Cisco Nexus 7000 Series Installation manual

Cisco Nexus 7000 Series Security Command Reference
First Published: --
Last Modified: --
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

©Cisco Systems, Inc. All rights reserved.

CONTENTS
Preface Preface xxi
Preface xxi
Audience xxi
Document Conventions xxi
Related Documentation xxiv
Documentation Feedback xxv
Obtaining Documentation and Submitting a Service Request xxv
CHAPTER 1 A Commands 1
absolute 3
accept-lifetime 5
access-class 7
action 9
arp access-list 11
authentication (LDAP) 13
aaa accounting default 15
aaa accounting dot1x 17
aaa authentication cts default group 19
aaa authentication dot1x default group 21
aaa authentication eou default group 23
aaa authentication login ascii-authentication 25
aaa authentication login chap enable 26
aaa authentication login console 27
aaa authentication login default 29
aaa authentication login error-enable 31
aaa authentication login invalid-username-log 32
aaa authentication login mschap enable 33
Cisco Nexus 7000 Series Security Command Reference
iii

aaa authentication login mschapv2 enable 34
aaa authentication rejected 35
aaa authorization commands default 37
aaa authorization config-commands default 39
aaa authorization cts default group 41
aaa authorization ssh-certificate 43
aaa authorization ssh-publickey 45
aaa group server ldap 47
aaa group server radius 49
aaa group server tacacs+ 50
aaa user default-role 51
CHAPTER 2 C Commands 53
cipher suite 56
clear access-list counters 58
clear accounting log 60
clear copp statistics 61
clear cts cache 62
clear cts policy 63
capture session 64
cts dot1x 65
class (policy map) 67
class-map type control-plane 69
clear aaa local user blocked 71
clear ldap-server statistics 72
clear mac access-list counters 73
clear port-security 75
clear cts role-based counters 77
clear dot1x 78
clear eou 79
clear hardware rate-limiter 81
clear ip arp inspection log 84
clear ip access-list counters 85
clear ip arp inspection statistics vlan 87
clear ip device tracking 89
Cisco Nexus 7000 Series Security Command Reference
iv
Contents

clear ip dhcp relay statistics 91
clear ip dhcp snooping binding 92
clear ipv6 access-list counters 94
clear ipv6 dhcp relay statistics 96
clear ipv6 dhcp-ldra statistics 97
clear vlan access-list counters 98
conf-offset 100
copp copy profile 102
copp profile 104
CRLLookup 106
crypto ca authenticate 108
crypto ca crl request 110
clear ldap-server statistics 112
clear mac access-list counters 113
clear port-security 115
clear radius-server statistics 117
clear ssh hosts 118
clear tacacs-server statistics 119
clear user 120
cts l3 spi (global) 121
cts l3 spi (interface) 123
crypto ca enroll 125
crypto ca export 127
crypto ca import 129
crypto ca lookup 132
crypto ca remote ldap crl-refresh-time 134
crypto ca remote ldap server-group 135
crypto ca test verify 136
crypto ca trustpoint 137
crypto cert ssh-authorize 139
crypto certificatemap mapname 141
cts cache enable 142
cts device-id 143
cts role-based sgt-map 145
cts sgt 147
Cisco Nexus 7000 Series Security Command Reference
v
Contents

cts l3 spi (global) 148
cts l3 spi (interface) 150
cts l3 spi (interface) 152
cts manual 154
cts refresh environment-data 156
cts refresh role-based-policy 157
cts rekey 158
cts role-based access-list 159
cts role-based counters enable 161
cts role-based detailed-logging 163
cts role-based enforcement 165
cts role-based monitor 167
cts role-based policy priority-static 169
cts role-based sgt 170
cts sxp allow default-route-sgt 172
cts sxp connection peer 173
cts sxp default password 176
cts sxp default source-ip 178
cts sxp enable 179
cts sxp listener hold-time 180
cts sxp mapping network-map 182
cts sxp node-id 183
cts sxp reconcile-period 185
cts sxp retry-period 187
cts sxp speaker hold-time 189
CHAPTER 3 D Commands 191
dot1x max-reauth-req 193
dot1x max-req 195
dot1x pae authenticator 197
dot1x port-control 199
dot1x radius-accounting 201
dot1x re-authentication (EXEC) 202
dot1x re-authentication (global configuration and interface configuration) 203
dot1x system-auth-control 205
Cisco Nexus 7000 Series Security Command Reference
vi
Contents

