! PermitANY — Cisco NX-OS Security Hardening
! Security hardening for Cisco Nexus: AAA, SSH hardening, role-based access, CoPP, disable unnecessary services, and management plane protection.
! Generated: 2026-09-20
! These are EXAMPLE values. Replace with your actual config before deploying.
!
hostname NXOS-LEAF-01
!
! ── Features ────────────────────────────────────────────────────────
feature ssh

feature tacacs+

!
! ── Banner ──────────────────────────────────────────────────────────
banner motd @
AUTHORIZED ACCESS ONLY.
@
!
! ── Users ───────────────────────────────────────────────────────────
username admin password Admin@2024! role network-admin
no username admin passphrase lifetime 0
!
! ── AAA ──────────────────────────────────────────────────────────────

tacacs-server host 10.0.0.50 key TacacsKey! timeout 5
aaa group server tacacs+ TACACS-GROUP
  server 10.0.0.50
aaa authentication login default group TACACS-GROUP local
aaa authentication login console group TACACS-GROUP local
aaa authorization commands default group TACACS-GROUP local
aaa accounting default group TACACS-GROUP


!
! ── SSH Hardening ───────────────────────────────────────────────────
ssh login-attempts 3
ssh key dsa 0
crypto key generate rsa modulus 4096
ip ssh version 2
!
! ── Line Hardening ──────────────────────────────────────────────────
line vty
  exec-timeout 10
  access-class MGMT-ACL in
line console
  exec-timeout 10
!
! ── Management ACL ──────────────────────────────────────────────────
ip access-list MGMT-ACL

  permit ip 10.0.0.0/24 any

  deny ip any any log
!
! ── Service Hardening ───────────────────────────────────────────────

no feature telnet


no cdp enable


no feature http-server

no feature dhcp
no ip source-route
!