Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Secure Nexus management with four coordinated controls: AAA verifies the administrator and records the session, SSH encrypts the remote CLI connection, RBAC limits what the authenticated account can do, and a correctly attached management ACL restricts which source addresses can reach management services. The exact commands and ACL attachment method depend on the Nexus family and NX-OS release. The guidance below is scoped to the Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 10.6(x), updated April 27, 2026; confirm the matching guide for your switch before applying configuration.
What each control protects
These controls operate at different points in the access path, so one cannot substitute for another:
- AAA (authentication, authorization, and accounting) establishes identity, selects or supplies authorization attributes, and records management sessions. NX-OS configures login services independently, allowing different policies for remote Telnet/SSH access, the console, and accounting.
- SSH protects the transport between an administrator’s client and the switch. It encrypts the remote CLI session; it does not decide which commands the user may run.
- RBAC maps a local account or AAA authorization attributes to roles and permitted operations. A successful login should not automatically provide unrestricted administrative capability.
- A management ACL is a source restriction. When the platform and release support the required attachment, it should allow management traffic only from approved administrator networks and deny other sources.
A user can therefore be authenticated successfully yet still be unable to execute a command because of RBAC, or be unable to reach the SSH service at all because the source is outside the permitted management ranges.
Confirm the platform and release before changing anything
NX-OS syntax, defaults, and feature support are not universal across Nexus families. Record the exact switch model, supervisor arrangement, NX-OS release, management interface in use, and the organization’s approved AAA and cryptographic policies. Use the security guide that matches those facts. The procedures in the 10.6(x) Nexus 9000 guide should not be copied unchanged to an older release or a different Nexus family.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Prerequisites for remote AAA
- IP reachability from the switch to every configured AAA server.
- The switch configured as an AAA client on each server.
- A matching shared secret (where the selected protocol requires one).
- AAA servers that are running and able to answer requests from the switch.
- A tested local account and a console recovery path before changing remote-login behavior.
Make changes from a console or an existing, verified administrative session. Keep that session open until remote tests and the saved configuration have been checked.
Build AAA as separate service policies
NX-OS AAA is service-based. Cisco describes AAA as independently providing authentication, authorization, and accounting, with remote RADIUS or TACACS+ and the local user database available according to the service being configured. Do not assume that a policy applied to remote SSH login automatically changes console login or accounting.
Remote Telnet and SSH login
The default login service list governs user Telnet/SSH login. In the matching release guide, construct its method list from the approved remote server group or groups and the local database according to your outage policy. The configuration form is represented by aaa authentication login default <methods>; the exact method keywords and group names must match the release and the server configuration.
Console login
Console authentication is a separate service list. Configure it deliberately with aaa authentication login console <methods>. Many organizations retain a verified local recovery account on the console even when remote logins primarily use centralized AAA. Whether that account remains usable during a remote-server outage is controlled by the fallback choice described below.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
Management-session accounting
Use aaa accounting default <methods> for user-session accounting. NX-OS can retain management-session information locally or send it to remote AAA servers. Decide which events must be retained, how long local records remain available, and how remote records are protected and monitored. Accounting is not authentication: enabling logs does not grant access, and authenticating a user does not by itself guarantee that session records are being collected.
Choose remote AAA, local accounts, and fallback deliberately
| Design choice | Strength | Operational risk or requirement |
|---|---|---|
| Centralized RADIUS or TACACS+ groups | One place to disable accounts, enforce policy, and collect administrator activity across switches; multiple servers in a group provide failover. | Requires reachability, correct client registration, shared secrets, responsive servers, and a tested outage procedure. |
| Local database as the primary method | Works without network services and is simple for an isolated device or emergency account. | Credential rotation and auditing are distributed across switches; stale local accounts become a management risk. |
| Remote methods followed by local fallback | Preserves a recovery path when all configured remote servers are unavailable. | A local credential can remain an alternative route during a remote AAA failure; protect and monitor it. |
| Remote methods with local fallback disabled | Removes the local alternative for the affected service, reducing exposure to local credentials. | A remote AAA outage can prevent remote and possibly console access unless an independently verified recovery path exists. |
NX-OS uses local authentication as the default when remote methods fail. Cisco documents the form no aaa authentication login { console | default } fallback error local to disable that fallback for the selected service. Treat this as a risk decision, not a universal hardening step: disabling fallback can reduce an attack path but can also turn an AAA outage into a lockout. Test the behavior in a maintenance window from the console before relying on it.
