Cisco AP775A - Nexus Converged Network Switch 5010 User manual

Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
First Published: 07/17/2009
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]
Text Part Number: OL-16597-01

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version
of the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco StackPower, Cisco StadiumVision, Cisco
TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flip Video, Flip Video (Design), Flipshare (Design), Flip Ultra, and Welcome
to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AsyncOS,
Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco
Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare,
GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX,
Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to
Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.
All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco
and any other company. (0907R)
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown
for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

CONTENTS
New and Changed Information for the Cisco Nexus 5000 Series 41
Preface xliii
Audience xliii
Document Organization xliii
Document Conventions xliv
Related Documentation xlv
Obtaining Documentation and Submitting a Service Request xlvi
Overview 1
Information About Cisco Nexus 5000 Series Switches 1
New Technologies in the Cisco Nexus 5000 Series 1
Fibre Channel over Ethernet 1
Data Center I/O Consolidation 2
Virtual Interfaces 3
Cisco Nexus 5000 Series Switch Hardware 4
Chassis 4
Expansion Modules 4
Fabric Extender 4
Ethernet Interfaces 4
Fibre Channel Interfaces 5
Management Interfaces 5
Cisco Nexus 5000 Series Switch Software 5
Ethernet Switching 5
FCoE and Fibre Channel Switching 5
QoS 6
Virtual Port Channels 6
Serviceability 6
Switched Port Analyzer 6
Ethanalyzer 6
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 iii

Call Home 6
Online Diagnostics 7
Switch Management 7
Simple Network Management Protocol 7
Role-Based Access Control 7
Configuration Methods 7
Configuring with CLI, XML Management Interface, or SNMP 7
Configuring with Cisco Data Center Network Manager 7
Configuring with Cisco MDS Fabric Manager 7
Network Security Features 8
Virtual Device Contexts 8
Licensing 8
Typical Deployment Topologies 8
Ethernet TOR Switch Topology 8
Fabric Extender Deployment Topology 10
Data Center I/O Consolidation Topology 11
Supported Standards 11
Configuration Fundamentals 13
Using the Command-Line Interface 15
Accessing the Command Line Interface 15
Telnet Connection 15
SSH Connection 16
Using the CLI 17
Using CLI Command Modes 17
Changing Command Modes 17
Listing the Commands Used with Each Command Mode 18
CLI Command Hierarchy 18
EXEC Mode Commands 18
Configuration Mode Commands 20
Using Commands 22
Listing Commands and Syntax 22
Entering Command Sequences 22
Undoing or Reverting to Default Values or Conditions 22
Using Keyboard Shortcuts 23
Using CLI Variables 24
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
iv OL-16597-01
Contents

User-Defined Persistent CLI Variables 25
Using Command Aliases 26
Defining Command Aliases 26
Command Scripts 26
Executing Commands Specified in a Script 26
Using CLI Variables in Scripts 27
Setting the Delay Time 28
Initial Switch Configuration 29
Configuring the Switch 29
Image Files on the Switch 29
Starting the Switch 29
Boot Sequence 30
Console Settings 31
Upgrading the Switch Software 31
Downgrading from a Higher Release 33
Initial Configuration 35
Configuration Prerequisites 35
Initial Setup 35
Preparing to Configure the Switch 35
Default Login 36
Configuring the Switch 36
Changing the Initial Configuration 40
Accessing the Switch 40
Additional Switch Configuration 40
Assigning a Switch Name 40
Configuring Date and Time 41
Configuring Time Zone 41
Adjusting for Daylight Saving Time or Summer Time 42
NTP Configuration 43
About NTP 43
NTP Configuration Guidelines 43
Configuring NTP 44
NTP CFS Distribution 45
Enabling NTP Distribution 45
Committing NTP Configuration Changes 45
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 v
Contents

