Cisco NX-OS Base / Day-0 Config

Cisco NX-OSBeginner

Day-zero configuration for Cisco Nexus switches: hostname, features, users, management interface, NTP, DNS, syslog, and SSH.

↓ example.txt

What is it?

Cisco NX-OS is the operating system running on Nexus data center switches. Unlike IOS, NX-OS uses a modular feature model — protocols and services are not enabled by default, you must explicitly run 'feature ospf', 'feature bgp', 'feature lacp', etc. This reduces the attack surface significantly. NX-OS also has a dedicated management VRF (Virtual Routing and Forwarding) that completely isolates management traffic from production traffic — SSH and syslog travel through 'vrf management' while data plane traffic uses the default VRF.

✓ When to use

·First thing after unboxing any Cisco Nexus switch (5000, 7000, 9000 series)
·Before enabling any other features or connecting to the production network
·During data center build-outs — base config is the foundation for VXLAN EVPN, vPC, and BGP configs
·As part of a ZTP (Zero Touch Provisioning) automation pipeline for day-0 deployment

✗ When NOT to use

·This IS always needed — there is no scenario where skipping the base config is appropriate in production

How it compares

vs Cisco IOS base configIOS has most features enabled by default — you disable them. NX-OS has almost nothing enabled by default — you enable what you need with 'feature' commands. NX-OS is safer out of the box.

vs Arista EOS base configEOS and NX-OS follow similar feature-enable models. EOS uses 'management api http-commands' for eAPI access (like NX-OS's 'feature nxapi'). Both are data-center focused OSes.

Prerequisites

→Console access via terminal emulator (PuTTY, SecureCRT) for initial setup
→Management IP and gateway — mgmt0 interface is the out-of-band management port
→NTP server IPs — NX-OS requires NTP per VRF (use-vrf management for the mgmt0 interface)
→Features to enable: plan which protocols you'll need (ospf, bgp, vpc, lacp, etc.) before deploying

Config Generator

Hostname *

Domain Name

Admin Password *

NX-OS Features to Enable

Management IP (CIDR) *

Management Gateway *

Management VRF

NTP Servers

DNS Server 1

DNS Server 2

Syslog Server

Timezone

MOTD Banner

Verification commands

show version

Verify NX-OS version, uptime, and hardware model

Expected: Shows NX-OS version, chassis type, and module states

show feature

List all available features and which are enabled/disabled

Expected: Shows 'enabled' or 'disabled' for each feature. Verify features you need are enabled.

show ip ssh

Verify SSH is running on the management interface

Expected: Shows SSH version 2 enabled

show ntp status

Verify NTP is synchronized

Expected: Clock is synchronized, reference is your NTP server IP

show interface mgmt0

Verify management interface has the correct IP and is up

Expected: Interface status should be 'up'. Shows IP address, speed, and counters.

Debug commands

show logging last 50

Show the last 50 syslog messages on the device

Common mistakes & fixes

⚡ Cannot SSH after base config — connection refused

Cause: 'feature ssh' not enabled or RSA key not generated

Fix: Run 'feature ssh' then 'crypto key generate rsa'. Verify with 'show feature | grep ssh'.

⚡ NTP not synchronizing

Cause: NTP server specified without 'use-vrf management', so it tries the default VRF

Fix: Add 'use-vrf management' to the NTP server command. Verify reachability: 'ping <ntp-ip> vrf management'.

⚡ Syslog messages not reaching the server

Cause: Missing 'use-vrf management' on the logging server command

Fix: Add 'use-vrf management' to 'logging server' command. NX-OS management traffic must specify the VRF.