Cisco Nexus 9000 Series User manual

Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release
9.x
First Published: 2018-07-17
Last Modified: 2018-11-05
Americas Headquarters
Cisco Systems, Inc.
170 West Tasman Drive
San Jose, CA 95134-1706
USA
http://www.cisco.com
Tel: [phone]
800 553-NETS (6387)
Fax: [phone]

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS,
INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND,
EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.
THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH
THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY,
CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.
The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB's public domain version of
the UNIX operating system. All rights reserved. Copyright ©1981, Regents of the University of California.
NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS" WITH ALL FAULTS.
CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.
IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT
LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS
HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network
topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional
and coincidental.
This product includes cryptographic software written by Eric Young ([email protected]).
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit. (https://www.openssl.org/)
This product includes software written by Tim Hudson ([email protected]).
Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL:
https://www.cisco.com/go/trademarks. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship
between Cisco and any other company. (1110R)
©2018 Cisco Systems, Inc. All rights reserved.

CONTENTS
?
Preface xxv
PREFACE
Audience xxv
Document Conventions xxv
Related Documentation for Cisco Nexus 9000 Series Switches xxvi
Documentation Feedback xxvi
Obtaining Documentation and Submitting a Service Request xxvi
New and Changed Information 1
CHAPTER 1
New and Changed Information 1
Overview 3
CHAPTER 2
Authentication, Authorization, and Accounting 3
RADIUS and TACACS+ Security Protocols 4
LDAP 5
SSH and Telnet 5
User Accounts and Roles 5
IP ACLs 5
MAC ACLs 6
VACLs 6
DHCP Snooping 6
Dynamic ARP Inspection 6
IP Source Guard 7
Password Encryption 7
Keychain Management 7
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
iii

Traffic Storm Control 7
Control Plane Policing 8
Rate Limits 8
Software Image 8
Virtual Device Contexts 8
Configuring AAA 9
CHAPTER 3
About AAA 9
AAA Security Services 9
Benefits of Using AAA 10
Remote AAA Services 10
AAA Server Groups 11
AAA Service Configuration Options 11
Authentication and Authorization Process for User Login 12
AES Password Encryption and Master Encryption Keys 13
Licensing Requirements for AAA 13
Prerequisites for AAA 14
Guidelines and Limitations for AAA 14
Default Settings for AAA 14
Configuring AAA 15
Process for Configuring AAA 15
Configuring Console Login Authentication Methods 15
Configuring Default Login Authentication Methods 17
Disabling Fallback to Local Authentication 19
Enabling the Default User Role for AAA Authentication 20
Enabling Login Authentication Failure Messages 21
Logging Successful and Failed Login Attempts 22
Enabling CHAP Authentication 23
Enabling MSCHAP or MSCHAP V2 Authentication 24
Configuring AAA Accounting Default Methods 26
Using AAA Server VSAs with Cisco NX-OS Devices 28
About VSAs 28
VSA Format 28
Specifying Cisco NX-OS User Roles and SNMPv3 Parameters on AAA Servers 29
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
iv
Contents

Configuring Secure Login Features 29
Configuring Login Parameters 29
Restricting User Login Sessions 30
Restricting the Password Length 31
Enabling the Password Prompt for the Username 32
Configuring the Shared Secret for RADIUS or TACACS+ 33
Monitoring and Clearing the Local AAA Accounting Log 34
Verifying the AAA Configuration 34
Configuration Examples for AAA 35
Configuration Examples for Login Parameters 35
Configuration Examples for the Password Prompt Feature 36
Additional References for AAA 37
Configuring RADIUS 39
CHAPTER 4
About RADIUS 39
RADIUS Network Environments 39
RADIUS Operation 40
RADIUS Server Monitoring 40
Vendor-Specific Attributes 41
Licensing Requirements for RADIUS 42
Prerequisites for RADIUS 42
Guidelines and Limitations for RADIUS 42
Default Settings for RADIUS 43
Configuring RADIUS Servers 43
RADIUS Server Configuration Process 44
Configuring RADIUS Server Hosts 44
Configuring Global RADIUS Keys 46
Configuring a Key for a Specific RADIUS Server 47
Configuring RADIUS Server Groups 48
Configuring the Global Source Interface for RADIUS Server Groups 50
Allowing Users to Specify a RADIUS Server at Login 51
Configuring the Global RADIUS Transmission Retry Count and Timeout Interval 52
Configuring the RADIUS Transmission Retry Count and Timeout Interval for a Server 53
Configuring Accounting and Authentication Attributes for RADIUS Servers 55
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
v
Contents

