Cisco Nexus 5500 Series Installation manual

Cisco Systems, Inc.
www.cisco.com
Cisco has more than 200 offices worldwide. 
Addresses, phone numbers, and fax numbers 
are listed on the Cisco website at 
www.cisco.com/go/offices.
Cisco Nexus 5500 Series NX-OS Security
Command Reference
Cisco NX-OS Releases 6.x
First Published: September 2012
Last Modified: October 4, 2013
Text Part Number: OL-27883-02

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL
STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT
WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT
SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE
OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public
domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH
ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF
DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING,
WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO
OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this
URL: www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership
relationship between Cisco and any other company. (1110R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display
output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in
illustrative content is unintentional and coincidental.
Cisco Nexus 5500 Series NX-OS Security Command Reference 
© 2013 Cisco Systems, Inc. All rights reserved.

iii
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
CONTENTS
Preface ix
Audience ix
Document Conventions ix
Related Documentation x
Documentation Feedback xi
Obtaining Documentation and Submitting a Service Request xi
xi
New and Changed Information xiii
New and Changed Information for Cisco NX-OS Releases xiii
New and Changed Information for Cisco NX-OS Release 6.0(2)N2(2) xiii
New and Changed Information for Cisco NX-OS Release 6.0(2)N1(2) xiii
A Commands 1
aaa accounting default 2
aaa authentication login console 3
aaa authentication login default 5
aaa authentication login error-enable 7
aaa authentication login mschap enable 8
aaa authorization commands default 9
aaa authorization config-commands default 11
aaa authorization ssh-certificate 13
aaa authorization ssh-publickey 15
aaa group server radius 17
aaa user default-role 18
action 19
C Commands 21
checkpoint 22
clear access-list counters 24
clear accounting log 25
clear checkpoint database 26
clear ip arp 27

Contents
iv
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
clear ip arp inspection log 28
clear ip arp inspection statistics vlan 29
clear ip dhcp snooping binding 30
clear ip dhcp snooping statistics 32
cts role-based batched-programming 33
D Commands 35
deadtime 36
deny (ARP) 38
deny icmp (IPv4) 40
deny igmp (IPv4) 46
deny ip (IPv4) 50
deny tcp (IPv4) 54
deny udp (IPv4) 60
deny icmp (IPv6) 66
deny ipv6 (IPv6) 70
deny sctp (IPv6) 74
deny tcp (IPv6) 79
deny udp (IPv6) 85
deny (MAC) 90
description (user role) 93
E Commands 95
enable 96
enable secret 97
F Commands 99
feature (user role feature group) 100
feature dhcp 101
feature http-server 103
feature port-security 105
feature privilege 107
feature tacacs+ 108
I Commands 109
interface policy deny 110
ip access-class 111
ip access-group 113

Contents
v
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
ip access-list 115
ip arp event-history errors 117
ip arp inspection log-buffer 118
ip arp inspection validate 119
ip arp inspection vlan 121
ip arp inspection trust 123
ip dhcp packet strict-validation 124
ip dhcp snooping 125
ip dhcp snooping information option 126
ip dhcp snooping trust 127
ip dhcp snooping verify mac-address 128
ip dhcp snooping vlan 129
ip port access-group 130
ip source binding 132
ip verify source dhcp-snooping-vlan 134
ip verify unicast source reachable-via 136
ipv6 access-class 138
ipv6 access-list 140
ipv6 port traffic-filter 141
ipv6 traffic-filter 143
M Commands 145
mac access-list 146
mac port access-group 148
match 150
P Commands 153
permit (ARP) 154
permit icmp (IPv4) 156
permit igmp (IPv4) 162
permit ip (IPv4) 166
permit tcp (IPv4) 170
permit udp (IPv4) 176
permit icmp (IPv6) 183
permit ipv6 (IPv6) 188
permit sctp (IPv6) 192
permit tcp (IPv6) 197

Contents
vi
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
permit udp (IPv6) 203
permit (MAC) 209
permit interface 212
permit vlan 214
permit vrf 216
permit vsan 217
R Commands 219
radius-server deadtime 220
radius-server directed-request 221
radius-server host 222
radius-server key 224
radius-server retransmit 225
radius-server timeout 226
remark 227
resequence 229
role feature-group name 231
role name 232
rollback running-config 234
rule 236
S Commands 239
server 240
ssh 242
ssh6 243
ssh key 244
ssh server enable 246
storm-control level 247
Show Commands 249
show aaa accounting 250
show aaa authentication 251
show aaa authorization 252
show aaa groups 253
show aaa user 254
show access-lists 255
show accounting log 257

