Cisco Nexus 7000 Series Installation manual

Cisco Nexus 7000 Series Security Command Reference
First Published: --
Last Modified: --
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

©Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface xxi
Preface xxi
Audience xxi
Document Conventions xxi
Related Documentation xxiv
Documentation Feedback xxv
Obtaining Documentation and Submitting a Service Request xxv
CHAPTER 1 A Commands 1
absolute 3
accept-lifetime 5
access-class 7
action 9
arp access-list 11
authentication (LDAP) 13
aaa accounting default 15
aaa accounting dot1x 17
aaa authentication cts default group 19
aaa authentication dot1x default group 21
aaa authentication eou default group 23
aaa authentication login ascii-authentication 25
aaa authentication login chap enable 26
aaa authentication login console 27
aaa authentication login default 29
aaa authentication login error-enable 31
aaa authentication login invalid-username-log 32
aaa authentication login mschap enable 33
Cisco Nexus 7000 Series Security Command Reference
iii

aaa authentication login mschapv2 enable 34
aaa authentication rejected 35
aaa authorization commands default 37
aaa authorization config-commands default 39
aaa authorization cts default group 41
aaa authorization ssh-certificate 43
aaa authorization ssh-publickey 45
aaa group server ldap 47
aaa group server radius 49
aaa group server tacacs+ 50
aaa user default-role 51
CHAPTER 2 C Commands 53
cipher suite 56
clear access-list counters 58
clear accounting log 60
clear copp statistics 61
clear cts cache 62
clear cts policy 63
capture session 64
cts dot1x 65
class (policy map) 67
class-map type control-plane 69
clear aaa local user blocked 71
clear ldap-server statistics 72
clear mac access-list counters 73
clear port-security 75
clear cts role-based counters 77
clear dot1x 78
clear eou 79
clear hardware rate-limiter 81
clear ip arp inspection log 84
clear ip access-list counters 85
clear ip arp inspection statistics vlan 87
clear ip device tracking 89
Cisco Nexus 7000 Series Security Command Reference
iv
Contents

clear ip dhcp relay statistics 91
clear ip dhcp snooping binding 92
clear ipv6 access-list counters 94
clear ipv6 dhcp relay statistics 96
clear ipv6 dhcp-ldra statistics 97
clear vlan access-list counters 98
conf-offset 100
copp copy profile 102
copp profile 104
CRLLookup 106
crypto ca authenticate 108
crypto ca crl request 110
clear ldap-server statistics 112
clear mac access-list counters 113
clear port-security 115
clear radius-server statistics 117
clear ssh hosts 118
clear tacacs-server statistics 119
clear user 120
cts l3 spi (global) 121
cts l3 spi (interface) 123
crypto ca enroll 125
crypto ca export 127
crypto ca import 129
crypto ca lookup 132
crypto ca remote ldap crl-refresh-time 134
crypto ca remote ldap server-group 135
crypto ca test verify 136
crypto ca trustpoint 137
crypto cert ssh-authorize 139
crypto certificatemap mapname 141
cts cache enable 142
cts device-id 143
cts role-based sgt-map 145
cts sgt 147
Cisco Nexus 7000 Series Security Command Reference
v
Contents

cts l3 spi (global) 148
cts l3 spi (interface) 150
cts l3 spi (interface) 152
cts manual 154
cts refresh environment-data 156
cts refresh role-based-policy 157
cts rekey 158
cts role-based access-list 159
cts role-based counters enable 161
cts role-based detailed-logging 163
cts role-based enforcement 165
cts role-based monitor 167
cts role-based policy priority-static 169
cts role-based sgt 170
cts sxp allow default-route-sgt 172
cts sxp connection peer 173
cts sxp default password 176
cts sxp default source-ip 178
cts sxp enable 179
cts sxp listener hold-time 180
cts sxp mapping network-map 182
cts sxp node-id 183
cts sxp reconcile-period 185
cts sxp retry-period 187
cts sxp speaker hold-time 189
CHAPTER 3 D Commands 191
dot1x max-reauth-req 193
dot1x max-req 195
dot1x pae authenticator 197
dot1x port-control 199
dot1x radius-accounting 201
dot1x re-authentication (EXEC) 202
dot1x re-authentication (global configuration and interface configuration) 203
dot1x system-auth-control 205
Cisco Nexus 7000 Series Security Command Reference
vi
Contents

