Cisco Nexus 9000 Series

To Next Page

To Previous Page

Standards

TitleStandards

—No new or modified standards are supported by this feature, and support for existing standards has not

been modified by this feature.

MIBs

MIBs LinkMIBs

To locate and download supported MIBs, go to the following URL:

ftp://ftp.cisco.com/pub/mibs/supportlists/nexus9000/

Nexus9000MIBSupportList.html

MIBs related to TACACS+

Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x

103

Configuring TACACS+

Additional References for TACACS+

Main Page

Default Chapter4
- Table of Contents4
- Chapter27
- Chapter29
Chapter 130
Chapter 230
- RADIUS and TACACS+ Security Protocols30
- Ldap31
- MAC Acls32
  - Traffic Storm Control33
- IP Source Guard33
CHAPTER 3 Configuring AAA35
- About AAA35
- Licensing Requirements for AAA39
- Prerequisites for AAA40
- Guidelines and Limitations for AAA40
- Default Settings for AAA40
- Configuring AAA41
- Monitoring and Clearing the Local AAA Accounting Log60
- Verifying the AAA Configuration60
- Configuration Examples for AAA61
- Configuration Examples for Login Parameters61
- Configuration Examples for the Password Prompt Feature62
- Additional References for AAA63
CHAPTER 4 Configuring RADIUS65
- About RADIUS65
- Licensing Requirements for RADIUS68
- Prerequisites for RADIUS68
- Guidelines and Limitations for RADIUS68
- Default Settings for RADIUS69
- Configuring RADIUS Servers69
- Verifying the RADIUS Configuration88
- Monitoring RADIUS Servers89
- Clearing RADIUS Server Statistics89
- Configuration Example for RADIUS90
- Where to Go Next90
- Additional References for RADIUS90
CHAPTER 5 Configuring TACACS93
- About TACACS93
- Licensing Requirements for TACACS97
- Prerequisites for TACACS97
- Guidelines and Limitations for TACACS97
- Default Settings for TACACS98
- Configuring TACACS98
- Monitoring TACACS+ Servers125
- Clearing TACACS+ Server Statistics125
- Verifying the TACACS+ Configuration126
- Configuration Examples for TACACS126
- Where to Go Next128
- Additional References for TACACS128
CHAPTER 6 Configuring LDAP131
- About LDAP131
- Licensing Requirements for LDAP134
- Prerequisites for LDAP134
- Guidelines and Limitations for LDAP134
- Default Settings for LDAP135
- Configuring LDAP135
- Monitoring LDAP Servers148
- Clearing LDAP Server Statistics149
- Verifying the LDAP Configuration149
- Configuration Examples for LDAP150
- Where to Go Next150
- Additional References for LDAP151
CHAPTER 7 Configuring SSH and Telnet153
- About SSH and Telnet153
- Licensing Requirements for SSH and Telnet155
- Prerequisites for SSH and Telnet155
- Guidelines and Limitations for SSH and Telnet155
- Default Settings for SSH and Telnet156
- Configuring SSH156
- Configuring Telnet173
- Verifying the SSH and Telnet Configuration175
- Configuration Example for SSH176
- Configuration Example for SSH Passwordless File Copy177
- Configuration Example for X.509V3 Certificate-Based SSH Authentication179
- Additional References for SSH and Telnet179
CHAPTER 8 Configuring User Accounts and RBAC181
- About User Accounts and RBAC181
- Licensing Requirements for User Accounts and RBAC184
- Guidelines and Limitations for User Accounts and RBAC184
- Default Settings for User Accounts and RBAC185
- Enabling Password-Strength Checking185
- Configuring User Accounts186
- Configuring Roles188
- About no Service Password-Recovery197
- Enabling no Service Password-Recovery197
- Verifying User Accounts and RBAC Configuration198
- Configuration Examples for User Accounts and RBAC199
- Additional References for User Accounts and RBAC200
CHAPTER 9 Configuring 802.1X203
- About 802.1X203
- Licensing Requirements for 802.1X209
- Prerequisites for 802.1X209
- 802.1X Guidelines and Limitations209
- Default Settings for 802.1X211
- Configuring 802.1X212
- Verifying the 802.1X Configuration231
- 802.1X Support for VXLAN EVPN231
- Monitoring 802.1X236
- Configuration Example for 802.1X236
- Additional References for 802.1X237
C H a P T E239
Configuring IP Acls239
- About Acls239
- Policy-Based Acls247
- Statistics and Acls248
- Atomic ACL Updates248
- Session Manager Support for IP Acls249
- ACL TCAM Regions249
- Licensing Requirements for IP Acls254
- Prerequisites for IP Acls255
