Cisco NX-OS Security Hardening
Security hardening for Cisco Nexus: AAA, SSH hardening, role-based access, CoPP, disable unnecessary services, and management plane protection.
What is it?
NX-OS security hardening follows many of the same principles as IOS hardening, but leverages NX-OS's role-based access control (RBAC) and feature-based architecture. NX-OS has built-in roles (network-admin, network-operator, vdc-admin) that control what commands each user can run. The feature model is an advantage: services not enabled with 'feature' simply don't exist on the switch. NX-OS also has 'Control Plane Policing (CoPP)' pre-configured by default — protecting the switch CPU from traffic flooding attacks.
When to use
- ·Before deploying any Nexus switch to production
- ·After a security audit or compliance review
- ·For PCI-DSS, SOC 2, or HIPAA compliance in data center environments
- ·When establishing a security baseline for a new data center deployment
When NOT to use
- ·In a lab environment where rapid config changes are needed — strict exec timeouts slow troubleshooting. Use separate lab and production configs.
- ·Disabling 'feature dhcp' when Nexus is acting as a DHCP relay — verify first with 'show run | inc dhcp'
How it compares
Prerequisites
- →TACACS+ server configured and reachable from mgmt0 before applying AAA config
- →Management ACL must include your actual management source IPs — wrong IPs cause lockout
- →Verify which features are in use before disabling them: 'show feature' to see enabled features
- →Test console access before restricting VTY lines — console is not affected by VTY ACLs
Config Generator
Verification commands
show ip sshVerify SSH is enabled on the switch
ExpectedSSH Enabled - version 2.0
show aaa authenticationShow AAA authentication configuration and status
ExpectedLists authentication methods for login and console. TACACS+ should be primary with local as fallback.
show roleShow available RBAC roles and their permissions
ExpectedLists built-in roles (network-admin, network-operator) and any custom roles
show usersShow currently logged-in users and their source
ExpectedLists username, access method (ssh), source IP, and assigned role
Debug commands
show aaa accounting log last 20Show recent AAA accounting events (commands entered)
Common mistakes & fixes
Further learning
Recommended books to go deeper on this topic.
Network Security Architectures
Sean Convery · Cisco Press · Defense-in-depth, CoPP, control plane hardening, AAA design
CCNP Enterprise Core ENCOR 350-401 Official Cert Guide
Brad Edgeworth et al. · Cisco Press · AAA, RADIUS, TACACS+, device hardening best practices