Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallSecure a Cisco Nexus switch by layering four controls: service-based AAA to identify users and record sessions, SSH to encrypt remote CLI traffic, NX-OS role-based access control (RBAC) to limit authorized actions, and a management-plane source restriction that allows only approved administrator networks. The exact commands and ACL attachment method depend on the Nexus family and NX-OS release. The procedures and defaults below are scoped to the Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 10.6(x), updated April 27, 2026; match that guide to your switch before applying configuration.
What each control protects
These features solve different problems and should not be treated as interchangeable:
As an Amazon Associate I earn from qualifying purchases.
- AAA authentication verifies the administrator’s identity. NX-OS can use configured RADIUS, TACACS+, or LDAP groups, or its local user database, depending on the service.
- AAA authorization supplies or selects the roles that determine what an authenticated account may do.
- AAA accounting records management sessions locally or sends session information to remote AAA servers.
- SSH protects the remote CLI connection with encryption. It protects the transport; it does not decide which commands the user may run.
- RBAC limits commands and operations after login. A successful SSH login must not automatically mean unrestricted administrative privilege.
- A management ACL can restrict which source networks are allowed to reach management services, but its binding mechanism is platform- and release-specific. An interface ACL example is not automatically a verified management-plane access class.
Cisco describes the SSH function this way: “You can use the Secure Shell (SSH) server to enable an SSH client to make a secure, encrypted connection to a Cisco NX-OS device.” Encryption, identity, authorization, auditing, and source restriction are separate layers; a secure design uses all that the platform and your policy support.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsConfirm the platform and recovery plan first
Do not paste a Nexus 9000 NX-OS 10.6(x) sequence into another Nexus family or an older release without checking its security guide. Feature support, defaults, command syntax, and ACL attachment points can differ. Record the exact switch model, NX-OS release, management interface in use, administrator source subnets, and the remote AAA servers that will be reachable from the switch.
Keep a tested console path before changing AAA or management filtering. Console authentication is configured as a distinct AAA service, so a console session can be the difference between a recoverable mistake and a locked-out switch. A USB-to-RJ45 console cable can be useful during initial setup or recovery, but verify the switch’s console port and your host connection before buying any accessory; compatibility is model-specific.
- Confirm IP reachability from the switch to each AAA server.
- Configure the switch as an AAA client and use the shared secret expected by the server.
- Verify that the server is configured to answer requests from this switch.
- Stage and test changes in a maintenance window, with an active console session or another proven recovery path.
Design AAA by service
NX-OS AAA is service-based rather than one global switch. Cisco documents separate controls for remote CLI login, console login, and management-session accounting.
| Service | Purpose | Documented NX-OS control |
|---|---|---|
| Telnet/SSH user login | Authenticates users connecting to the remote CLI | aaa authentication login default |
| Console login | Authenticates users on the local console | aaa authentication login console |
| User-session accounting | Records management-session information locally or on remote AAA servers | aaa accounting default |
The method lists available to each service vary. Remote groups can contain RADIUS, TACACS+, or LDAP servers, while the local database remains an available method where supported. Treat authentication, authorization, and accounting as independent design decisions: enabling remote login does not automatically create useful command authorization or an audit trail.
Choose remote AAA, local accounts, and fallback deliberately
Remote AAA for normal administration
Centralized AAA lets you apply organization-wide identity policy, remove a departed administrator’s access in one place, and collect session records centrally. Configure redundant servers in a remote AAA group. If the first server does not respond, NX-OS tries the next server in that group and can continue to subsequent configured groups.
Remote AAA requires more than a server address: the switch needs IP reachability, AAA-client configuration, a matching shared secret, and a server that responds to requests. Test both successful authentication and the expected role assignment before relying on the service for production access.
Local accounts as recovery credentials
Local authentication is the default method when remote methods fail. That behavior can preserve access during a AAA outage, but it also means a local credential may remain usable when centralized policy is unavailable. Cisco documents the command below to disable local fallback for either console or default login:
no aaa authentication login { console | default } fallback error local
Disabling fallback can reduce exposure to local credentials, yet it can make recovery harder during a server, routing, or shared-secret failure. There is no universal “more secure” choice: decide based on your outage and break-glass requirements, retain a verified console recovery procedure, and test the result during a controlled window. Never disable the only recovery path without proving another one.