Configuring Global Periodic RADIUS Server Monitoring 57
Configuring Periodic RADIUS Server Monitoring on Individual Servers 58
Configuring the RADIUS Dead-Time Interval 60
Configuring One-Time Passwords 61
Manually Monitoring RADIUS Servers or Groups 62
Verifying the RADIUS Configuration 62
Monitoring RADIUS Servers 63
Clearing RADIUS Server Statistics 63
Configuration Example for RADIUS 64
Where to Go Next 64
Additional References for RADIUS 64
Configuring TACACS+ 67
CHAPTER 5
About TACACS+ 67
TACACS+ Advantages 67
TACACS+ Operation for User Login 68
Default TACACS+ Server Encryption Type and Secret Key 69
Command Authorization Support for TACACS+ Servers 69
TACACS+ Server Monitoring 69
Vendor-Specific Attributes for TACACS+ 70
Cisco VSA Format for TACACS+ 70
Licensing Requirements for TACACS+ 71
Prerequisites for TACACS+ 71
Guidelines and Limitations for TACACS+ 71
Default Settings for TACACS+ 72
Configuring TACACS+ 72
TACACS+ Server Configuration Process 72
Enabling TACACS+ 73
Configuring TACACS+ Server Hosts 73
Configuring Global TACACS+ Keys 75
Configuring a Key for a Specific TACACS+ Server 76
Configuring TACACS+ Server Groups 77
Configuring the Global Source Interface for TACACS+ Server Groups 79
Allowing Users to Specify a TACACS+ Server at Login 79
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
vi
Contents

Configuring the Timeout Interval for a TACACS+ Server 81
Configuring TCP Ports 82
Configuring Global Periodic TACACS+ Server Monitoring 83
Configuring Periodic TACACS+ Server Monitoring on Individual Servers 85
Configuring the TACACS+ Dead-Time Interval 87
Configuring ASCII Authentication 88
Configuring AAA Authorization on TACACS+ Servers 89
Configuring Command Authorization on TACACS+ Servers 90
Testing Command Authorization on TACACS+ Servers 92
Enabling and Disabling Command Authorization Verification 93
Configuring Privilege Level Support for Authorization on TACACS+ Servers 94
Permitting or Denying Commands for Users of Privilege Roles 96
Manually Monitoring TACACS+ Servers or Groups 97
Disabling TACACS+ 98
Monitoring TACACS+ Servers 99
Clearing TACACS+ Server Statistics 99
Verifying the TACACS+ Configuration 100
Configuration Examples for TACACS+ 100
Where to Go Next 102
Additional References for TACACS+ 102
Configuring LDAP 105
CHAPTER 6
About LDAP 105
LDAP Authentication and Authorization 105
LDAP Operation for User Login 106
LDAP Server Monitoring 107
Vendor-Specific Attributes for LDAP 107
Cisco VSA Format for LDAP 107
Virtualization Support for LDAP 108
Licensing Requirements for LDAP 108
Prerequisites for LDAP 108
Guidelines and Limitations for LDAP 108
Default Settings for LDAP 109
Configuring LDAP 109
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
vii
Contents

LDAP Server Configuration Process 109
Enabling or Disabling LDAP 110
Configuring LDAP Server Hosts 111
Configuring the RootDN for an LDAP Server 112
Configuring LDAP Server Groups 113
Configuring the Global LDAP Timeout Interval 115
Configuring the Timeout Interval for an LDAP Server 116
Configuring TCP Ports 117
Configuring LDAP Search Maps 118
Configuring Periodic LDAP Server Monitoring 119
Configuring the LDAP Dead-Time Interval 120
Configuring AAA Authorization on LDAP Servers 121
Monitoring LDAP Servers 122
Clearing LDAP Server Statistics 123
Verifying the LDAP Configuration 123
Configuration Examples for LDAP 124
Where to Go Next 124
Additional References for LDAP 125
Configuring SSH and Telnet 127
CHAPTER 7
About SSH and Telnet 127
SSH Server 127
SSH Client 127
SSH Server Keys 128
SSH Authentication Using Digital Certificates 128
Telnet Server 129
Licensing Requirements for SSH and Telnet 129
Prerequisites for SSH and Telnet 129
Guidelines and Limitations for SSH and Telnet 129
Default Settings for SSH and Telnet 130
Configuring SSH 130
Generating SSH Server Keys 130
Specifying the SSH Public Keys for User Accounts 132
Specifying the SSH Public Keys in IETF SECSH Format 132
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
viii
Contents