Server-group failover
Remote AAA server groups let NX-OS try another server when the first does not respond, then continue to subsequent configured groups according to the method list. Test both a normal response and a nonresponsive primary server. A timeout, an explicit rejection, and a network failure may produce different behavior; document what your servers return and verify the switch’s actual result.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Avoid duplicate usernames
Cisco warns that when a local account and a remote AAA account use the same username, NX-OS applies the local user’s roles to the remote user. Use distinct naming or explicitly design for that precedence. Otherwise a centrally authenticated account may receive local privileges that administrators did not intend.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
RADIUS and TACACS+ considerations
Select the protocol that fits the organization’s existing AAA service and authorization policy; do not infer capabilities from another platform. On Nexus 9000, aaa authentication login ascii-authentication is supported only for TACACS+, not RADIUS. Check the release guide for every protocol-specific option before using it in a shared template.
Secure the SSH transport
Cisco’s 10.6(x) guide states: "You can use the Secure Shell (SSH) server to enable an SSH client to make a secure, encrypted connection to a Cisco NX-OS device." SSH protects the connection, but its defaults are not a complete organizational hardening policy.
Know the 10.6(x) defaults
For Nexus 9000 NX-OS 10.6(x), the guide lists the SSH server as enabled by default, with a default 1024-bit RSA server key. Telnet is disabled by default. Verify those facts on the actual switch rather than assuming a factory state survived previous changes.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Set keys, algorithms, and client compatibility
Review the server key type and size, host-key handling, and the enabled key-exchange, cipher, and MAC algorithms against your security policy. Use only algorithms supported by both the selected NX-OS release and your administrative clients. If you remove legacy algorithms, test every approved automation tool and jump host first. Cisco notes that DSA-related SSH commands are deprecated beginning in NX-OS Release 10.6(1)F; do not build a new policy around those commands.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Public-key user authentication is documented as an available option. If you adopt it, define how public keys are issued, rotated, revoked, and associated with the account’s RBAC role. A key authenticates a user; it does not replace authorization or source-address restrictions.
Verify SSH before and after hardening
show ssh keydisplays the switch’s SSH key information.show ssh serverdisplays SSH server state and settings.show running-config security [all]helps review the security configuration, including SSH-related settings.
Capture the output before changes, apply one policy change at a time, and test a new SSH session from each approved administration network. Do not close the known-good session until a new session has authenticated and received the expected role.
Use RBAC to limit authenticated administrators
AAA answers who the user is and can provide authorization attributes; RBAC determines what that identity can do on the switch. Define roles around operational duties, such as monitoring, provisioning, or security administration, and grant only the commands and configuration areas required for each duty. Keep a separate, tightly controlled break-glass role for recovery rather than giving every named administrator full privileges.
Review both local role assignments and roles returned by the AAA server. The duplicate-username precedence rule makes this especially important: a local account with the same name can determine the remote user’s effective roles. Test representative accounts by attempting an allowed operation and a deliberately forbidden one, then confirm that accounting records identify the session.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Design the management ACL without assuming an interface ACL is enough
Management ACL implementation is platform- and release-specific. The Nexus 9000 IP ACL chapter states: "Management interface traffic is always processed on the supervisor module." That describes where processing occurs; it does not, by itself, document a complete binding procedure for filtering SSH management access.
Do not present a generic ip access-group interface example as a management-plane SSH filter unless the matching Nexus family and NX-OS release explicitly document that attachment. Confirm all of the following in the applicable guide:
- Which management interface or management-plane feature is supported.
- Whether the ACL is attached to the management plane, a management interface, a control-plane feature, or another documented hook.
- Which protocols and directions the attachment filters.
- Rule evaluation order, implicit behavior, and whether established or return traffic needs an explicit permit.
- How the switch handles an ACL change made through the console versus an existing SSH session.
Build the source policy
List the exact administrator source prefixes, jump-host addresses, monitoring systems, and automation endpoints that must reach management services. Separate human administration from monitoring and automation if they need different permissions or logging. Start with the narrowest justified ranges; avoid permitting an entire user VLAN when only a bastion subnet is required.
Recommended Free Tools
Apply and validate safely
- Open a console session or retain another tested out-of-band path.
- Record the current ACL and management configuration.
- Confirm the release-specific attachment syntax and apply the ACL in a maintenance window.
- From every intended source, test SSH and any other explicitly allowed management service.
- From an unauthorized source, verify that the connection is denied or cannot complete.
- Check logs, counters, and the running configuration using the verification commands documented for that feature.