Discarding NTP Configuration Changes 46
Releasing Fabric Session Lock 46
Database Merge Guidelines 46
NTP Session Status Verification 46
Management Interface Configuration 47
About the mgmt0 Interface 47
Configuring the Management Interface 47
Displaying Management Interface Configuration 48
Shutting Down the Management Interface 48
Managing the Switch Configuration 48
Displaying the Switch Configuration 48
Saving a Configuration 49
Clearing a Configuration 49
Using Switch File Systems 49
Setting the Current Directory 49
Displaying the Current Directory 49
Listing the Files in a Directory 50
Creating a Directory 50
Deleting an Existing Directory 50
Moving Files 50
Copying Files 51
Deleting Files 51
Displaying File Contents 51
Saving Command Output to a File 51
Compressing and Uncompressing Files 52
Managing Licenses 53
Licensing Terminology 53
Licensing Model 54
Licence Installation 55
Obtaining a Factory-Installed License 55
Performing a Manual Installation 56
Obtaining the License Key File 56
Installing the License Key File 56
Backing Up License Files 57
Identifying License Features in Use 58
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
vi OL-16597-01
Contents

Uninstalling Licenses 58
Updating Licenses 59
Grace Period Alerts 60
License Transfers Between Switches 61
Verifying the License Configuration 61
LAN Switching 63
Configuring Ethernet Interfaces 65
Information About Ethernet Interfaces 65
About the Interface Command 65
About the Unidirectional Link Detection Parameter 66
UDLD Overview 66
Default UDLD Configuration 67
UDLD Aggressive and Nonaggressive Modes 67
About Interface Speed 68
About the Cisco Discovery Protocol 68
Default CDP Configuration 68
About the Debounce Timer Parameters 68
About MTU Configuration 69
Configuring Ethernet Interfaces 69
Configuring the UDLD Mode 69
Configuring Interface Speed 70
Configuring the Cisco Discovery Protocol 71
Configuring the CDP Characteristics 71
Enabling or Disabling CDP 72
Configuring the Debounce Timer 72
Configuring the Description Parameter 73
Disabling and Restarting Ethernet Interfaces 73
Displaying Interface Information 74
Default Physical Ethernet Settings 77
Configuring VLANs 79
Configuring VLANs 79
Information About VLANs 79
Understanding VLANs 79
Understanding VLAN Ranges 80
Creating, Deleting, and Modifying VLANs 81
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 vii
Contents

Configuring a VLAN 82
Creating and Deleting a VLAN 82
Entering the VLAN Submode and Configuring the VLAN 83
Adding Ports to a VLAN 84
Verifying VLAN Configuration 84
Configuring Private VLANs 87
Information About Private VLANs 87
Primary and Secondary VLANs in Private VLANs 88
Private VLAN Ports 88
Primary, Isolated, and Community Private VLANs 89
Associating Primary and Secondary VLANs 90
Private VLAN Promiscuous Trunks 91
Private VLAN Isolated Trunks 91
Broadcast Traffic in Private VLANs 92
Private VLAN Port Isolation 92
Guidelines and Limitations for Private VLANs 92
Configuring a Private VLAN 92
Enabling Private VLANs 92
Configuring a VLAN as a Private VLAN 93
Associating Secondary VLANs with a Primary Private VLAN 94
Configuring an Interface as a Private VLAN Host Port 95
Configuring an Interface as a Private VLAN Promiscuous Port 96
Configuring a Promiscuous Trunk Port 97
Configuring an Isolated Trunk Port 97
Configuring the Allowed VLANs for PVLAN Trunking Ports 98
Configuring Native 802.1Q VLANs on Private VLANs 99
Verifying Private VLAN Configuration 100
Configuring Access and Trunk Interfaces 101
Information About Access and Trunk Interfaces 101
Understanding Access and Trunk Interfaces 101
Understanding IEEE 802.1Q Encapsulation 102
Understanding Access VLANs 103
Understanding the Native VLAN ID for Trunk Ports 104
Understanding Allowed VLANs 104
Understanding Native 802.1Q VLANs 104
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
viii OL-16597-01
Contents