Specifying the SSH Public Keys in OpenSSH Format 133
Configuring a Maximum Number of SSH Login Attempts 134
Starting SSH Sessions 135
Starting SSH Sessions from Boot Mode 136
Configuring SSH Passwordless File Copy 136
Configuring SCP and SFTP Servers 138
Configuring X.509v3 Certificate-Based SSH Authentication 139
Configuring Legacy SSH Algorithm Support 141
Changing the Default SSH Server Port 143
Clearing SSH Hosts 144
Disabling the SSH Server 145
Deleting SSH Server Keys 145
Clearing SSH Sessions 146
Configuring Telnet 147
Enabling the Telnet Server 147
Starting Telnet Sessions to Remote Devices 148
Clearing Telnet Sessions 149
Verifying the SSH and Telnet Configuration 149
Configuration Example for SSH 150
Configuration Example for SSH Passwordless File Copy 151
Configuration Example for X.509v3 Certificate-Based SSH Authentication 153
Additional References for SSH and Telnet 153
Configuring User Accounts and RBAC 155
CHAPTER 8
About User Accounts and RBAC 155
User Accounts 155
Characteristics of Strong Passwords 156
User Roles 156
User Role Rules 157
Licensing Requirements for User Accounts and RBAC 158
Guidelines and Limitations for User Accounts and RBAC 158
Default Settings for User Accounts and RBAC 159
Enabling Password-Strength Checking 159
Configuring User Accounts 160
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
ix
Contents

Configuring Roles 162
Creating User Roles and Rules 162
Creating Feature Groups 165
Changing User Role Interface Policies 166
Changing User Role VLAN Policies 167
Changing User Role VRF Policies 169
About No Service Password-Recovery 171
Enabling No Service Password-Recovery 171
Verifying User Accounts and RBAC Configuration 172
Configuration Examples for User Accounts and RBAC 173
Additional References for User Accounts and RBAC 174
Configuring 802.1X 177
CHAPTER 9
About 802.1X 177
Device Roles 177
Authentication Initiation and Message Exchange 178
Authenticator PAE Status for Interfaces 180
Ports in Authorized and Unauthorized States 180
MAC Authentication Bypass 181
Dynamic VLAN Assignment based on MAC-Based Authentication (MAB) 181
VLAN Assignment from RADIUS 182
Single Host and Multiple Hosts Support 182
Supported Topology 182
Licensing Requirements for 802.1X 183
Prerequisites for 802.1X 183
802.1X Guidelines and Limitations 183
Default Settings for 802.1X 185
Configuring 802.1X 186
Process for Configuring 802.1X 186
Enabling the 802.1X Feature 186
Configuring AAA Authentication Methods for 802.1X 187
Controlling 802.1X Authentication on an Interface 188
Creating or Removing an Authenticator PAE on an Interface 190
Enabling Periodic Reauthentication for an Interface 191
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
x
Contents

Manually Reauthenticating Supplicants 192
Manually Initializing 802.1X Authentication 192
Changing 802.1X Authentication Timers for an Interface 193
Enabling MAC Authentication Bypass 195
Enabling Single Host or Multiple Hosts Mode 196
Disabling 802.1X Authentication on the Cisco NX-OS Device 198
Disabling the 802.1X Feature 199
Resetting the 802.1X Interface Configuration to the Default Values 200
Setting the Maximum Authenticator-to-Supplicant Frame for an Interface 201
Enabling RADIUS Accounting for 802.1X Authentication 202
Configuring AAA Accounting Methods for 802.1X 203
Setting the Maximum Reauthentication Retry Count on an Interface 204
Verifying the 802.1X Configuration 205
802.1X Support for VXLAN EVPN 205
Guidelines and Limitations for 802.1X Support for VXLAN EVPN 205
Configuring 802.1X Support for VXLAN EVPN 206
Verifying the 802.1X Support for VXLAN EVPN 207
Monitoring 802.1X 210
Configuration Example for 802.1X 210
Additional References for 802.1X 211
Configuring IP ACLs 213
CHAPTER 10
About ACLs 213
ACL Types and Applications 214
Order of ACL Application 215
About Rules 216
Protocols for IP ACLs and MAC ACLs 216
Source and Destination 217
Implicit Rules for IP and MAC ACLs 217
Additional Filtering Options 217
Sequence Numbers 218
Logical Operators and Logical Operation Units 219
IPv4 ACL Logging 219
Time Ranges 219
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xi
Contents

