When you specify a VSA as shell:roles*"network-operator network-admin" or
"shell:roles*\"network-operator network-admin\"", this VSA is flagged as an optional attribute and other
Cisco devices ignore this attribute.
Note
accountinginfo
Stores accounting information in addition to the attributes covered by a standard RADIUS accounting
protocol. This attribute is sent only in the VSA portion of the Account-Request frames from the RADIUS
client on the switch, and it can only be used with the accounting protocol-related PDUs.
Specifying Cisco NX-OS User Roles and SNMPv3 Parameters on AAA Servers
You can use the VSA cisco-av-pair on AAA servers to specify user role mapping for the Cisco NX-OS device
using this format:
shell:roles="roleA roleB …"
If you do not specify the role option in the cisco-av-pair attribute, the default user role is network-operator.
You can also specify your SNMPv3 authentication and privacy protocol attributes as follows:
shell:roles="roleA roleB..." snmpv3:auth=SHA priv=AES-128
The SNMPv3 authentication protocol options are SHA and MD5. The privacy protocol options are AES-128
and DES. If you do not specify these options in the cisco-av-pair attribute, MD5 and DES are the default
authentication protocols.
Configuring Secure Login Features
Configuring Login Parameters
You can configure login parameters to automatically block further login attempts when a possible
denial-of-service (DoS) attack is detected and slow down dictionary attacks by enforcing a quiet period if
multiple failed connection attempts are detected.
This feature restarts if a system switchover occurs or the AAA process restarts.
Note
The
login block-for
and
login quiet-mode
configuration mode commands have been renamed to
system
login block-for
and
system login quiet-mode
, respectively.
Note
SUMMARY STEPS
1.
configure terminal
2.
[
no
]
system login block-for seconds attempts tries within seconds
3.
(Optional) [
no
]
system login quiet-mode access-class acl-name
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
29
Configuring AAA
Specifying Cisco NX-OS User Roles and SNMPv3 Parameters on AAA Servers
