Cisco Nexus 9000 Series Configuration Guide

Cisco Nexus 9000 Series

562 pages

To Next Page

To Next Page

Page #1 background image

Loading...

Page #1 background image

Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release

9.x

First Published: 2018-07-17

Last Modified: 2018-11-05

Americas Headquarters

Cisco Systems, Inc.

170 West Tasman Drive

San Jose, CA 95134-1706

USA

http://www.cisco.com

Tel: 408 526-4000

800 553-NETS (6387)

Fax: 408 527-0883

Table of Contents

Default Chapter4
- Table of Contents4
- Chapter27
- Chapter29
Chapter 130
Chapter 230
- RADIUS and TACACS+ Security Protocols30
- Ldap31
- MAC Acls32
  - Traffic Storm Control33
- IP Source Guard33
CHAPTER 3 Configuring AAA35
- About AAA35
- Licensing Requirements for AAA39
- Prerequisites for AAA40
- Guidelines and Limitations for AAA40
- Default Settings for AAA40
- Configuring AAA41
- Monitoring and Clearing the Local AAA Accounting Log60
- Verifying the AAA Configuration60
- Configuration Examples for AAA61
- Configuration Examples for Login Parameters61
- Configuration Examples for the Password Prompt Feature62
- Additional References for AAA63
CHAPTER 4 Configuring RADIUS65
- About RADIUS65
- Licensing Requirements for RADIUS68
- Prerequisites for RADIUS68
- Guidelines and Limitations for RADIUS68
- Default Settings for RADIUS69
- Configuring RADIUS Servers69
- Verifying the RADIUS Configuration88
- Monitoring RADIUS Servers89
- Clearing RADIUS Server Statistics89
- Configuration Example for RADIUS90
- Where to Go Next90
- Additional References for RADIUS90
CHAPTER 5 Configuring TACACS93
- About TACACS93
- Licensing Requirements for TACACS97
- Prerequisites for TACACS97
- Guidelines and Limitations for TACACS97
- Default Settings for TACACS98
- Configuring TACACS98
- Monitoring TACACS+ Servers125
- Clearing TACACS+ Server Statistics125
- Verifying the TACACS+ Configuration126
- Configuration Examples for TACACS126
- Where to Go Next128
- Additional References for TACACS128
CHAPTER 6 Configuring LDAP131
- About LDAP131
- Licensing Requirements for LDAP134
- Prerequisites for LDAP134
- Guidelines and Limitations for LDAP134
- Default Settings for LDAP135
- Configuring LDAP135
- Monitoring LDAP Servers148
- Clearing LDAP Server Statistics149
- Verifying the LDAP Configuration149
- Configuration Examples for LDAP150
- Where to Go Next150
- Additional References for LDAP151
CHAPTER 7 Configuring SSH and Telnet153
- About SSH and Telnet153
- Licensing Requirements for SSH and Telnet155
- Prerequisites for SSH and Telnet155
- Guidelines and Limitations for SSH and Telnet155
- Default Settings for SSH and Telnet156
- Configuring SSH156
- Configuring Telnet173
- Verifying the SSH and Telnet Configuration175
- Configuration Example for SSH176
- Configuration Example for SSH Passwordless File Copy177
- Configuration Example for X.509V3 Certificate-Based SSH Authentication179
- Additional References for SSH and Telnet179
CHAPTER 8 Configuring User Accounts and RBAC181
- About User Accounts and RBAC181
- Licensing Requirements for User Accounts and RBAC184
- Guidelines and Limitations for User Accounts and RBAC184
- Default Settings for User Accounts and RBAC185
- Enabling Password-Strength Checking185
- Configuring User Accounts186
- Configuring Roles188
- About no Service Password-Recovery197
- Enabling no Service Password-Recovery197
- Verifying User Accounts and RBAC Configuration198
- Configuration Examples for User Accounts and RBAC199
- Additional References for User Accounts and RBAC200
CHAPTER 9 Configuring 802.1X203
- About 802.1X203
- Licensing Requirements for 802.1X209
- Prerequisites for 802.1X209
- 802.1X Guidelines and Limitations209
- Default Settings for 802.1X211
- Configuring 802.1X212
- Verifying the 802.1X Configuration231
- 802.1X Support for VXLAN EVPN231
- Monitoring 802.1X236
- Configuration Example for 802.1X236
- Additional References for 802.1X237
C H a P T E239
Configuring IP Acls239
- About Acls239
- Policy-Based Acls247
- Statistics and Acls248
- Atomic ACL Updates248
- Session Manager Support for IP Acls249
- ACL TCAM Regions249
- Licensing Requirements for IP Acls254
- Prerequisites for IP Acls255
- Guidelines and Limitations for IP Acls255
- Default Settings for IP Acls259
- Configuring IP Acls259
- Verifying the IP ACL Configuration293
- Monitoring and Clearing IP ACL Statistics295
- Configuration Examples for IP Acls295
- About System Acls296
- Configuring Object Groups300
CHAPTER 11 Configuring MAC Acls313
- Creating a MAC ACL313
- Changing a MAC ACL314
- Changing Sequence Numbers in a MAC ACL315
- Removing a MAC ACL316
- Applying a MAC ACL as a Port ACL316
- Applying a MAC ACL as a VACL317
- Enabling or Disabling MAC Packet Classification317
- Verifying the MAC ACL Configuration319
- Monitoring and Clearing MAC ACL Statistics319
- Configuration Example for MAC Acls320
- Additional References for MAC Acls320
CHAPTER 12 Configuring VLAN Acls321
- About VLAN Acls321
- Licensing Requirements for Vacls322
- Prerequisites for Vacls322
- Guidelines and Limitations for Vacls323
- Default Settings for Vacls323
- Configuring Vacls324
- Verifying the VACL Configuration327
- Monitoring and Clearing VACL Statistics327
- Configuration Example for Vacls328
- Additional References for Vacls328
CHAPTER 13 Configuring Port Security329
- About Port Security329
- Licensing Requirements for Port Security335
- Prerequisites for Port Security335
- Default Settings for Port Security335
- Guidelines and Limitations for Port Security336
- Guidelines and Limitations for Port Security on Vpcs336
- Configuring Port Security337
- Verifying the Port Security Configuration349
- Displaying Secure MAC Addresses349
- Configuration Example for Port Security349
- Configuration Examples for Port Security in a Vpc Domain350
  - Example: Configuring Port Security on an Orphan Port350
  - Example: Configuring Port Security on the Vpc Leg350
- Additional References for Port Security351
CHAPTER 14 Configuring DHCP353
- About DHCP Snooping353
- About the DHCP Relay Agent357
- About the Dhcpv6 Relay Agent360
  - Dhcpv6 Relay Agent360
- VRF Support for the Dhcpv6 Relay Agent360
- About DHCP Client360
- Licensing Requirements for DHCP361
- Prerequisites for DHCP361