Policy-Based ACLs 221
Statistics and ACLs 222
Atomic ACL Updates 222
Session Manager Support for IP ACLs 223
ACL TCAM Regions 223
Licensing Requirements for IP ACLs 228
Prerequisites for IP ACLs 229
Guidelines and Limitations for IP ACLs 229
Default Settings for IP ACLs 233
Configuring IP ACLs 233
Creating an IP ACL 233
Changing an IP ACL 235
Creating a VTY ACL 237
Changing Sequence Numbers in an IP ACL 238
Removing an IP ACL 239
Configuring ACL TCAM Region Sizes 240
Using Templates to Configure ACL TCAM Region Sizes 249
Configuring TCAM Carving 250
Configuring UDF-Based Port ACLs 257
Applying an IP ACL as a Router ACL 259
Applying an IP ACL as a Port ACL 260
Applying an IP ACL as a VACL 262
Configuring IPv4 ACL Logging 262
Configuring ACLs Using HTTP Methods to Redirect Requests 264
Verifying the IP ACL Configuration 267
Monitoring and Clearing IP ACL Statistics 269
Configuration Examples for IP ACLs 269
About System ACLs 270
Carving a TCAM Region 271
Configuring System ACLs 271
Configuration and Show Command Examples for the System ACLs 272
Configuring Object Groups 274
Session Manager Support for Object Groups 274
Creating and Changing an IPv4 Address Object Group 274
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xii
Contents

Creating and Changing an IPv6 Address Object Group 275
Creating and Changing a Protocol Port Object Group 277
Removing an Object Group 278
Verifying the Object-Group Configuration 279
Configuring Time-Ranges 279
Session Manager Support for Time-Ranges 279
Creating a Time-Range 279
Changing a Time-Range 281
Removing a Time-Range 282
Changing Sequence Numbers in a Time Range 283
Verifying the Time-Range Configuration 284
Additional References for IP ACLs 284
Configuring MAC ACLs 285
CHAPTER 11
About MAC ACLs 285
MAC Packet Classification 285
Licensing Requirements for MAC ACLs 286
Guidelines and Limitations for MAC ACLs 286
Default Settings for MAC ACLs 286
Configuring MAC ACLs 287
Creating a MAC ACL 287
Changing a MAC ACL 288
Changing Sequence Numbers in a MAC ACL 289
Removing a MAC ACL 290
Applying a MAC ACL as a Port ACL 290
Applying a MAC ACL as a VACL 291
Enabling or Disabling MAC Packet Classification 291
Verifying the MAC ACL Configuration 293
Monitoring and Clearing MAC ACL Statistics 293
Configuration Example for MAC ACLs 294
Additional References for MAC ACLs 294
Configuring VLAN ACLs 295
CHAPTER 12
About VLAN ACLs 295
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xiii
Contents

VLAN Access Maps and Entries 295
VACLs and Actions 295
VACL Statistics 296
Session Manager Support for VACLs 296
Licensing Requirements for VACLs 296
Prerequisites for VACLs 296
Guidelines and Limitations for VACLs 297
Default Settings for VACLs 297
Configuring VACLs 298
Creating a VACL or Adding a VACL Entry 298
Removing a VACL or a VACL Entry 299
Applying a VACL to a VLAN 300
Verifying the VACL Configuration 301
Monitoring and Clearing VACL Statistics 301
Configuration Example for VACLs 302
Additional References for VACLs 302
Configuring Port Security 303
CHAPTER 13
About Port Security 303
Secure MAC Address Learning 303
Static Method 304
Dynamic Method 304
Sticky Method 304
Dynamic Address Aging 305
Secure MAC Address Maximums 305
Security Violations and Actions 306
Port Security and Port Types 307
Port Security and Port-Channel Interfaces 307
Port Type Changes 309
Licensing Requirements for Port Security 309
Prerequisites for Port Security 309
Default Settings for Port Security 309
Guidelines and Limitations for Port Security 310
Guidelines and Limitations for Port Security on vPCs 310
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xiv
Contents