Contents
vii
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
show checkpoint 259
show checkpoint summary 262
show checkpoint system 264
show checkpoint user 265
show diff rollback-patch checkpoint 267
show diff rollback-patch file 269
show diff rollback-patch running-config 271
show diff rollback-patch startup-config 274
show http-server 277
show ip access-lists 278
show ip arp 280
show ip arp inspection 283
show ip arp inspection interfaces 284
show ip arp inspection log 285
show ip arp inspection statistics 286
show ip arp inspection vlan 287
show ip arp sync-entries 288
show ip dhcp snooping 289
show ip dhcp snooping binding 290
show ip dhcp snooping statistics 292
show ipv6 access-lists 293
show ip verify source 295
show mac access-lists 297
show privilege 298
show radius-server 299
show role 302
show role feature 306
show role feature-group 309
show rollback log 310
show running-config aaa 312
show running-config aclmgr 313
show running-config arp 315
show running-config dhcp 317
show running-config radius 319
show running-config security 320

Contents
viii
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
show ssh key 322
show ssh server 323
show startup-config aaa 324
show startup-config aclmgr 325
show startup-config arp 327
show startup-config dhcp 328
show startup-config radius 330
show startup-config security 331
show tacacs-server 332
show telnet server 334
show user-account 335
show users 336
show vlan access-list 337
show vlan access-map 338
show vlan filter 339
T Commands 341
tacacs-server deadtime 342
tacacs-server directed-request 343
tacacs-server host 344
tacacs-server key 346
tacacs-server timeout 347
telnet 348
telnet server enable 349
telnet6 350
U Commands 351
use-vrf 352
username 354
V Commands 357
vlan access-map 358
vlan filter 359
vlan policy deny 361
vrf policy deny 362
vsan policy deny 363

ix
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
Preface
This preface describes the audience, organization, and conventions of the Cisco Nexus 5500 Series
NX-OS Security Command Reference. It also provides information on how to obtain related
documentation.
This preface includes the following sections:
•Audience, page ix
•Document Conventions, page ix
•Related Documentation, page x
•Obtaining Documentation and Submitting a Service Request, page xi
•Obtaining Documentation and Submitting a Service Request, page xi
Audience
This publication is for experienced users who configure and maintain Cisco NX-OS devices.
Document Conventions
Command descriptions use these conventions:
Convention Description
boldface font Commands and keywords are in boldface.
italic font Arguments for which you supply values are in italics.
[ ] Elements in square brackets are optional.
{x | y | z} Alternative keywords are grouped in braces and separated by vertical bars.
[ x | y | z ] Optional alternative keywords are grouped in brackets and separated by vertical
bars.
string A nonquoted set of characters. Do not use quotation marks around the string or
the string will include the quotation marks.

x
Cisco Nexus 5500 Series NX-OS Security Command Reference
OL-27883-02
Chapter
Screen examples use these conventions:
This document uses the following conventions:
Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the
manual.
Caution Means reader be careful. In this situation, you might do something that could result in equipment damage
or loss of data.
Related Documentation
Documentation for Cisco Nexus 5000 Series Switches and Cisco Nexus 2000 Series Fabric Extenders is
available at the following URL:
http://www.cisco.com/en/US/products/ps9670/tsd_products_support_series_home.html
The documentation set includes the following types of documents:
•Licensing Information Guide
•Release Notes
•Installation and Upgrade Guides
•Configuration Guides
•Configuration Examples and TechNotes
•Programming Guides
•Operations Guides
•Error and System Message Guides
•Field Notices
•Security Advisories, Responses and Notices
•Troubleshooting Guide
•Command References
•MIB Reference Guide
screen font Terminal sessions and information that the switch displays are in screen font.
boldface screen
font
Information you must enter is in boldface screen font.
italic screen font Arguments for which you supply values are in italic screen font.
< > Nonprinting characters, such as passwords, are in angle brackets.
[ ] Default responses to system prompts are in square brackets.
!, # An exclamation point (!) or a pound sign (#) at the beginning of a line of code
indicates a comment line.