Rank #3
- Item Package Dimension: 22.48L X 17.28W X 1.73H Inches
- Item Package Weight - 32.47 Pounds
- Item Package Quantity - 1
- Product Type - Electronic Switch
Avoid username collisions
If a local account and a remote AAA account use the same username, NX-OS applies the local user’s roles to the remote user. Use distinct names, or explicitly account for this precedence in your access design and role review.
RADIUS and TACACS+ considerations
Select the protocol that fits your existing AAA policy and server capabilities; the guide does not justify broad protocol comparisons beyond its documented behavior. On Nexus 9000, aaa authentication login ascii-authentication is supported only for TACACS+, not RADIUS. Check that limitation before selecting an ASCII-authentication method.
Configure and verify AAA safely
Build the configuration in this order so that each dependency is testable:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Prepare the servers. Add the switch as an AAA client, set the shared secret, define the permitted authentication and authorization policy, and enable accounting destinations if required.
- Verify reachability. From the switch, confirm that routing and source addressing allow requests to reach every configured AAA server.
- Define server groups and method order. Put redundant servers in the intended groups and decide where the local database appears in the method sequence.
- Set remote-login authentication. Configure the
defaultlogin service for SSH (and Telnet only if an approved legacy requirement exists; Telnet is disabled by default in the documented release). - Set console authentication separately. Configure the
consolelogin service and verify that your recovery account and role work at the console. - Configure accounting. Use
aaa accounting defaultto retain management-session records locally or send them to remote AAA servers, according to your audit policy. - Test the positive path. Open a new session with a test remote account and confirm authentication, assigned role, and accounting records.
- Test failure behavior. In a maintenance window, make the primary server unavailable and verify group failover. Then verify the planned local-fallback behavior without closing your console session.
Use show aaa authentication to inspect the login-authentication configuration. Check server-side logs as well as the switch; a successful password exchange with an unexpected role is an authorization problem, not proof that the entire AAA design is correct.
Harden SSH transport
The Nexus 9000 Release 10.6(x) guide lists the SSH server as enabled by default, with a default 1024-bit RSA server key. Telnet is listed as disabled by default. Those are release-specific defaults, not a completed hardening policy. Review key size, key type, host-key lifecycle, and algorithm compatibility against your organization’s standards and the exact NX-OS release.
Set an explicit SSH policy
- Keep SSH as the remote CLI protocol and do not enable Telnet merely because a client expects it.
- Select supported key types and cryptographic algorithms that meet current policy while remaining compatible with approved administrative clients.
- Replace or regenerate default-strength host keys when your policy requires stronger protection, and document the resulting host-key change for operators who validate fingerprints.
- Review public-key user authentication if it is part of your access design; ensure the key-to-user mapping still receives the intended NX-OS role.
- Note that Cisco marks DSA-related SSH commands as deprecated beginning in NX-OS Release 10.6(1)F; do not build a new policy around deprecated DSA controls.
Verify SSH state
After making changes, use the documented verification commands:
show ssh key— inspect SSH key information.show ssh server— inspect SSH server state and settings.show running-config security [all]— review the security configuration, including the effective SSH-related lines.
Test from an approved administrator source and from a deliberately unapproved source. Confirm that the approved client negotiates the selected algorithms and that the session receives the expected AAA/RBAC role.
Apply RBAC so login does not equal full privilege
AAA can authenticate a person without authorizing every operation. NX-OS user accounts and roles determine which commands and actions are available after login. Define roles around actual duties—such as monitoring, operations, or full change administration—and grant only the commands each duty needs. Review inherited roles and remote AAA attributes together, because a locally defined role can affect a remote user when usernames collide.
Best Value
- MPN: N3K-C3048TP-1GE=
- Give read-only staff a role that cannot change configuration.
- Give incident responders only the diagnostic and narrowly scoped operational commands required for their response process.
- Reserve broad configuration privileges for a small, accountable group.
- Test both an allowed and a denied command for every role before deployment, and record the expected result in the access review.