- Only after successful tests, save the configuration according to your change-control process.
Never rely on an ACL’s presence in the running configuration as proof that it filters SSH. The attachment, direction, rule order, and observed behavior must all be verified.
Recommended deployment sequence
- Inventory and back up. Record model, NX-OS release, management addresses, current AAA, SSH, user, role, and ACL settings. Export a known-good configuration through the approved method.
- Prepare recovery. Connect through the console, verify a local recovery account, and confirm that the account’s role is sufficient for repair. If using a console adapter, verify that its connector and host port match the switch before the maintenance window; compatibility is model-specific.
- Prepare AAA servers. Register the switch as a client, configure matching secrets, create server groups, and verify reachability and responses from the switch.
- Configure remote login methods. Build the
defaultservice list with the approved group order and fallback behavior. Configure the console service list separately. - Configure accounting. Select local or remote session storage and verify that a test login produces the expected record.
- Harden SSH. Confirm server state, replace weak or policy-noncompliant keys and algorithms as supported by the release, and test client compatibility.
- Assign RBAC roles. Map each local or remote administrative identity to the least-privileged role required for its job. Check for duplicate usernames across local and remote sources.
- Attach the management ACL using the documented mechanism. Do not substitute a generic interface ACL command when the release requires another feature.
- Run positive and negative tests. Test approved and unapproved source addresses, remote-server failure, console login, role restrictions, accounting, and a fresh SSH connection.
- Save and monitor. Save only after tests pass, retain the pre-change configuration, and monitor AAA failures, SSH events, ACL denies, and accounting delivery.
Verification and failure handling
| Test | Expected result | If it fails |
|---|---|---|
| SSH from an approved source | Encrypted session opens and the account receives its intended RBAC role. | Check source ACL rules, SSH server state, client algorithm compatibility, AAA reachability, and username precedence. |
| SSH from an unapproved source | Connection is blocked by the documented management ACL attachment. | Confirm the ACL is attached to the management feature, not merely present or applied to an unrelated interface. |
| Primary AAA server unavailable | NX-OS tries the next server in the group and follows the configured fallback policy. | Check timeouts, server-group order, network reachability, and whether local fallback was intentionally disabled. |
| Console login during AAA outage | Behavior matches the separately configured console service list and recovery plan. | Use the console to restore a verified method list; do not make emergency changes through an untested remote path. |
| Restricted account attempts a prohibited command | RBAC denies the operation while permitted tasks continue to work. | Review local roles, returned AAA attributes, and duplicate usernames. |
| Accounting check | Session data appears in the selected local or remote destination. | Check accounting method configuration, server reachability, and destination retention or ingestion. |
Common mistakes to avoid
- Applying a command sequence from a different Nexus family or NX-OS release without checking syntax and feature support.
- Assuming SSH encryption grants administrator privileges or that AAA authentication defines every command a user may run.
- Disabling local fallback without a verified console recovery path and a maintenance-window test.
- Using the same username in the local database and remote AAA without accounting for local-role precedence.
- Leaving the 10.6(x) SSH defaults unchanged when the organization’s key and algorithm policy requires stronger settings.
- Calling an interface ACL a management-plane filter without proving the documented attachment and observing allowed and denied traffic.
- Saving an ACL change before testing an approved source, an unapproved source, and console recovery.
Control comparison at a glance
| Layer | Primary question answered | Failure or design concern |
|---|---|---|
| AAA authentication | Is this identity allowed to start a session? | Server outage, method order, fallback, and credential lifecycle. |
| AAA authorization and RBAC | Which commands and operations may this identity perform? | Overbroad roles or local-role precedence for duplicate usernames. |
| AAA accounting | What management session occurred and where is it recorded? | Missing records when remote destinations are unreachable or local retention is inadequate. |
| SSH | Is the remote CLI connection encrypted and compatible with policy? | Weak defaults, deprecated algorithms, or clients that cannot negotiate the approved set. |
| Management ACL | Which source addresses can reach management services? | Release-specific attachment, rule order, and administrative lockout. |
Final operating standard
Use centralized AAA with deliberate server failover, a separately tested console policy, and accounting that reaches a monitored destination. Use SSH with keys and algorithms approved for the exact NX-OS release, then verify the running state rather than trusting defaults. Assign least-privilege RBAC roles independently of authentication. Finally, apply a management ACL only through the documented mechanism for the exact Nexus platform, prove both permitted and denied behavior, and preserve a tested console recovery path for every change.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
