Security
The Security domain tests how you control access to Nexus, MDS, UCS, and ACI, and how you protect the data-plane edge: AAA, RBAC, CoPP, port security, DHCP snooping, DAI, and SAN fabric binding.
AAA
Cisco AAA separates authentication, authorization, and accounting. TACACS+ runs over TCP 49 and encrypts the entire payload, so it can authorize individual commands; RADIUS uses UDP 1812/1813 and hides only the password, which makes it weaker for per-command authorization. LDAP is common for directory-backed authentication. On NX-OS you define a server group, then apply it: aaa group server tacacs+ TAC1 server 10.10.10.10 aaa authentication login default group TAC1 local The trailing local is what prevents a lockout if servers are unreachable.
RBAC
NX-OS roles bundle rules; network-admin and network-operator are built in, and you can create roles with permit/deny on command families. On MDS, roles are scoped to VSANs.
Control plane protection
CoPP polices traffic destined to the supervisor CPU with a policy map and class maps; it does not police transit data traffic. Port security limits learned MAC addresses per interface (maximum, sticky, violation action). DHCP snooping builds a binding table from trusted ports; dynamic ARP inspection validates ARP against that table; IP source guard checks source IP and MAC.
SAN security
Fabric binding allows only switches with listed WWNs and domain IDs to join; port security on MDS binds devices to ports; FC-SP adds authentication (DH-CHAP).
Worked example
An engineer enables DHCP snooping on a VLAN but hosts cannot get addresses. The uplink to the DHCP server is still untrusted, so offers are dropped. Mark the server-facing port trusted (ip dhcp snooping trust), keep host ports untrusted, and enable option 82 if the relay needs it. DAI then works only on VLANs where snooping is enabled and the binding table is populated.
Traps
- Forgetting local fallback in AAA and locking yourself out.
- Assuming RADIUS encrypts the whole packet.
- Enabling DAI without DHCP snooping.
- Confusing CoPP with interface ACLs.