Configuring Access and Trunk Interfaces 105
Configuring a LAN Interface as an Ethernet Access Port 105
Configuring Access Host Ports 105
Configuring Trunk Ports 106
Configuring the Native VLAN for 802.1Q Trunking Ports 107
Configuring the Allowed VLANs for Trunking Ports 107
Configuring Native 802.1Q VLANs 108
Verifying Interface Configuration 109
Configuring EtherChannels 111
Information About EtherChannels 111
Understanding EtherChannels 111
Compatibility Requirements 112
Load Balancing Using EtherChannels 113
Understanding LACP 114
LACP Overview 114
LACP ID Parameters 115
Channel Modes 116
LACP Marker Responders 117
LACP-Enabled and Static EtherChannels Differences 117
Configuring EtherChannels 117
Creating an EtherChannel 117
Adding a Port to an EtherChannel 118
Configuring Load Balancing Using EtherChannels 119
Enabling LACP 120
Configuring Channel Mode for a Port 120
Configuring the LACP System Priority and System ID 121
Configuring the LACP Port Priority 121
Verifying EtherChannel Configuration 122
Configuring Virtual Port Channels 123
Information About vPCs 123
vPC Overview 123
Terminology 125
vPC Terminology 125
Fabric Extender Terminology 125
Supported vPC Topologies 126
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 ix
Contents

Cisco Nexus 5000 Series Switch vPC Topology 126
Single Homed Fabric Extender vPC Topology 126
Dual Homed Fabric Extender vPC Topology 127
vPC Domain 128
Peer-Keepalive Link and Messages 128
Compatibility Parameters for vPC Peer Links 129
Configuration Parameters That Must Be Identical 129
Configuration Parameters That Should Be Identical 130
vPC Peer Links 131
vPC Peer Link Overview 131
Manually Configured vPC Features 132
vPC Number 133
vPC Interactions with Other Features 133
vPC and LACP 133
vPC Peer Links and STP 133
CFSoE 134
vPC Guidelines and Limitations 134
Configuring vPCs 135
Enabling vPCs 135
Disabling vPCs 135
Creating a vPC Domain 136
Configuring a vPC Keepalive Link 137
Creating a vPC Peer Link 138
Checking the Configuration Compatibility 138
Creating an EtherChannel Host Interface 139
Moving Other EtherChannels into a vPC 140
Manually Configuring a vPC Domain MAC Address 141
Manually Configuring the System Priority 142
Manually Configuring a vPC Peer Switch Role 143
Verifying the vPC Configuration 144
vPC Example Configurations 145
Dual Homed Fabric Extender vPC Configuration Example 145
Single Homed Fabric Extender vPC Configuration Example 146
vPC Default Settings 148
Configuring Rapid PVST+ 149
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
xOL-16597-01
Contents

Information About Rapid PVST+ 149
Understanding STP 150
STP Overview 150
Understanding How a Topology is Created 150
Understanding the Bridge ID 150
Bridge Priority Value 151
Extended System ID 151
STP MAC Address Allocation 151
Understanding BPDUs 152
Election of the Root Bridge 153
Creating the Spanning Tree Topology 153
Understanding Rapid PVST+ 154
Rapid PVST+ Overview 154
Rapid PVST+ BPDUs 156
Proposal and Agreement Handshake 157
Protocol Timers 158
Port Roles 158
Port States 159
Rapid PVST+ Port State Overview 159
Blocking State 160
Learning State 160
Forwarding State 160
Disabled State 161
Summary of Port States 161
Synchronization of Port Roles 161
Processing Superior BPDU Information 162
Processing Inferior BPDU Information 162
Detecting Unidirectional Link Failure 163
Port Cost 163
Port Priority 164
Rapid PVST+ and IEEE 802.1Q Trunks 164
Rapid PVST+ Interoperation with Legacy 802.1D STP 164
Rapid PVST+ Interoperation with 802.1s MST 165
Configuring Rapid PVST+ 165
Enabling Rapid PVST+ 165
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 xi
Contents