dot1x timeout quiet-period 206
dot1x timeout ratelimit-period 208
dot1x timeout re-authperiod 210
dot1x timeout server-timeout 212
dot1x timeout supp-timeout 214
dot1x timeout tx-period 216
deadtime 218
delete ca-certificate 220
delete certificate 221
delete crl 223
deny (ARP) 224
deny (IPv4) 228
deny (IPv6) 243
deny (MAC) 259
deny (role-based access control list) 262
description (identity policy) 264
description (user role) 266
destination interface 268
device 270
device-role 272
dot1x default 274
dot1x host-mode 275
dot1x initialize 277
dot1x mac-auth-bypass 278
CHAPTER 4 E Commands 279
encrypt pause-frame 280
encryption decrypt type6 282
encryption delete type6 283
enable 284
enable Cert-DN-match 286
enable secret 288
enable user-server-group 290
encryption re-encrypt obfuscated 292
enrollment terminal 293
Cisco Nexus 7000 Series Security Command Reference
vii
Contents

eou allow clientless 294
eou default 295
eou initialize 296
eou logging 298
eou max-retry 300
eou port 302
eou ratelimit 303
eou revalidate (EXEC) 305
eou revalidate (global configuration and interface configuration) 307
eou timeout 309
eq 312
CHAPTER 5 F Commands 315
feature (user role feature group) 316
feature cts 317
feature dhcp 319
feature dot1x 321
feature eou 322
feature ldap 323
feature mka 325
feature password encryption aes 327
feature port-security 328
feature privilege 330
feature scp-server 332
feature sftp-server 333
feature ssh 334
feature tacacs+ 335
feature telnet 336
filter 337
fips mode enable 339
fragments 341
CHAPTER 6 G Commands 343
gt 344
Cisco Nexus 7000 Series Security Command Reference
viii
Contents

CHAPTER 7 H Commands 347
hardware access-list allow deny ace 348
hardware access-list capture 349
hardware access-list resource feature bank-mapping 351
hardware access-list resource pooling 352
hardware access-list update 354
hardware rate-limiter 356
hop-limit 360
host (IPv4) 362
host (IPv6) 365
CHAPTER 8 I Commands 367
identity policy 369
identity profile eapoudp 370
interface policy deny 371
ip access-class 373
ip access-group 375
ip access-list 378
ip arp inspection filter 380
ip arp inspection log-buffer 382
ip arp inspection trust 384
ip arp inspection validate 385
ip arp inspection vlan 387
ip dhcp packet strict-validation 389
ip dhcp redirect-response 391
ip dhcp relay 392
ip dhcp relay address 394
ip dhcp relay information option 396
ip dhcp relay information option vpn 398
ip dhcp relay subnet-broadcast 400
ip dhcp relay sub-option type cisco 402
ip dhcp smart-relay 404
ip dhcp smart-relay global 406
ip dhcp snooping 408
Cisco Nexus 7000 Series Security Command Reference
ix
Contents

ip dhcp snooping information option 410
ip dhcp snooping trust 412
ip dhcp snooping verify mac-address 414
ip dhcp snooping vlan 416
ip forward-protocol udp 418
ip port access-group 419
ip radius source-interface 422
ip source binding 423
ip tacacs source-interface 425
ip udp relay addrgroup 426
ip udp relay subnet-broadcast 427
ip verify source dhcp-snooping-vlan 429
ip verify unicast source reachable-via 430
ipv6 access-class 432
ipv6 access-class 434
ipv6 access-list 436
ipv6 dhcp-ldra 438
ipv6 dhcp guard policy 439
ipv6 dhcp-ldra (interface) 440
ipv6 dhcp relay 441
ipv6 dhcp-ldra attach policy (interface) 443
ipv6 dhcp-ldra attach-policy vlan 445
ipv6 dhcp relay address 446
ipv6 nd raguard attach-policy 448
ipv6 nd raguard policy 450
ipv6 neighbor binding 452
ipv6 neighbor binding logging 454
ipv6 neighbor binding max-entries 455
ipv6 neighbor tracking 457
ipv6 port traffic-filter 459
ipv6 snooping attach-policy 462
ipv6 traffic-filter 463
CHAPTER 9 K Commands 465
key 466
Cisco Nexus 7000 Series Security Command Reference
x
Contents