- Guidelines and Limitations for IP Acls255
- Default Settings for IP Acls259
- Configuring IP Acls259
- Verifying the IP ACL Configuration293
- Monitoring and Clearing IP ACL Statistics295
- Configuration Examples for IP Acls295
- About System Acls296
- Configuring Object Groups300
CHAPTER 11 Configuring MAC Acls313
- Creating a MAC ACL313
- Changing a MAC ACL314
- Changing Sequence Numbers in a MAC ACL315
- Removing a MAC ACL316
- Applying a MAC ACL as a Port ACL316
- Applying a MAC ACL as a VACL317
- Enabling or Disabling MAC Packet Classification317
- Verifying the MAC ACL Configuration319
- Monitoring and Clearing MAC ACL Statistics319
- Configuration Example for MAC Acls320
- Additional References for MAC Acls320
CHAPTER 12 Configuring VLAN Acls321
- About VLAN Acls321
- Licensing Requirements for Vacls322
- Prerequisites for Vacls322
- Guidelines and Limitations for Vacls323
- Default Settings for Vacls323
- Configuring Vacls324
- Verifying the VACL Configuration327
- Monitoring and Clearing VACL Statistics327
- Configuration Example for Vacls328
- Additional References for Vacls328
CHAPTER 13 Configuring Port Security329
- About Port Security329
- Licensing Requirements for Port Security335
- Prerequisites for Port Security335
- Default Settings for Port Security335
- Guidelines and Limitations for Port Security336
- Guidelines and Limitations for Port Security on Vpcs336
- Configuring Port Security337
- Verifying the Port Security Configuration349
- Displaying Secure MAC Addresses349
- Configuration Example for Port Security349
- Configuration Examples for Port Security in a Vpc Domain350
  - Example: Configuring Port Security on an Orphan Port350
  - Example: Configuring Port Security on the Vpc Leg350
- Additional References for Port Security351
CHAPTER 14 Configuring DHCP353
- About DHCP Snooping353
- About the DHCP Relay Agent357
- About the Dhcpv6 Relay Agent360
  - Dhcpv6 Relay Agent360
- VRF Support for the Dhcpv6 Relay Agent360
- About DHCP Client360
- Licensing Requirements for DHCP361
- Prerequisites for DHCP361
- Guidelines and Limitations for DHCP361
- Default Settings for DHCP362
- Configuring DHCP363
- Configuring Dhcpv6382
- Enabling DHCP Client388
- Verifying the DHCP Configuration390
CHAPTER 15 Configuring Ipv6 First Hop Security395
- Introduction to First-Hop Security395
  - Ipv6 Global Policies396
  - Ipv6 First-Hop Security Binding Table396
- Guidelines and Limitations of First Hop Security396
- About Vpc First Hop Security Configuration397
- RA Guard400
  - Overview of Ipv6 RA Guard400
  - Guidelines and Limitations of Ipv6 RA Guard401
- Dhcpv6 Guard401
  - Overview of DHCP-Dhcpv6 Guard401
  - Limitation of Dhcpv6 Guard401
- Ipv6 Snooping402
  - Overview of Ipv6 Snooping402
  - Guidelines and Limitations for Ipv6 Snooping402
- How to Configure Ipv6 FHS403
- Configuration Examples412
- Additional References for Ipv6 First-Hop Security413
CHAPTER 16 Configuring Dynamic ARP Inspection415
- About DAI415
- Licensing Requirements for DAI418
- Prerequisites for DAI418
- Guidelines and Limitations for DAI419
- Default Settings for DAI419
- Configuring DAI420
- Verifying the DAI Configuration425
- Monitoring and Clearing DAI Statistics425
- Configuration Examples for DAI426
  - Two Devices Support DAI426
    - Configuring Device a426
    - Configuring Device B428
- Additional References for DAI430
  - Related Documents430
  - Standards430
- Configuring IP Source Guard431
- About IP Source Guard431
- Licensing Requirements for IP Source Guard432
- Prerequisites for IP Source Guard432
- Guidelines and Limitations for IP Source Guard432
- Default Settings for IP Source Guard433
CHAPTER 17 Configuring IP Source Guard433
- Enabling or Disabling IP Source Guard on a Layer 2 Interface433
- Adding or Removing a Static IP Source Entry434
- Configuring IP Source Guard for Trunk Ports435
- Displaying IP Source Guard Bindings436
- Clearing IP Source Guard Statistics436
- Configuration Example for IP Source Guard436
- Additional References437
  - Related Documents437
- Configuring Password Encryption439
- About AES Password Encryption and Master Encryption Keys439
- Licensing Requirements for Password Encryption439
- Guidelines and Limitations for Password Encryption440
