Cisco Nexus 3548 Switch NX-OS Security Command Reference

Book Title

Chapter Title

New and Changed Information

PDF - Complete Book (2.13 MB) PDF - This Chapter (507.0 KB)
View with Adobe Reader on a variety of devices

New and Changed Information

This chapter provides release-specific information for each new and changed feature in the Cisco Nexus 3548 Switch NX-OS Security Command Reference. The latest version of this document is available at the following Cisco website:

To check for additional information about this Cisco NX-OS Release, see the Cisco Nexus 3548 Switch NX-OS Release Notes available at the following Cisco website:

Table 1 summarizes the new and changed features and tells you where they are documented.

Table 1 New and Changed Information
Feature	Description	Changed in Release	Where Documented
MAC ACL	This feature was introduced.	6.0(2)A4(1)	deny (MAC) mac access-list mac packet-classify mac port access-group permit (MAC) resequence show mac access-lists statistics per-entry
Syslog Thresholds for System Resources	This feature was introduced.	5.0(3)A3(2)	hardware profile tcam syslog-threshold
DHCP Relay	Added support for Option 82 information to be in encoded string format.	5.0(3)A3(2)	ip dhcp smart relay
Access Control List (ACL) ternary content addressable memory (TCAM) regions	The following commands were introduced to to change the size of ACL ternary content addressable memory (TCAM) regions: hardware profile tcam region show hardware profile tcam region	5.0(3)A2(1)	hardware profile tcam region show hardware profile tcam region
Address Resolution Protocol (ARP) ACLs for Control plane policing (CoPP)	The following commands were updated to include support for CoPP ACLs: deny (IPv4) permit (IPv4)	5.0(3)A2(1)	deny (IPv4) permit (IPv4)
Access control list (ACL)	This feature was introduced. You can configure ACLs for incoming or outgoing traffic, IPv4 and MAC access lists, or VLAN ACLs.	5.0(3)A1(1)	action clear access-list counters deny (IPv4) ip access-group ip access-list ip port access-group mac port access-group match permit (IPv4) permit (MAC) permit vlan remark resequence vlan access-map vlan filter show access-lists show ip access-lists show running-config aclmgr show startup-config aclmgr show vlan access-list show vlan access-map show vlan filter
ACLs on VTY	This feature was introduced. You can configure an access class to restrict incoming or outgoing traffic on a virtual terminal line (VTY).	5.0(3)A1(1)	access-class ip access-class
Dynamic Host Configuration Protocol (DHCP) Snooping	This feature was introduced. You can configure DHCP snooping on switches and VLANs.	5.0(3)A1(1)	feature dhcp mac port access-group show running-config dhcp show startup-config dhcp
Dynamic ARP Inspection (DAI)	This feature was introduced. You can configure dynamic Address Resolution Protocol (ARP) inspection (DAI) on a Cisco NX-OS switch.	5.0(3)A1(1)	clear ip arp control-plane control-plane ip dhcp smart relay show running-config arp show startup-config arp
Remote Authentication Dial-In User Service (RADIUS)	This feature was introduced. You can configure RADIUS server parameters, the shared secret key, and the number of retransmissions to RADIUS servers.	5.0(3)A1(1)	aaa group server radius deadtime radius-server deadtime radius-server directed-request radius-server host radius-server key radius-server retransmit radius-server timeout server show aaa groups show radius-server show running-config radius
Secure Shell (SSH)	This feature was introduced. You can configure a SSH session using IPv4 or IPv6, or create a SSH server key.	5.0(3)A1(1)	ssh ssh key ssh server enable show running-config security show ssh key show ssh server show startup-config security
Telnet	This feature was introduced. You can configure an IPv4 or IPv6 Telnet session and enable a Telnet server.	5.0(3)A1(1)	telnet telnet server enable show telnet server
Terminal Access Controller Access-Control System Plus (TACACS+)	This feature was introduced. You can configure the TACACS+ server parameters, enable a secret password for a privilege level, and create user accounts.	5.0(3)A1(1)	deadtime enable enable secret feature privilege feature tacacs+ server tacacs-server deadtime tacacs-server directed-request tacacs-server host tacacs-server key tacacs-server timeout username show privilege show tacacs-server show user-account show users
Authentication, authorization, and accounting (AAA)	This feature was introduced. You can configure AAA authentication methods, authorization methods, accounting methods, Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) authentication, or RADIUS server groups.	5.0(3)A1(1)	aaa accounting default aaa authentication login console aaa authentication login default aaa authentication login error-enable aaa authentication login mschap enable aaa authorization commands default aaa authorization config-commands default aaa group server radius aaa user default-role show aaa accounting show aaa authentication show aaa authorization show aaa groups show aaa user show access-lists show accounting log show running-config aaa show startup-config aaa
User roles	This feature was introduced. You can create user roles or user role feature groups.	5.0(3)A1(1)	deny (MAC) feature (user role feature group) hardware profile tcam syslog-threshold permit vsan role feature-group name role name rule vlan policy deny vsan policy deny show role show role feature show role feature-group show user-account show users
Virtual forwarding and routing (VRF)	This feature was introduced. You can configure VRF, VRF-lite features, and the IP features for a VRF.	5.0(3)A1(1)	permit vrf vrf policy deny use-vrf
System Management	This feature was introduced.	5.0(3)A1(1)	show mac access-lists
Unicast Routing	This feature was introduced.	5.0(3)A1(1)	mac port access-group

