the PF Registration vlan



int fa1/0/46
 switchport access vlan 311
 switchport mode access
 switchport port-security maximum 2 vlan access
 switchport port-security
 switchport port-security violation restrict
 switchport port-security mac-address 0200.0001.0046 vlan access