I85PREP
⌘ K
Cisco 300-625 DCSAN study materials
Cisco 300-625 DCSAN study resources

Shared Admin Account and VSAN-Scoped RBAC on MDS 9396S

Cisco 300-625 DCSAN · Put your knowledge to work in context.

All case studies

Shared Admin Account and VSAN-Scoped RBAC on MDS 9396S

A storage team runs eight Cisco MDS 9396S switches on NX-OS 9.3(8). An audit found that every administrator uses one shared local account with the network-admin role, although two TACACS+ servers (10.10.10.21 and 10.10.10.22) are configured in the running configuration. The switch still authenticates with aaa authentication login default local. NTP is not configured, and switch clocks differ by up to seven minutes. Syslog is stored only in local buffers, and the monitoring team needs read-only access to all VSANs. A new storage operator must be able to change zones only in VSAN 10, while a second operator must be able to change zones in VSAN 20. Management access is through mgmt0. The change window is 60 minutes, and no production traffic may be disrupted. The security policy requires individual authentication, least privilege, and an emergency local account that is not used for daily work.

1. Design the AAA and RBAC model for the two storage operators, the monitoring team, and emergency access. Explain how VSAN restriction and command privilege are enforced.

Read the worked answer

Use TACACS+ for authentication and authorization, with local as fallback, and create MDS roles that match job duties rather than assigning network-admin broadly.

  • Create storage-op-vsan10 and storage-op-vsan20 roles. Give each role a VSAN policy that permits only its assigned VSAN and denies the other VSANs, then add rules that permit the zone configuration commands needed for that VSAN. Do not grant network-admin or unrestricted config rules.
  • Create monitoring-ro with read-only show rules across all VSANs. Avoid giving it any configuration rule.
  • Map TACACS+ users to these roles through the TACACS+ profile if the server can return an MDS role attribute; otherwise authenticate with TACACS+ but assign the role on the local username entry. Test this mapping before rollout.
  • Keep one emergency local network-admin account with a strong, escrowed password. It is for break-glass use only; do not use it for daily work.

The VSAN policy limits which VSANs the role can affect, while the role rules limit which commands the user can run. Both are required: a command rule alone does not confine an operator to VSAN 10. Verify with show role, show user-account, and a test login before removing the shared account.

2. What deployment order avoids locking the team out, and how would you verify each step?

Read the worked answer

Work from a second management session and never close the original session until the new path is proven.

  1. Create the roles and test local test users assigned to those roles. Confirm that the VSAN 10 operator cannot modify VSAN 20 and that the monitoring user cannot enter configuration mode.
  2. Confirm TACACS+ reachability and authentication with test aaa if available, and check the accounting/log path.
  3. Configure aaa authentication login default group tacacs+ local and the matching authorization commands with local fallback. Keep the emergency local account enabled.
  4. Open a new SSH session as a TACACS+ user, verify the assigned role, and run an allowed and a denied command.
  5. Only after both sessions behave correctly, remove the shared local account and tighten local fallback.

Use show aaa authentication, show aaa authorization, show role, show user-account, and show logging to verify. If the test login fails, the original session still allows rollback to local authentication.

3. How should NTP be implemented, and why does clock accuracy matter on these switches?

Read the worked answer

Configure at least two internal NTP servers, preferably with NTP authentication, and verify synchronization with show ntp status and show ntp peers. Use consistent NTP sources for all eight switches; do not rely on a single server or on manual clock setting.

Clock accuracy matters because syslog and accounting timestamps must correlate across switches and with TACACS+ records. Certificate validation, scheduled operations, and troubleshooting of fabric events also depend on consistent time. A seven-minute drift can make a TACACS+ failure, an ISL event, and an application timeout appear unrelated. After NTP is synchronized, confirm that logs from the mgmt0 interface and fabric events show the same time base, then update the monitoring/SIEM collectors to use that time.