- Default Settings for Password Encryption440
CHAPTER 18 Configuring Password Encryption440
- Configuring a Master Key and Enabling the AES Password Encryption Feature440
- Converting Existing Passwords to Type-6 Encrypted Passwords442
- Converting Type-6 Encrypted Passwords Back to Their Original States442
- Deleting Type-6 Encrypted Passwords442
- Verifying the Password Encryption Configuration443
- Configuration Examples for Password Encryption443
CHAPTER 19 Configuring Keychain Management445
- About Keychain Management445
  - Lifetime of a Key445
- Licensing Requirements for Keychain Management446
- Prerequisites for Keychain Management446
- Guidelines and Limitations for Keychain Management446
- Default Settings for Keychain Management447
- Configuring Keychain Management447
- Determining Active Key Lifetimes454
- Verifying the Keychain Management Configuration454
- Configuration Example for Keychain Management455
- Where to Go Next455
- Additional References for Keychain Management455
- Configuring Traffic Storm Control457
- About Traffic Storm Control457
- Licensing Requirements for Traffic Storm Control458
- Guidelines and Limitations for Traffic Storm Control459
- Default Settings for Traffic Storm Control460
CHAPTER 20 Configuring Traffic Storm Control460
- Verifying Traffic Storm Control Configuration462
- Monitoring Traffic Storm Control Counters462
- Configuration Examples for Traffic Storm Control462
- Additional References for Traffic Storm Control463
CHAPTER 21 Configuring Unicast RPF465
- About Unicast RPF465
  - Unicast RPF Process466
- Licensing Requirements for Unicast RPF467
- Guidelines and Limitations for Unicast RPF467
- Default Settings for Unicast RPF468
- Configuring Unicast RPF for Cisco Nexus 9500 Switches with -R Line Cards469
- Configuring Unicast RPF for Cisco Nexus 9300 Switches470
- Configuration Examples for Unicast RPF472
- Verifying the Unicast RPF Configuration473
- Additional References for Unicast RPF473
- Configuring Switchport Blocking475
- About Switchport Blocking475
- Licensing Requirements for Switchport Blocking475
- Guidelines and Limitations for Switchport Blocking475
- Default Settings for Switchport Blocking476
CHAPTER 22 Configuring Switchport Blocking476
- Verifying the Switchport Blocking Configuration477
- Configuration Example for Switchport Blocking477
CHAPTER 23 Configuring Control Plane Policing479
- About Copp479
- Licensing Requirements for Copp496
- Guidelines and Limitations for Copp496
- Default Settings for Copp498
- Configuring Copp499
- Protocol ACL Filtering507
  - Configuring ARP ACL Filtering for Copp507
  - Configuring IP ACL Filtering for Copp509
- Verifying the Copp Configuration512
- Displaying the Copp Configuration Status514
- Monitoring Copp514
- Clearing the Copp Statistics515
- Configuration Examples for Copp515
  - Copp Configuration Example515
  - Changing or Reapplying the Default Copp Policy Using the Setup Utility516
- Additional References for Copp517
- Configuring Rate Limits519
- About Rate Limits519
- Licensing Requirements for Rate Limits520
- Guidelines and Limitations for Rate Limits520
- Default Settings for Rate Limits521
CHAPTER 24 Configuring Rate Limits521
- Monitoring Rate Limits523
- Clearing the Rate Limit Statistics523
- Verifying the Rate Limit Configuration524
- Configuration Examples for Rate Limits524
- Additional References for Rate Limits525
C H a P T E527
Configuring Macsec527
- About Macsec527
  - Key Lifetime and Hitless Key Rollover528
  - Fallback Key528
- Licensing Requirements for Macsec528
- Guidelines and Limitations for Macsec528
- Enabling Macsec530
- Disabling Macsec531
- Configuring a Macsec Keychain and Keys532
- Configuring Macsec Fallback Key534
- Configuring a Macsec Policy535
- Rotating Psks537
- About Configurable EAPOL Destination and Ethernet Type537
  - Enabling EAPOL Configuration537
  - Disabling EAPOL Configuration538
- Verifying the Macsec Configuration539
- Displaying Macsec Statistics541
- Configuration Example for Macsec544
- XML Examples545
Mibs553
- Related Documentation554

Cisco Nexus 9000 Series - Page 129

Table of Contents

Other manuals for Cisco Nexus 9000 Series

Related product manuals