- Guidelines and Limitations for DHCP361
- Default Settings for DHCP362
- Configuring DHCP363
- Configuring Dhcpv6382
- Enabling DHCP Client388
- Verifying the DHCP Configuration390
CHAPTER 15 Configuring Ipv6 First Hop Security395
- Introduction to First-Hop Security395
  - Ipv6 Global Policies396
  - Ipv6 First-Hop Security Binding Table396
- Guidelines and Limitations of First Hop Security396
- About Vpc First Hop Security Configuration397
- RA Guard400
  - Overview of Ipv6 RA Guard400
  - Guidelines and Limitations of Ipv6 RA Guard401
- Dhcpv6 Guard401
  - Overview of DHCP-Dhcpv6 Guard401
  - Limitation of Dhcpv6 Guard401
- Ipv6 Snooping402
  - Overview of Ipv6 Snooping402
  - Guidelines and Limitations for Ipv6 Snooping402
- How to Configure Ipv6 FHS403
- Configuration Examples412
- Additional References for Ipv6 First-Hop Security413
CHAPTER 16 Configuring Dynamic ARP Inspection415
- About DAI415
- Licensing Requirements for DAI418
- Prerequisites for DAI418
- Guidelines and Limitations for DAI419
- Default Settings for DAI419
- Configuring DAI420
- Verifying the DAI Configuration425
- Monitoring and Clearing DAI Statistics425
- Configuration Examples for DAI426
  - Two Devices Support DAI426
    - Configuring Device a426
    - Configuring Device B428
- Additional References for DAI430
  - Related Documents430
  - Standards430
- Configuring IP Source Guard431
- About IP Source Guard431
- Licensing Requirements for IP Source Guard432
- Prerequisites for IP Source Guard432
- Guidelines and Limitations for IP Source Guard432
- Default Settings for IP Source Guard433
CHAPTER 17 Configuring IP Source Guard433
- Enabling or Disabling IP Source Guard on a Layer 2 Interface433
- Adding or Removing a Static IP Source Entry434
- Configuring IP Source Guard for Trunk Ports435
- Displaying IP Source Guard Bindings436
- Clearing IP Source Guard Statistics436
- Configuration Example for IP Source Guard436
- Additional References437
  - Related Documents437
- Configuring Password Encryption439
- About AES Password Encryption and Master Encryption Keys439
- Licensing Requirements for Password Encryption439
- Guidelines and Limitations for Password Encryption440
- Default Settings for Password Encryption440
CHAPTER 18 Configuring Password Encryption440
- Configuring a Master Key and Enabling the AES Password Encryption Feature440
- Converting Existing Passwords to Type-6 Encrypted Passwords442
- Converting Type-6 Encrypted Passwords Back to Their Original States442
- Deleting Type-6 Encrypted Passwords442
- Verifying the Password Encryption Configuration443
- Configuration Examples for Password Encryption443
CHAPTER 19 Configuring Keychain Management445
- About Keychain Management445
  - Lifetime of a Key445
- Licensing Requirements for Keychain Management446
- Prerequisites for Keychain Management446
- Guidelines and Limitations for Keychain Management446
- Default Settings for Keychain Management447
- Configuring Keychain Management447
- Determining Active Key Lifetimes454
- Verifying the Keychain Management Configuration454
- Configuration Example for Keychain Management455
- Where to Go Next455
- Additional References for Keychain Management455
- Configuring Traffic Storm Control457
- About Traffic Storm Control457
- Licensing Requirements for Traffic Storm Control458
- Guidelines and Limitations for Traffic Storm Control459
- Default Settings for Traffic Storm Control460
CHAPTER 20 Configuring Traffic Storm Control460
- Verifying Traffic Storm Control Configuration462
- Monitoring Traffic Storm Control Counters462
- Configuration Examples for Traffic Storm Control462
- Additional References for Traffic Storm Control463
CHAPTER 21 Configuring Unicast RPF465
- About Unicast RPF465
  - Unicast RPF Process466
- Licensing Requirements for Unicast RPF467
- Guidelines and Limitations for Unicast RPF467
- Default Settings for Unicast RPF468
- Configuring Unicast RPF for Cisco Nexus 9500 Switches with -R Line Cards469
- Configuring Unicast RPF for Cisco Nexus 9300 Switches470
- Configuration Examples for Unicast RPF472
- Verifying the Unicast RPF Configuration473
- Additional References for Unicast RPF473
- Configuring Switchport Blocking475
- About Switchport Blocking475
- Licensing Requirements for Switchport Blocking475
- Guidelines and Limitations for Switchport Blocking475
- Default Settings for Switchport Blocking476
CHAPTER 22 Configuring Switchport Blocking476
- Verifying the Switchport Blocking Configuration477
- Configuration Example for Switchport Blocking477
CHAPTER 23 Configuring Control Plane Policing479
- About Copp479
- Licensing Requirements for Copp496
- Guidelines and Limitations for Copp496
- Default Settings for Copp498
- Configuring Copp499
- Protocol ACL Filtering507
  - Configuring ARP ACL Filtering for Copp507
  - Configuring IP ACL Filtering for Copp509
- Verifying the Copp Configuration512
- Displaying the Copp Configuration Status514
- Monitoring Copp514
- Clearing the Copp Statistics515
- Configuration Examples for Copp515
  - Copp Configuration Example515
  - Changing or Reapplying the Default Copp Policy Using the Setup Utility516
- Additional References for Copp517
- Configuring Rate Limits519
- About Rate Limits519
- Licensing Requirements for Rate Limits520
- Guidelines and Limitations for Rate Limits520
- Default Settings for Rate Limits521
CHAPTER 24 Configuring Rate Limits521
- Monitoring Rate Limits523
- Clearing the Rate Limit Statistics523
- Verifying the Rate Limit Configuration524
- Configuration Examples for Rate Limits524
- Additional References for Rate Limits525
C H a P T E527
Configuring Macsec527
- About Macsec527
  - Key Lifetime and Hitless Key Rollover528
  - Fallback Key528
- Licensing Requirements for Macsec528
- Guidelines and Limitations for Macsec528
- Enabling Macsec530
- Disabling Macsec531
- Configuring a Macsec Keychain and Keys532
- Configuring Macsec Fallback Key534
- Configuring a Macsec Policy535
- Rotating Psks537
- About Configurable EAPOL Destination and Ethernet Type537
  - Enabling EAPOL Configuration537
  - Disabling EAPOL Configuration538
- Verifying the Macsec Configuration539
- Displaying Macsec Statistics541
- Configuration Example for Macsec544
- XML Examples545
Mibs553
- Related Documentation554