Enabling Rapid PVST+ per VLAN 166
Configuring the Root Bridge ID 167
Configuring a Secondary Root Bridge 168
Configuring the Rapid PVST+ Port Priority 168
Configuring the Rapid PVST+ Pathcost Method and Port Cost 169
Configuring the Rapid PVST+ Bridge Priority of a VLAN 170
Configuring the Rapid PVST+ Hello Time for a VLAN 170
Configuring the Rapid PVST+ Forward Delay Time for a VLAN 171
Configuring the Rapid PVST+ Maximum Age Time for a VLAN 171
Specifying the Link Type 172
Restarting the Protocol 172
Verifying Rapid PVST+ Configurations 172
Configuring Multiple Spanning Tree 175
Information About MST 175
MST Overview 175
MST Regions 176
MST BPDUs 176
MST Configuration Information 177
IST, CIST, and CST 177
IST, CIST, and CST Overview 177
Spanning Tree Operation Within an MST Region 178
Spanning Tree Operations Between MST Regions 178
MST Terminology 179
Hop Count 180
Boundary Ports 180
Detecting Unidirectional Link Failure 181
Port Cost and Port Priority 182
Interoperability with IEEE 802.1D 182
Interoperability with Rapid PVST+: Understanding PVST Simulation 183
Configuring MST 183
MST Configuration Guidelines 183
Enabling MST 183
Entering MST Configuration Mode 184
Specifying the MST Name 185
Specifying the MST Configuration Revision Number 185
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
xii OL-16597-01
Contents

Specifying the Configuration on an MST Region 186
Mapping and Unmapping VLANs to MST Instances 187
Mapping Secondary VLANs to Same MSTI as Primary VLANs for Private VLANs 188
Configuring the Root Bridge 189
Configuring a Secondary Root Bridge 190
Configuring the Port Priority 190
Configuring the Port Cost 191
Configuring the Switch Priority 192
Configuring the Hello Time 193
Configuring the Forwarding-Delay Time 193
Configuring the Maximum-Aging Time 194
Configuring the Maximum-Hop Count 194
Configuring PVST Simulation Globally 194
Configuring PVST Simulation Per Port 195
Specifying the Link Type 196
Restarting the Protocol 196
Verifying MST Configurations 197
Configuring STP Extensions 199
About STP Extensions 199
Information About STP Extensions 199
Understanding STP Port Types 199
Spanning Tree Edge Ports 199
Spanning Tree Network Ports 200
Spanning Tree Normal Ports 200
Understanding Bridge Assurance 200
Understanding BPDU Guard 200
Understanding BPDU Filtering 201
Understanding Loop Guard 202
Understanding Root Guard 202
Configuring STP Extensions 203
STP Extensions Configuration Guidelines 203
Configuring Spanning Tree Port Types Globally 203
Configuring Spanning Tree Edge Ports on Specified Interfaces 204
Configuring Spanning Tree Network Ports on Specified Interfaces 205
Enabling BPDU Guard Globally 206
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 xiii
Contents

Enabling BPDU Guard on Specified Interfaces 206
Enabling BPDU Filtering Globally 207
Enabling BPDU Filtering on Specified Interfaces 208
Enabling Loop Guard Globally 209
Enabling Loop Guard or Root Guard on Specified Interfaces 210
Verifying STP Extension Configuration 210
Configuring the MAC Address Table 211
Information About MAC Addresses 211
Configuring MAC Addresses 211
Configuring a Static MAC Address 211
Configuring the Aging Time for the MAC Table 212
Clearing Dynamic Addresses from the MAC Table 213
Verifying the MAC Address Configuration 213
Configuring IGMP Snooping 215
Information About IGMP Snooping 215
IGMPv1 and IGMPv2 216
IGMPv3 217
IGMP Snooping Querier 217
IGMP Forwarding 217
Configuring IGMP Snooping Parameters 218
Verifying IGMP Snooping Configuration 220
Configuring Traffic Storm Control 221
Information About Traffic Storm Control 221
Traffic Storm Guidelines and Limitations 222
Configuring Traffic Storm Control 223
Verifying Traffic Storm Control Configuration 223
Traffic Storm Control Example Configuration 224
Default Traffic Storm Settings 224
Switch Security Features 225
Configuring Authentication, Authorization, and Accounting 227
Information About AAA 227
AAA Security Services 227
Benefits of Using AAA 228
Remote AAA Services 228
AAA Server Groups 229
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
xiv OL-16597-01
Contents

