350-601 · Question #410
Refer to the exhibit. A user must be granted management access to the Cisco Nexus 9000 Series Switch using AAA servers. The RADIUS servers are configured to accept login requests from the same Layer…
The correct answer is C. Set the RADIUS source interface to be mgmt0 for group RAD1 and VLAN 22 for group RAD2. D. Configure the authentication login to use group RAD1 for console and group RAD2 for remote. To configure AAA on a Cisco Nexus 9000 for RADIUS, using different servers for console and SSH access, the RADIUS source interfaces must be specified for each group, and authentication login methods must be configured to use the respective RADIUS groups for console and remote…
Question
Refer to the exhibit. A user must be granted management access to the Cisco Nexus 9000 Series Switch using AAA servers. The RADIUS servers are configured to accept login requests from the same Layer 2 subnet of the switch. The user must be permitted to log in with these requirements:
- RADIUS server 1 must be used to log in via a console.
- RADIUS server 2 must be used to login via SSH.
Which two actions meet these requirements? (Choose two.)
Exhibit
Options
- AEnable command authorization to RAD1 and RAD2 for all successful logins.
- BChange the dead timer for RAD1 and RAD2 to 1 minute.
- CSet the RADIUS source interface to be mgmt0 for group RAD1 and VLAN 22 for group RAD2.
- DConfigure the authentication login to use group RAD1 for console and group RAD2 for remote
- EConfigure AAA to send the accounting traffic to RAD1 and RAD2.
How the community answered
(38 responses)- A11% (4)
- B3% (1)
- C79% (30)
- E8% (3)
Why each option
To configure AAA on a Cisco Nexus 9000 for RADIUS, using different servers for console and SSH access, the RADIUS source interfaces must be specified for each group, and authentication login methods must be configured to use the respective RADIUS groups for console and remote access.
Command authorization is a separate AAA function from authentication and is not required to meet the specific login authentication requirements for console and SSH access.
Changing the dead timer for RADIUS servers affects how long the switch waits before marking a server as unreachable, which does not directly address the requirement of using specific servers for console vs- SSH login.
Setting the RADIUS source interface is crucial because it defines the interface through which the switch sends RADIUS requests for a specific server group. This ensures that RADIUS server 1 (for console) and RADIUS server 2 (for SSH) receive requests originating from the expected interface (mgmt0 and VLAN 22 respectively), enabling proper communication and authentication, especially when servers might be filtering based on source IP.
This action directly addresses the requirement to use different RADIUS servers for different login methods. By configuring `authentication login` to specify `group RAD1` for `console` access and `group RAD2` for `remote` (SSH) access, the switch correctly directs authentication requests to the designated RADIUS server based on the login method used.
Configuring AAA accounting sends records of user activity to RADIUS servers after successful logins/actions, which is distinct from configuring how users authenticate using different servers for different access methods.
Concept tested: Cisco Nexus AAA RADIUS authentication (source interface, login methods)
Source: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/7-x/security/configuration/guide/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x/b_Cisco_Nexus_9000_Series_NX-OS_Security_Configuration_Guide_7x_chapter_0110.html
Topics
Community Discussion
No community discussion yet for this question.
