Cisco Nexus 5000 Series NX-OS Security Command Reference

S Commands

This chapter describes the Cisco NX-OS security commands that begin with S.

server

To add a server to a RADIUS or TACACS+ server group, use the server command. To delete a server from a server group, use the no form of this command.

server {ipv4-address | ipv6-address | hostname}

no server {ipv4-address | ipv6-address | hostname}

Syntax Description

Command Default

None

Command Modes

RADlUS server group configuration mode
TACACS+ server group configuration mode

Command History

Usage Guidelines

You can configure up to 64 servers in a server group.

Use the aaa group server radius command to enter RADIUS server group configuration mode or aaa group server tacacs+ command to enter TACACS+ server group configuration mode.

If the server is not found, use the radius-server host command or tacacs-server host command to configure the server.

Note You must use the feature tacacs+ command before you configure TACACS+.

Examples

This example shows how to add a server to a RADIUS server group:

switch(config)# aaa group server radius RadServer 

switch(config-radius)# server 192.168.1.1 

This example shows how to delete a server from a RADIUS server group:

switch(config)# aaa group server radius RadServer 

switch(config-radius)# no server 192.168.1.1 

This example shows how to add a server to a TACACS+ server group:

switch(config)# feature tacacs+ 

switch(config)# aaa group server tacacs+ TacServer 

switch(config-tacacs+)# server 192.168.2.2 

This example shows how to delete a server from a TACACS+ server group:

switch(config)# feature tacacs+ 

switch(config)# aaa group server tacacs+ TacServer 

switch(config-tacacs+)# no server 192.168.2.2 

Related Commands

ssh

To create a Secure Shell (SSH) session using IPv4, use the ssh command.

ssh [username@]{ipv4-address | hostname} [vrf {vrf-name | default | management}]

Syntax Description

Command Default

Default VRF

Command Modes

EXEC mode

Command History

Usage Guidelines

The switch supports SSH version 2.

Examples

This example shows how to start an SSH session using IPv4:

switch# ssh 192.168.1.1 vrf management 

Related Commands

ssh6

To create a Secure Shell (SSH) session using IPv6, use the ssh6 command.

ssh6 [username@]{ipv6-address | hostname} [vrf {vrf-name | default | management}]

Syntax Description

Command Default

Default VRF

Command Modes

EXEC mode

Command History

Usage Guidelines

The switch supports SSH version 2.

Examples

This example shows how to start an SSH session using IPv6:

switch# ssh6 2001:0DB8::200C:417A vrf management 

Related Commands

ssh key

To create a Secure Shell (SSH) server key, use the ssh key command. To remove the SSH server key, use the no form of this command.

ssh key {dsa [force] | rsa [length [force]]}

no ssh key [dsa | rsa]

Syntax Description

Command Default

1024-bit length

Command Modes

Global configuration mode

Command History

Usage Guidelines

The Cisco NX-OS software supports SSH version 2.

If you want to remove or replace an SSH server key, you must first disable the SSH server using the no ssh server enable command.

Examples

This example shows how to create an SSH server key using RSA with the default key length:

switch(config)# ssh key rsa 

This example shows how to create an SSH server key using RSA with a specified key length:

switch(config)# ssh key rsa 768 

This example shows how to replace an SSH server key using DSA with the force option:

switch(config)# no ssh server enable 

switch(config)# ssh key dsa force 

switch(config)# ssh server enable 

This example shows how to remove the DSA SSH server key:

switch(config)# no ssh server enable 

switch(config)# no ssh key dsa 

switch(config)# ssh server enable 

This example shows how to remove all SSH server keys:

switch(config)# no ssh server enable 

switch(config)# no ssh key 

switch(config)# ssh server enable 

Related Commands

ssh login-attempts

To configure the maximum number of times that a user can attempt to log in to a Secure Shell (SSH) session, use the ssh login-attempts command. To disable the configuration, use the no form of this command.

ssh login-attempts number

no ssh login-attempts number

Syntax Description

Command Default

3

Command Modes

Global configuration

network-admin

vdc-admin

Command History

Usage Guidelines

The total number of login attempts includes attempts through public-key authentication, certificate-based authentication, and password-based authentication.

This command does not require a license.

If the user exceeds the maximum number of permitted login attempts, the session disconnects.

Examples

This example shows how to configure the maximum number of times that a user can attempt to log in to an SSH session:

switch# configure terminal 

switch(config)# ssh login-attempts 5 

This example shows how to disable the SSH login attempt configuration:

switch# configure terminal 

switch(config)# no ssh login-attempts 

Related Commands

ssh server enable

To enable the Secure Shell (SSH) server, use the ssh server enable command. To disable the SSH server, use the no form of this command.

ssh server enable

no ssh server enable

Syntax Description

This command has no arguments or keywords.

Command Default

Enabled

Command Modes

Global configuration mode

Command History

Usage Guidelines

The switch supports SSH version 2.

Examples

This example shows how to enable the SSH server:

switch(config)# ssh server enable 

This example shows how to disable the SSH server:

switch(config)# no ssh server enable 

Related Commands

storm-control level

To set the suppression level for traffic storm control, use the storm-control level command. To turn off the suppression mode or revert to the default, use the no form of this command.

storm-control {broadcast | multicast | unicast} level percentage[.fraction]

no storm-control {broadcast | multicast | unicast} level

Syntax Description

Command Default

All packets are passed.

Command Modes

Interface configuration mode

Command History

Usage Guidelines

Enter the storm-control level command to enable traffic storm control on the interface, configure the traffic storm-control level, and apply the traffic storm-control level to all traffic storm-control modes that are enabled on the interface.

The period (.) is required when you enter the fractional-suppression level.

The suppression level is a percentage of the total bandwidth. A threshold value of 100 percent means that no limit is placed on traffic. A threshold value of 0 or 0.0 (fractional) percent means that all specified traffic is blocked on a port.

Use the show interfaces counters storm-control command to display the discard count.

Use one of the following methods to turn off suppression for the specified traffic type:

•Set the level to 100 percent for the specified traffic type.

•Use the no form of this command.

Examples

This example shows how to enable suppression of broadcast traffic and set the suppression threshold level:

switch(config-if)# storm-control broadcast level 30 

This example shows how to disable the suppression mode for multicast traffic:

switch(config-if)# no storm-control multicast level 

Related Commands