AAA Service Configuration Options 229
Authentication and Authorization Process for User Login 230
Prerequisites for Remote AAA 231
Information about AAA Guidelines and Limitations 232
Configuring AAA 232
Configuring Console Login Authentication Methods 232
Configuring Default Login Authentication Methods 233
Enabling Login Authentication Failure Messages 234
Enabling MSCHAP Authentication 235
Configuring AAA Accounting Default Methods 236
Using AAA Server VSAs 237
About VSAs 237
VSA Format 237
Specifying Switch User Roles and SMNPv3 Parameters on AAA Servers 238
Displaying and Clearing the Local AAA Accounting Log 238
Verifying AAA Configuration 238
Example AAA Configuration 239
Default AAA Settings 239
Configuring RADIUS 241
Configuring RADIUS 241
Information About RADIUS 241
RADIUS Network Environments 241
RADIUS Operation 242
RADIUS Server Monitoring 242
Vendor-Specific Attributes 243
Prerequisites for RADIUS 244
Guidelines and Limitations for RADIUS 244
Configuring RADIUS Servers 244
Configuring RADIUS Server Hosts 245
Configuring RADIUS Global Preshared Keys 245
Configuring RADIUS Server Preshared Keys 246
Configuring RADIUS Server Groups 247
Allowing Users to Specify a RADIUS Server at Login 248
Configuring the Global RADIUS Transmission Retry Count and Timeout Interval 248
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 xv
Contents

Configuring the RADIUS Transmission Retry Count and Timeout Interval for a
Server 249
Configuring Accounting and Authentication Attributes for RADIUS Servers 250
Configuring Periodic RADIUS Server Monitoring 251
Configuring the Dead-Time Interval 252
Manually Monitoring RADIUS Servers or Groups 252
Verifying RADIUS Configuration 253
Displaying RADIUS Server Statistics 253
Example RADIUS Configuration 254
Default RADIUS Settings 254
Configuring TACACS+ 255
About Configuring TACACS+ 255
Information About TACACS+ 255
TACACS+ Advantages 255
User Login with TACACS+ 256
Default TACACS+ Server Encryption Type and Preshared Key 256
TACACS+ Server Monitoring 257
Prerequisites for TACACS+ 257
Guidelines and Limitations for TACACS+ 257
Configuring TACACS+ 258
TACACS+ Server Configuration Process 258
Enabling TACACS+ 258
Configuring TACACS+ Server Hosts 259
Configuring TACACS+ Global Preshared Keys 259
Configuring TACACS+ Server Preshared Keys 260
Configuring TACACS+ Server Groups 261
Specifying a TACACS+ Server at Login 262
Configuring the Global TACACS+ Timeout Interval 262
Configuring the Timeout Interval for a Server 263
Configuring TCP Ports 263
Configuring Periodic TACACS+ Server Monitoring 264
Configuring the Dead-Time Interval 265
Manually Monitoring TACACS+ Servers or Groups 266
Disabling TACACS+ 266
Displaying TACACS+ Statistics 267
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
xvi OL-16597-01
Contents

Verifying TACACS+ Configuration 267
Example TACACS+ Configuration 267
Default TACACS+ Settings 267
Configuring SSH and Telnet 269
Configuring SSH and Telnet 269
Information About SSH and Telnet 269
SSH Server 269
SSH Client 269
SSH Server Keys 269
Telnet Server 270
Guidelines and Limitations for SSH 270
Configuring SSH 270
Generating SSH Server Keys 270
Specifying the SSH Public Keys for User Accounts 271
Specifying the SSH Public Keys in Open SSH Format 271
Specifying the SSH Public Keys in IETF SECSH Format 272
Specifying the SSH Public Keys in PEM-Formatted Public Key Certificate Form
272
Starting SSH Sessions to Remote Devices 273
Clearing SSH Hosts 273
Disabling the SSH Server 273
Deleting SSH Server Keys 274
Clearing SSH Sessions 274
SSH Example Configuration 275
Configuring Telnet 276
Enabling the Telnet Server 276
Reenabling the Telnet Server 276
Starting Telnet Sessions to Remote Devices 276
Clearing Telnet Sessions 277
Verifying the SSH and Telnet Configuration 277
Default SSH Settings 277
Configuring Access Control Lists 279
Information About ACLs 279
IP ACL Types and Applications 279
Application Order 280
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 xvii
Contents