dot1x timeout quiet-period 206
dot1x timeout ratelimit-period 208
dot1x timeout re-authperiod 210
dot1x timeout server-timeout 212
dot1x timeout supp-timeout 214
dot1x timeout tx-period 216
deadtime 218
delete ca-certificate 220
delete certificate 221
delete crl 223
deny (ARP) 224
deny (IPv4) 228
deny (IPv6) 243
deny (MAC) 259
deny (role-based access control list) 262
description (identity policy) 264
description (user role) 266
destination interface 268
device 270
device-role 272
dot1x default 274
dot1x host-mode 275
dot1x initialize 277
dot1x mac-auth-bypass 278
CHAPTER 4 E Commands 279
encrypt pause-frame 280
encryption decrypt type6 282
encryption delete type6 283
enable 284
enable Cert-DN-match 286
enable secret 288
enable user-server-group 290
encryption re-encrypt obfuscated 292
enrollment terminal 293
Cisco Nexus 7000 Series Security Command Reference
vii
Contents

eou allow clientless 294
eou default 295
eou initialize 296
eou logging 298
eou max-retry 300
eou port 302
eou ratelimit 303
eou revalidate (EXEC) 305
eou revalidate (global configuration and interface configuration) 307
eou timeout 309
eq 312
CHAPTER 5 F Commands 315
feature (user role feature group) 316
feature cts 317
feature dhcp 319
feature dot1x 321
feature eou 322
feature ldap 323
feature mka 325
feature password encryption aes 327
feature port-security 328
feature privilege 330
feature scp-server 332
feature sftp-server 333
feature ssh 334
feature tacacs+ 335
feature telnet 336
filter 337
fips mode enable 339
fragments 341
CHAPTER 6 G Commands 343
gt 344
Cisco Nexus 7000 Series Security Command Reference
viii
Contents

CHAPTER 7 H Commands 347
hardware access-list allow deny ace 348
hardware access-list capture 349
hardware access-list resource feature bank-mapping 351
hardware access-list resource pooling 352
hardware access-list update 354
hardware rate-limiter 356
hop-limit 360
host (IPv4) 362
host (IPv6) 365
CHAPTER 8 I Commands 367
identity policy 369
identity profile eapoudp 370
interface policy deny 371
ip access-class 373
ip access-group 375
ip access-list 378
ip arp inspection filter 380
ip arp inspection log-buffer 382
ip arp inspection trust 384
ip arp inspection validate 385
ip arp inspection vlan 387
ip dhcp packet strict-validation 389
ip dhcp redirect-response 391
ip dhcp relay 392
ip dhcp relay address 394
ip dhcp relay information option 396
ip dhcp relay information option vpn 398
ip dhcp relay subnet-broadcast 400
ip dhcp relay sub-option type cisco 402
ip dhcp smart-relay 404
ip dhcp smart-relay global 406
ip dhcp snooping 408
Cisco Nexus 7000 Series Security Command Reference
ix
Contents

ip dhcp snooping information option 410
ip dhcp snooping trust 412
ip dhcp snooping verify mac-address 414
ip dhcp snooping vlan 416
ip forward-protocol udp 418
ip port access-group 419
ip radius source-interface 422
ip source binding 423
ip tacacs source-interface 425
ip udp relay addrgroup 426
ip udp relay subnet-broadcast 427
ip verify source dhcp-snooping-vlan 429
ip verify unicast source reachable-via 430
ipv6 access-class 432
ipv6 access-class 434
ipv6 access-list 436
ipv6 dhcp-ldra 438
ipv6 dhcp guard policy 439
ipv6 dhcp-ldra (interface) 440
ipv6 dhcp relay 441
ipv6 dhcp-ldra attach policy (interface) 443
ipv6 dhcp-ldra attach-policy vlan 445
ipv6 dhcp relay address 446
ipv6 nd raguard attach-policy 448
ipv6 nd raguard policy 450
ipv6 neighbor binding 452
ipv6 neighbor binding logging 454
ipv6 neighbor binding max-entries 455
ipv6 neighbor tracking 457
ipv6 port traffic-filter 459
ipv6 snooping attach-policy 462
ipv6 traffic-filter 463
CHAPTER 9 K Commands 465
key 466
Cisco Nexus 7000 Series Security Command Reference
x
Contents