Table 1 New and Changed Information

Feature

Description

Changed in Release

Where Documented

MAC ACL

This feature was introduced.

6.0(2)A4(1)

deny (MAC)

mac access-list

mac packet-classify

mac port access-group

permit (MAC)

resequence

show mac access-lists

statistics per-entry

Syslog Thresholds for System Resources

This feature was introduced.

5.0(3)A3(2)

hardware profile tcam syslog-threshold

DHCP Relay

Added support for Option 82 information to be in encoded string format.

5.0(3)A3(2)

ip dhcp smart relay

Access Control List (ACL) ternary content addressable memory (TCAM) regions

The following commands were introduced to to change the size of ACL ternary content addressable memory (TCAM) regions:

hardware profile tcam region
show hardware profile tcam region

5.0(3)A2(1)

hardware profile tcam region

show hardware profile tcam region

Address Resolution Protocol (ARP) ACLs for Control plane policing (CoPP)

The following commands were updated to include support for CoPP ACLs:

deny (IPv4)
permit (IPv4)

5.0(3)A2(1)

deny (IPv4)

permit (IPv4)

Access control list (ACL)

This feature was introduced.

You can configure ACLs for incoming or outgoing traffic, IPv4 and MAC access lists, or VLAN ACLs.

5.0(3)A1(1)

action

clear access-list counters

mac port access-group

show running-config aclmgr

show startup-config aclmgr

show vlan access-list

show vlan access-map

show vlan filter

ACLs on VTY

This feature was introduced.

You can configure an access class to restrict incoming or outgoing traffic on a virtual terminal line (VTY).

5.0(3)A1(1)

access-class

ip access-class

Dynamic Host Configuration Protocol (DHCP) Snooping

This feature was introduced.

You can configure DHCP snooping on switches and VLANs.

5.0(3)A1(1)

feature dhcp

mac port access-group

show running-config dhcp

show startup-config dhcp

Dynamic ARP Inspection (DAI)

This feature was introduced.

You can configure dynamic Address Resolution Protocol (ARP) inspection (DAI) on a Cisco NX-OS switch.

5.0(3)A1(1)

clear ip arp

control-plane

ip dhcp smart relay

show running-config arp

show startup-config arp

Remote Authentication Dial-In User Service (RADIUS)

This feature was introduced.

You can configure RADIUS server parameters, the shared secret key, and the number of retransmissions to RADIUS servers.

5.0(3)A1(1)

aaa group server radius

deadtime

radius-server deadtime

radius-server directed-request

radius-server host

radius-server key

radius-server retransmit

radius-server timeout

server

show aaa groups

show radius-server

show running-config radius

Secure Shell (SSH)

This feature was introduced.

You can configure a SSH session using IPv4 or IPv6, or create a SSH server key.

5.0(3)A1(1)

ssh

ssh key

ssh server enable

show running-config security

show ssh key

show ssh server

show startup-config security

Telnet

This feature was introduced.

You can configure an IPv4 or IPv6 Telnet session and enable a Telnet server.

5.0(3)A1(1)

telnet

telnet server enable

show telnet server

Terminal Access Controller Access-Control System Plus (TACACS+)

This feature was introduced.

You can configure the TACACS+ server parameters, enable a secret password for a privilege level, and create user accounts.

5.0(3)A1(1)

tacacs-server deadtime

tacacs-server directed-request

tacacs-server host

tacacs-server key

tacacs-server timeout

Authentication, authorization, and accounting (AAA)

This feature was introduced.

You can configure AAA authentication methods, authorization methods, accounting methods, Microsoft Challenge Handshake Authentication Protocol (MS-CHAP) authentication, or RADIUS server groups.

5.0(3)A1(1)

aaa accounting default

aaa authentication login console

aaa authentication login default

aaa authentication login error-enable

aaa authentication login mschap enable

aaa authorization commands default

aaa authorization config-commands default

aaa group server radius

aaa user default-role

show aaa accounting

show aaa authentication