300-170 · Question #106
You have a Cisco Nexus device that is configured to use RADIUS serve. What occur when local RBAC user account roles and RADIUS roles exist simultaneously?
The correct answer is B. Only rules from the local roles are applied. When a Cisco Nexus device uses a RADIUS server for authentication and both local RBAC user roles and RADIUS-provided roles exist for a user, the permissions from the local RBAC roles are applied.
Question
You have a Cisco Nexus device that is configured to use RADIUS serve. What occur when local RBAC user account roles and RADIUS roles exist simultaneously?
Options
- AOnly rules that are in the local roles and the RADIUS roles are applied
- BOnly rules from the local roles are applied.
- COnly rules from the RADIUS roles are applied.
- DThe rules from the local roles and the RADIUS roles are merged.
How the community answered
(36 responses)- B94% (34)
- C3% (1)
- D3% (1)
Why each option
When a Cisco Nexus device uses a RADIUS server for authentication and both local RBAC user roles and RADIUS-provided roles exist for a user, the permissions from the local RBAC roles are applied.
Rules are not merged, nor are only common rules applied; local roles supersede RADIUS-provided roles when both exist.
On Cisco Nexus devices, if a user account has both locally configured RBAC roles and roles assigned by a RADIUS server, the local RBAC roles take precedence and are the only ones applied for that user.
RADIUS roles are not applied when local RBAC roles exist; local roles take precedence over external authentication server roles.
The rules from local roles and RADIUS roles are not merged; the local role configuration takes precedence and is applied exclusively.
Concept tested: Cisco Nexus RBAC and RADIUS role precedence
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/security/7x/b_Cisco_Nexus_3000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_3000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_0100.html#task_AB0D5B3A13414167B7879B575306B705
Topics
Community Discussion
No community discussion yet for this question.