CloudLabBox
Try the free demo

Cisco NX-OS data centre lab 11 of 15

AAA, RBAC, key chains and first-hop security

Lock down a Nexus switch. Build a custom role and prove what it can and can't do, authenticate OSPF through a key chain, send logins to a TACACS+ server with a safe fallback, and add DHCP snooping and port security on the server VLAN.

Run this lab

It needs Standard: its 5 nodes are set to 6 vCPU and 8,704 MB in total.

In your workspace: Shared, then Cisco Nexus NX-OS data centre guided labs, then 11 - AAA RBAC key chains and first-hop security

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 6 vCPU and 8,704 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 90 minutes
Nodes need
6 vCPU, 8,704 MB
Smallest plan
Standard

The scenario

An auditor is coming to hall 3. Today everyone logs in with admin, OSPF trusts anyone who speaks it, and any device on the server VLAN could pretend to be the DHCP server. You have one day to fix all of it. R1 already expects OSPF MD5, which is why it's not your neighbour yet. R2 is the real DHCP server on VLAN 10. OPS runs the TACACS+ server, which knows two users, and NX-API is on so you can test logins from outside.

ItemValue
RoleTENANT-OPS: read everything, and change only Ethernet1/5-6
Local usertenantops, password Ops-Lab-2026
Key chainOSPF-KEYS, key 1, string Ashgrove-Key1
TACACS+ server192.168.100.10, key Tac-Key-2026, through VRF management
TACACS+ usersalice, password Alice-Pass1, privilege 15. bob, password Bob-Pass1, privilege 1
DHCPR2 (10.10.10.2) on Ethernet1/2, trusted. H1 on Ethernet1/5 is a client.

Test helper on OPS: /root/lab/nx.py USER PASSWORD show|conf "command" makes one NX-API call and prints the result.

What you’ll practise

  • Write a role with feature rules and an interface policy, and prove it from outside
  • Authenticate OSPF with a key chain, against an IOS neighbour
  • Point AAA at a TACACS+ group through the management VRF, and test it
  • Explain when local fallback is used, and keep the console safe
  • Use DHCP snooping and port security
  • Say which first-hop features need TCAM space on this image

The tasks

  1. Start the lab
  2. A custom role
  3. Authenticate OSPF with a key chain
  4. TACACS+ logins
  5. What local fallback really means
  6. First-hop security
  7. What needs TCAM on this image

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of AAA RBAC key chains and first-hop security5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.N1R1R2H1OPSMGMTeth0e0e5eth0e1Gi0/0e2Gi0/0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • N1 e1 to R1 Gi0/0
  • N1 e2 to R2 Gi0/0
  • N1 e5 to H1 eth0
  • N1 e0 to MGMT (network)
  • OPS eth0 to MGMT (network)
Nodes in AAA, RBAC, key chains and first-hop security, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
N1Cisco Nexus 9000vnxosv9k-9300v-9.3.102 vCPU, 6,144 MB
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
R2Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 512 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB
OPSEVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Cisco Nexus NX-OS data centre guided labs.

  3. Open 11 - AAA RBAC key chains and first-hop security and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Cisco NX-OS data centre labs

All Cisco NX-OS data centre labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.