key chain 468
key config-key 470
key-octet-string 472
key-server-priority 474
key-string 476
CHAPTER 10 L Commands 479
ldap-server deadtime 480
ldap-server host 481
ldap-server port 484
ldap-server timeout 485
ldap search-map 486
logging drop threshold 488
It 490
CHAPTER 11 M Commands 493
mac access-list 494
mac packet-classify 496
mac port access-group 498
macsec keychain policy 500
macsec policy 502
managed-config-flag 504
match (class-map) 505
match (VLAN access-map) 507
monitor session 509
CHAPTER 12 N Commands 511
nac enable 512
neq 513
CHAPTER 13 O Commands 515
object-group (identity policy) 516
object-group ip address 518
object-group ip port 520
object-group ipv6 address 522
Cisco Nexus 7000 Series Security Command Reference
xi
Contents

object-group udp relay ip address 524
other-config-flag 525
CHAPTER 14 P Commands 527
password secure-mode 528
password strength-check 529
periodic 531
permit (ACL) 534
permit (ARP) 537
permit (IPv4) 541
permit (IPv6) 556
permit (MAC) 572
permit (role-based access control list) 575
permit interface 577
permit vlan 579
permit vrf 581
platform access-list update 583
platform rate-limit 585
police (policy map) 587
policy 590
policy-map type control-plane 592
preference 593
propagate-sgt 594
CHAPTER 15 R Commands 597
radius abort 598
radius commit 599
radius distribute 600
radius-server deadtime 601
radius-server directed-request 603
radius-server host 604
radius-server key 607
radius-server retransmit 609
radius-server test 610
radius-server timeout 612
Cisco Nexus 7000 Series Security Command Reference
xii
Contents

range 613
rate-limit cpu direction 615
remark 617
replay-protection 619
resequence 621
revocation-check 623
role abort 625
role commit 626
role distribute 627
role feature-group name 628
role name 630
router-preference maximum 632
rsakeypair 634
rule 636
CHAPTER 16 S Commands 639
sak-expiry-time 640
sap modelist 642
sap pmk 644
send-lifetime 646
server 648
service dhcp 650
service-policy input 652
set cos 654
set dscp (policy map class) 656
set precedence (policy map class) 659
source-interface 661
ssh 663
ssh key 665
ssh login-attempts 667
ssh server enable 668
ssh6 669
statistics per-entry 671
storm-control level 673
switchport port-security 675
Cisco Nexus 7000 Series Security Command Reference
xiii
Contents

switchport port-security aging type 677
switchport port-security mac-address 679
switchport port-security mac-address sticky 681
switchport port-security maximum 683
switchport port-security violation 685
CHAPTER 17 Show Commands 689
show 694
show aaa accounting 695
show aaa authentication 696
show aaa authorization 698
show aaa groups 700
show aaa local user blocked 701
show aaa user default-role 702
show access-list status module 703
show access-lists 704
show accounting log 707
show arp access-lists 710
show class-map type control-plane 712
show cli syntax roles network-admin 713
show cli syntax roles network-operator 715
show copp diff profile 717
show copp profile 719
show copp status 721
show crypto ca certificates 722
show crypto ca certstore 724
show crypto ca crl 725
show crypto ca remote-certstore 727
show crypto ca trustpoints 728
show crypto certificatemap 729
show crypto key mypubkey rsa 730
show crypto ssh-auth-map 731
show cts 732
show cts capability interface 733
show cts credentials 735
Cisco Nexus 7000 Series Security Command Reference
xiv
Contents