Configuring Port Security 311
Enabling or Disabling Port Security Globally 311
Enabling or Disabling Port Security on a Layer 2 Interface 312
Enabling or Disabling Sticky MAC Address Learning 313
Adding a Static Secure MAC Address on an Interface 314
Removing a Static Secure MAC Address on an Interface 316
Removing a Sticky Secure MAC Address 317
Removing a Dynamic Secure MAC Address 318
Configuring a Maximum Number of MAC Addresses 319
Configuring an Address Aging Type and Time 320
Configuring a Security Violation Action 322
Verifying the Port Security Configuration 323
Displaying Secure MAC Addresses 323
Configuration Example for Port Security 323
Configuration Examples for Port Security in a vPC Domain 324
Example: Configuring Port Security on an Orphan Port 324
Example: Configuring Port Security on the vPC Leg 324
Additional References for Port Security 325
Configuring DHCP 327
CHAPTER 14
About DHCP Snooping 327
Trusted and Untrusted Sources 328
DHCP Snooping Binding Database 328
DHCP Snooping in a vPC Environment 329
Synchronizing DHCP Snooping Binding Entries 329
Packet Validation 329
DHCP Snooping Option 82 Data Insertion 330
About the DHCP Relay Agent 331
DHCP Relay Agent 331
DHCP Relay Agent Option 82 331
VRF Support for the DHCP Relay Agent 333
DHCP Smart Relay Agent 334
About the DHCPv6 Relay Agent 334
DHCPv6 Relay Agent 334
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xv
Contents

VRF Support for the DHCPv6 Relay Agent 334
About DHCP Client 334
Licensing Requirements for DHCP 335
Prerequisites for DHCP 335
Guidelines and Limitations for DHCP 335
Default Settings for DHCP 336
Configuring DHCP 337
Minimum DHCP Configuration 337
Enabling or Disabling the DHCP Feature 337
Configuring DHCP Snooping 338
Enabling or Disabling DHCP Snooping Globally 338
Enabling or Disabling DHCP Snooping on a VLAN 339
Enabling or Disabling DHCP Snooping MAC Address Verification 340
Enabling or Disabling Option 82 Data Insertion and Removal 341
Enabling or Disabling Strict DHCP Packet Validation 343
Configuring an Interface as Trusted or Untrusted 344
Enabling or Disabling DHCP Relay Trusted Port Functionality 345
Configuring an Interface as a DHCP Relay Trusted or Untrusted Port 346
Configuring all Interfaces as Trusted or Untrusted 347
Enabling or Disabling the DHCP Relay Agent 348
Enabling or Disabling Option 82 for the DHCP Relay Agent 349
Enabling or Disabling VRF Support for the DHCP Relay Agent 350
Configuring DHCP Server Addresses on an Interface 351
Configuring the DHCP Relay Source Interface 353
Enabling or Disabling DHCP Smart Relay Globally 354
Enabling or Disabling DHCP Smart Relay on a Layer 3 Interface 355
Configuring DHCPv6 356
Enabling or Disabling the DHCPv6 Relay Agent 356
Enabling or Disabling VRF Support for the DHCPv6 Relay Agent 357
Configuring DHCPv6 Server Addresses on an Interface 358
Configuring the DHCPv6 Relay Source Interface 360
Configuring IPv6 RA Guard 361
Enabling DHCP Client 362
Verifying the DHCP Configuration 364
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xvi
Contents

Displaying IPv6 RA Guard Statistics 364
Displaying DHCP Snooping Bindings 364
Clearing the DHCP Snooping Binding Database 365
Monitoring DHCP 365
Clearing DHCP Snooping Statistics 365
Clearing DHCP Relay Statistics 365
Clearing DHCPv6 Relay Statistics 365
Configuration Examples for DHCP 366
Configuration Examples for DHCP Client 366
Additional References for DHCP 367
Configuring IPv6 First Hop Security 369
CHAPTER 15
Introduction to First-Hop Security 369
IPv6 Global Policies 370
IPv6 First-Hop Security Binding Table 370
Guidelines and Limitations of First Hop Security 370
About vPC First Hop Security Configuration 371
DHCP Relay On-stack 371
DHCP Relay on VPC Leg 372
DHCP Client Relay on Orphan Ports 373
RA Guard 374
Overview of IPv6 RA Guard 374
Guidelines and Limitations of IPv6 RA Guard 375
DHCPv6 Guard 375
Overview of DHCP—DHCPv6 Guard 375
Limitation of DHCPv6 Guard 375
IPv6 Snooping 376
Overview of IPv6 Snooping 376
Guidelines and Limitations for IPv6 Snooping 376
How to Configure IPv6 FHS 377
Configuring the IPv6 RA Guard Policy on the Device 377
Configuring IPv6 RA Guard on an Interface 378
Configuring DHCP—DHCPv6 Guard 380
Configuring IPv6 Snooping 382
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xvii
Contents