Rules 280
Source and Destination 280
Protocols 280
Implicit Rules 280
Additional Filtering Options 281
Sequence Numbers 281
Logical Operators and Logical Operation Units 282
Configuring IP ACLs 283
Creating an IP ACL 283
Changing an IP ACL 283
Removing an IP ACL 284
Changing Sequence Numbers in an IP ACL 285
Applying an IP ACL as a Port ACL 285
Verifying IP ACL Configurations 286
Displaying and Clearing IP ACL Statistics 286
Configuring MAC ACLs 287
Creating a MAC ACL 287
Changing a MAC ACL 288
Removing a MAC ACL 289
Changing Sequence Numbers in a MAC ACL 289
Applying a MAC ACL as a Port ACL 290
Verifying MAC ACL Configurations 290
Displaying and Clearing MAC ACL Statistics 291
Example Configuration for MAC ACLs 291
Information About VLAN ACLs 291
VACLs and Access Maps 291
VACLs and Actions 292
Statistics 292
Configuring VACLs 292
Creating or Changing a VACL 292
Removing a VACL 293
Applying a VACL to a VLAN 293
Verifying VACL Configuration 294
Displaying and Clearing VACL Statistics 294
Example Configuration for VACL 295
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
xviii OL-16597-01
Contents

Default ACL Settings 295
System Management 297
Using Cisco Fabric Services 299
Using Cisco Fabric Services 299
Information About CFS 299
CFS Distribution 300
CFS Distribution Modes 300
Uncoordinated Distribution 300
Coordinated Distribution 300
Unrestricted Uncoordinated Distributions 301
Disabling or Enabling CFS Distribution on a Switch 301
Verifying CFS Distribution Status 301
CFS Distribution over IP 301
CFS Distribution over Fibre Channel 303
CFS Distribution Scopes 303
CFS Merge Support 303
CFS Support for Applications 304
CFS Application Requirements 304
Enabling CFS for an Application 304
Verifying Application Registration Status 304
Locking the Network 305
Verifying CFS Lock Status 305
Committing Changes 306
Discarding Changes 306
Saving the Configuration 306
Clearing a Locked Session 307
CFS Regions 307
About CFS Regions 307
Example Scenario 307
Managing CFS Regions 307
Creating CFS Regions 307
Assigning Applications to CFS Regions 308
Moving an Application to a Different CFS Region 308
Removing an Application from a Region 309
Deleting CFS Regions 309
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
OL-16597-01 xix
Contents

Configuring CFS over IP 309
Enabling CFS over IPv4 309
Enabling CFS over IPv6 310
Verifying the CFS Over IP Configuration 310
Configuring IP Multicast Address for CFS over IP 310
Configuring IPv4 Multicast Address for CFS 311
Configuring IPv6 Multicast Address for CFS 311
Verifying IP Multicast Address Configuration for CFS over IP 311
Displaying CFS Distribution Information 312
Default CFS Settings 314
Configuring User Accounts and RBAC 315
Configuring User Accounts and RBAC 315
Information About User Accounts and RBAC 315
About User Accounts 315
Characteristics of Strong Passwords 316
About User Roles 316
About Rules 317
About User Role Policies 317
Guidelines and Limitations for User Accounts 317
Configuring User Accounts 318
Configuring RBAC 319
Creating User Roles and Rules 319
Creating Feature Groups 320
Changing User Role Interface Policies 320
Changing User Role VLAN Policies 321
Changing User Role VSAN Policies 322
Verifying User Accounts and RBAC Configuration 322
Default User Account and RBAC Settings 323
Configuring Session Manager 325
Configuring Session Manager 325
Information About Session Manager 325
Configuration Guidelines and Limitations 325
Configuring Session Manager 326
Creating a Session 326
Configuring ACLs in a Session 326
Cisco Nexus 5000 Series Switch CLI Software Configuration Guide
xx OL-16597-01
Contents