show cts environment-data 736
show cts interface 737
show cts l3 interface 739
show cts l3 mapping 740
show cts pacs 741
show cts propagate-status 742
show cts role-based access-list 744
show cts role-based counters 745
show cts role-based disabled-interface 747
show cts role-based enable 748
show cts role-based policy 749
show cts role-based sgt vlan 751
show cts role-based sgt-map 752
show cts sap pmk 754
show cts sxp 755
show cts sxp connection 758
show data-corruption 759
show dot1x 760
show dot1x all 761
show dot1x interface ethernet 763
show encryption service stat 765
show eou 766
show fips status 768
show hardware access-list feature-combo 769
show hardware rate-limiter 772
show identity policy 776
show identity profile 777
show ip access-lists 778
show ip access-lists capture session 781
show ip arp inspection 782
show ip arp inspection interface 784
show ip arp inspection log 786
show ip arp inspection statistics 787
show ip arp inspection vlan 789
show ip device tracking 791
Cisco Nexus 7000 Series Security Command Reference
xv
Contents

show ip dhcp relay 793
show ip dhcp relay address 795
show ip dhcp relay statistics 797
show ip dhcp snooping 799
show ip dhcp snooping binding 801
show ip dhcp snooping statistics 803
show ip udp relay 805
show ip verify source 807
show ipv6 access-lists 809
show ipv6 dhcp relay 812
show ipv6 dhcp relay statistics 813
show ipv6 dhcp-ldra 814
show ipv6 dhcp guard policy 816
show ipv6 nd raguard policy 818
show ipv6 neighbor binding 819
show ipv6 snooping capture-policy 821
show ipv6 snooping counters 823
show ipv6 snooping features 825
show ipv6 snooping policies 826
show key chain 828
show ldap-search-map 830
show ldap-server 832
show ldap-server groups 833
show ldap-server statistics 834
show mac access-lists 836
show macsec mka 838
show macsec policy 842
show password secure-mode 844
show password strength-check 845
show policy-map interface control-plane 846
show policy-map type control-plane 850
show port-security 851
show port-security address 853
show port-security interface 855
show privilege 857
Cisco Nexus 7000 Series Security Command Reference
xvi
Contents

show radius 858
show radius-server 860
show role 863
show role feature 865
show role feature-group 867
show role pending 870
show role pending-diff 871
show role session 872
show role status 873
show run mka 874
show running-config aaa 876
show running-config aclmgr 877
show running-config copp 880
show running-config cts 882
show running-config dhcp 883
show running-config dot1x 885
show running-config eou 886
show running-config ldap 887
show running-config port-security 888
show running-config radius 889
show running-config security 890
show running-config tacacs+ 891
show security system state 892
show software integrity 893
show ssh key 894
show ssh server 895
show startup-config aaa 896
show startup-config aclmgr 897
show startup-config copp 899
show startup-config dhcp 901
show startup-config dot1x 903
show startup-config eou 904
show startup-config ldap 905
show startup-config port-security 906
show startup-config radius 907
Cisco Nexus 7000 Series Security Command Reference
xvii
Contents

show startup-config security 908
show startup-config tacacs+ 909
show system internal access-list feature bank-chain map 910
show system internal access-list feature bank-class map 912
show system internal access-list globals 914
show system internal pktmgr internal control sw-rate-limit 916
show system internal udp-relay database 917
show tacacs+ 919
show tacacs-server 921
show telnet server 924
show time-range 925
show user-account 927
show username 928
show users 930
show vlan access-list 931
show vlan access-map 933
show vlan filter 935
CHAPTER 18 T Commands 937
tacacs+ abort 938
tacacs+ commit 939
tacacs+ distribute 940
tacacs-server deadtime 941
tacacs-server directed-request 943
tacacs-server host 945
tacacs-server key 948
tacacs-server test 950
tacacs-server timeout 952
telnet 953
telnet server enable 955
telnet6 956
terminal verify-only 958
test aaa authorization command-type 960
time-range 962
trustedCert 964
Cisco Nexus 7000 Series Security Command Reference
xviii
Contents

CHAPTER 19 U Commands 967
user-certdn-match 968
username 970
userprofile 975
user-pubkey-match 977
user-switch-bind 979
use-vrf 981
CHAPTER 20 V Commands 983
vlan access-map 984
vlan filter 986
vlan policy deny 988
vrf policy deny 990
Cisco Nexus 7000 Series Security Command Reference
xix
Contents

Cisco Nexus 7000 Series Security Command Reference
xx
Contents