Other manuals for Cisco Nexus 9000 Series

Troubleshooting Guide126 pages

Quick Start Configuration Guide6 pages

Hardware Installation Guide112 pages

Installation12 pages

Installing8 pages

Questions and Answers:

Need help?

Do you have a question about the Cisco Nexus 9000 Series and is the answer not in the manual?

Cisco Nexus 9000 Series Specifications

General

Category	Switch
Operating System	Cisco NX-OS
Layer Support	L2, L3
Virtualization	VXLAN, Virtual Routing and Forwarding (VRF)
Management	CLI, SNMP, REST API
Features	ACI
Latency	Sub-microsecond
Power Supply	AC/DC options, Hot-swappable
Security Features	ACLs, TrustSec
Port Speeds	1-Gigabit Ethernet, 10-Gigabit Ethernet, 25-Gigabit Ethernet, 40-Gigabit Ethernet, 100-Gigabit Ethernet
Form Factor	Modular
Redundancy	Yes (Power, Fan)

Related product manuals

Preview: Cisco Nexus 9504

Cisco Nexus 9504

Preview: Cisco Nexus 9508

Cisco Nexus 9508

Preview: Cisco Nexus 9332C

Cisco Nexus 9332C

Cisco Nexus 9236C

Cisco Nexus 9364C

Preview: Cisco Nexus 9300-FX

Cisco Nexus 9300-FX

Cisco Nexus 9336C-FX2

Cisco Nexus 92160YC-X

Preview: Cisco Nexus 93180YC-FX

Cisco Nexus 93180YC-FX

Preview: Cisco Nexus 9332D-GX2B

Cisco Nexus 9332D-GX2B

Preview: Cisco Nexus 9348GC-FXP

Cisco Nexus 9348GC-FXP

Cisco Nexus 93108TC-FX