RBAC is not a substitute for SSH or a source ACL: it acts after a connection has reached the switch and a user has authenticated.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Management ACLs: restrict sources without assuming the attachment
Cisco’s IP ACL chapter states: “Management interface traffic is always processed on the supervisor module.” That describes where the traffic is processed; it does not, by itself, document a complete method for binding an ACL to SSH management access.
Management ACL implementation is platform- and release-specific. Before deployment, identify the exact Nexus family, NX-OS release, management interface, and documented attachment mechanism for that platform. Do not present a generic ip access-group interface example as a verified management-plane SSH filter unless the matching guide explicitly supports that use.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Use a safe ACL change procedure
- List every administrator source subnet, jump host, automation host, and emergency path that must remain reachable.
- Locate the release-specific documentation for management-plane ACL binding and confirm whether the rule applies to the intended management service.
- Order permits before any deny that could match an approved source; account for the platform’s rule-processing behavior.
- Keep an active console session while attaching or editing the ACL.
- Test an approved source, an unapproved source, and the console path before saving the configuration.
- Review counters or available verification output to confirm that intended sources hit the expected rules and unintended sources are denied.
- Save only after the tests pass, and record the rollback procedure and the last known-good configuration.
The primary risk is administrative lockout. A syntactically valid ACL can still block a jump host, automation system, or emergency subnet if the source range, interface, or attachment point was misunderstood.
How the layers work together
| Layer | Question it answers | Typical failure it prevents |
|---|---|---|
| Management source restriction | May this source network reach the management service? | Unapproved networks attempting to connect |
| SSH | Is the remote CLI session encrypted? | Clear-text remote CLI transport |
| AAA authentication | Who is the administrator? | Unverified identity |
| AAA authorization and RBAC | What may this authenticated administrator do? | Excessive command privilege |
| AAA accounting | What management session occurred, and where is it recorded? | Missing administrative audit trail |
A source ACL cannot replace identity checks, and a valid AAA login cannot make an unsafe transport or over-privileged role acceptable. Evaluate the chain end to end.
Decision guide for common design choices
| Choice | Strength | Operational cost or risk |
|---|---|---|
| Remote AAA with redundant server groups | Central administration, centralized policy, and server failover | Depends on IP reachability, shared-secret accuracy, server availability, and correct role attributes |
| Local accounts with remote fallback | Recovery remains possible during remote AAA outages | Local credentials require careful protection and break-glass governance |
| Remote AAA with local fallback disabled | Reduces reliance on local credentials when remote policy is unavailable | Can remove the recovery path during AAA, routing, or server failures; console recovery must be proven |
| RADIUS | Fits organizations already operating RADIUS-based AAA | Confirm the selected NX-OS authentication options; Nexus 9000 ASCII authentication is not supported for RADIUS |
| TACACS+ | Fits organizations already operating TACACS+-based AAA and supports the documented ASCII-authentication option | Requires matching server policy and shared-secret configuration |
| SSH key or public-key authentication | Can reduce dependence on passwords when supported by the release and client policy | Key distribution, revocation, algorithm compatibility, and role mapping must be managed |
| Management ACL source restriction | Narrows which networks can reach management services | Attachment support and syntax must be confirmed for the exact platform; mistakes can lock out administrators |
Validation checklist before production
- The exact Nexus model and NX-OS release are recorded and matched to the applicable security guide.
- AAA server reachability, AAA-client registration, shared secrets, and server responses have been tested.
- Remote login, console login, and accounting are configured as separate services with intentional method order.
- Primary and secondary AAA-server behavior has been tested, including the planned local-fallback outcome.
- No local and remote account share a username unless the resulting local-role precedence is intentional.
- SSH is enabled, Telnet remains disabled unless an approved exception exists, and key and algorithm settings meet policy.
show aaa authentication,show ssh key,show ssh server, andshow running-config security [all]outputs have been reviewed.- Each administrative role has been tested with both permitted and denied operations.
- The management ACL’s documented attachment method is confirmed for the release; approved, unapproved, and console paths have all been tested.
- A rollback configuration and a physically accessible console recovery method are available.
Source and version scope
This guidance follows Cisco’s Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 10.6(x), updated April 27, 2026, covering its AAA, SSH/Telnet, user-account and RBAC, and IP ACL chapters. Defaults and commands should be rechecked against the guide for your exact switch and release before deployment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