Verifying and Troubleshooting IPv6 Snooping 385
Configuration Examples 386
Example: IPv6 RA Guard Configuration 386
Example: Configuring DHCP—DHCPv6 Guard 386
Example: Configuring IPv6 First-Hop Security Binding Table 386
Example: Configuring IPv6 Snooping 387
Additional References for IPv6 First-Hop Security 387
Configuring Dynamic ARP Inspection 389
CHAPTER 16
About DAI 389
ARP 389
ARP Spoofing Attacks 389
DAI and ARP Spoofing Attacks 390
Interface Trust States and Network Security 391
Logging DAI Packets 392
Licensing Requirements for DAI 392
Prerequisites for DAI 392
Guidelines and Limitations for DAI 393
Default Settings for DAI 393
Configuring DAI 394
Enabling or Disabling DAI on VLANs 394
Configuring the DAI Trust State of a Layer 2 Interface 395
Enabling or Disabling Additional Validation 396
Configuring the DAI Logging Buffer Size 397
Configuring DAI Log Filtering 398
Verifying the DAI Configuration 399
Monitoring and Clearing DAI Statistics 399
Configuration Examples for DAI 400
Two Devices Support DAI 400
Configuring Device A 400
Configuring Device B 402
Additional References for DAI 404
Related Documents 404
Standards 404
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xviii
Contents

Configuring IP Source Guard 405
CHAPTER 17
About IP Source Guard 405
Licensing Requirements for IP Source Guard 406
Prerequisites for IP Source Guard 406
Guidelines and Limitations for IP Source Guard 406
Default Settings for IP Source Guard 407
Configuring IP Source Guard 407
Enabling or Disabling IP Source Guard on a Layer 2 Interface 407
Adding or Removing a Static IP Source Entry 408
Configuring IP Source Guard for Trunk Ports 409
Displaying IP Source Guard Bindings 410
Clearing IP Source Guard Statistics 410
Configuration Example for IP Source Guard 410
Additional References 411
Related Documents 411
Configuring Password Encryption 413
CHAPTER 18
About AES Password Encryption and Master Encryption Keys 413
Licensing Requirements for Password Encryption 413
Guidelines and Limitations for Password Encryption 414
Default Settings for Password Encryption 414
Configuring Password Encryption 414
Configuring a Master Key and Enabling the AES Password Encryption Feature 414
Converting Existing Passwords to Type-6 Encrypted Passwords 416
Converting Type-6 Encrypted Passwords Back to Their Original States 416
Deleting Type-6 Encrypted Passwords 416
Verifying the Password Encryption Configuration 417
Configuration Examples for Password Encryption 417
Configuring Keychain Management 419
CHAPTER 19
About Keychain Management 419
Lifetime of a Key 419
Licensing Requirements for Keychain Management 420
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xix
Contents

Prerequisites for Keychain Management 420
Guidelines and Limitations for Keychain Management 420
Default Settings for Keychain Management 421
Configuring Keychain Management 421
Creating a Keychain 421
Removing a Keychain 422
Configuring a Master Key and Enabling the AES Password Encryption Feature 423
Configuring Text for a Key 424
Configuring Accept and Send Lifetimes for a Key 425
Configuring a Key for OSPFv2 Cryptographic Authentication 427
Determining Active Key Lifetimes 428
Verifying the Keychain Management Configuration 428
Configuration Example for Keychain Management 429
Where to Go Next 429
Additional References for Keychain Management 429
Configuring Traffic Storm Control 431
CHAPTER 20
About Traffic Storm Control 431
Licensing Requirements for Traffic Storm Control 432
Guidelines and Limitations for Traffic Storm Control 433
Default Settings for Traffic Storm Control 434
Configuring Traffic Storm Control 434
Verifying Traffic Storm Control Configuration 436
Monitoring Traffic Storm Control Counters 436
Configuration Examples for Traffic Storm Control 436
Additional References for Traffic Storm Control 437
Configuring Unicast RPF 439
CHAPTER 21
About Unicast RPF 439
Unicast RPF Process 440
Licensing Requirements for Unicast RPF 441
Guidelines and Limitations for Unicast RPF 441
Default Settings for Unicast RPF 442
Configuring Unicast RPF for Cisco Nexus 9500 Switches with -R Line Cards 443
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
xx
Contents