Enabling MAB for the Authentication of the Data Traffic with the RADIUS Server.

For more information, see the Cisco Nexus 9000 Series NX-OS Security Configuration Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-installation-and-configuration-guides-list.html

Configuring the Authentication Order

Configuring the Authentication Order

POST http://<mgmt0_IP>/api/mo/sys.json

{
  "topSystem": {
    "children": [
      {
        "dot1xEntity": {
          "children": [
            {
              "dot1xInst": {
                "children": [
                  {
                    "dot1xIf": {
                      "attributes": {
                        "dot1xAuthOrder": "mab",
                        "id": "eth1/3"
                      }
                    }
                  },
                  {
                    "dot1xIf": {
                      "attributes": {
                        "dot1xAuthOrder": "mab",
                        "id": "eth1/2"
                      }
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      {
        "interfaceEntity": {
          "children": [
            {
              "l1PhysIf": {
                "attributes": {
                  "id": "eth1/3"
                }
              }
            },
            {
              "l1PhysIf": {
                "attributes": {
                  "id": "eth1/2"
                }
              }
            }
          ]
        }
      }
    ]
  }
}

{
    imdata:[]
}

<System>
  <dot1x-items>
    <inst-items>
      <if-items>
        <If-list>
          <id>eth1/3</id>
          <dot1xAuthOrder>mab</dot1xAuthOrder>
        </If-list>
        <If-list>
          <id>eth1/2</id>
          <dot1xAuthOrder>mab</dot1xAuthOrder>
        </If-list>
      </if-items>
    </inst-items>
  </dot1x-items>
  <intf-items>
    <phys-items>
      <PhysIf-list>
        <id>eth1/3</id>
      </PhysIf-list>
      <PhysIf-list>
        <id>eth1/2</id>
      </PhysIf-list>
    </phys-items>
  </intf-items>
</System>

Note: This example was added in Release 9.3(5).

CLI Commands

The CLI commands are equivalent to the payload examples displayed in the pane on the right. Click the DME tab in the top-left corner of the right pane to view the JSON payload. Click the YANG tab to view the XML payload.

interface ethernet 1/2-3
dot1x authentication order mab

Verifying a DME Configuration

The following table contains the distinguished name (DN) for each managed object (MO) in the DME payload. Issue a GET request using the DN to verify the configuration was posted or to get information about the configured properties of a particular object.

MO	DN
topSystem	sys
dot1xEntity	sys/dot1x
dot1xInst	sys/dot1x/inst
dot1xIf	sys/dot1x/inst/if-[eth1/3]
dot1xIf	sys/dot1x/inst/if-[eth1/2]
interfaceEntity	sys/intf
l1PhysIf	sys/intf/phys-[eth1/3]
l1PhysIf	sys/intf/phys-[eth1/2]

dot1xIf Properties

The following table contains information about the dot1xIf properties in the DME payload. For more information about the properties and MOs, see the NX-API DME Model Reference linked in the Related Documentation section below.

Property Name	Data Type	Description	Values
dot1xAuthOrder	dot1x:Dot1xAuthOrder (scalar:Enum8)	Dot1x authentication order	SELECTION: 0 - default 1 - mab DEFAULT: default
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

dot1xIf Properties

Property Name	Data Type	Description	Values
dot1xAuthOrder	dot1x:Dot1xAuthOrder (scalar:Enum8)	Dot1x authentication order	SELECTION: 0 - default 1 - mab DEFAULT: default
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

l1PhysIf Properties

The following table contains information about the l1PhysIf properties in the DME payload. For more information about the properties and MOs, see the NX-API DME Model Reference linked in the Related Documentation section below.

Property Name	Data Type	Description	Values
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

l1PhysIf Properties

Property Name	Data Type	Description	Values
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

See the NX-API DME Model Reference for detailed information about classes and attributes described in the payload:

https://developer.cisco.com/site/nx-os/docs/nexus-model-reference/

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html

Deleting the Authentication Order

Deleting the Authentication Order

POST http://<mgmt0_IP>/api/mo/sys.json

{
  "topSystem": {
    "children": [
      {
        "dot1xEntity": {
          "children": [
            {
              "dot1xInst": {
                "children": [
                  {
                    "dot1xIf": {
                      "attributes": {
                        "dot1xAuthOrder": "default",
                        "id": "eth1/3"
                      }
                    }
                  },
                  {
                    "dot1xIf": {
                      "attributes": {
                        "dot1xAuthOrder": "default",
                        "id": "eth1/2"
                      }
                    }
                  }
                ]
              }
            }
          ]
        }
      },
      {
        "interfaceEntity": {
          "children": [
            {
              "l1PhysIf": {
                "attributes": {
                  "id": "eth1/3"
                }
              }
            },
            {
              "l1PhysIf": {
                "attributes": {
                  "id": "eth1/2"
                }
              }
            }
          ]
        }
      }
    ]
  }
}

{
    imdata:[]
}

<System>
  <dot1x-items>
    <inst-items>
      <if-items>
        <If-list>
          <id>eth1/3</id>
          <dot1xAuthOrder>default</dot1xAuthOrder>
        </If-list>
        <If-list>
          <id>eth1/2</id>
          <dot1xAuthOrder>default</dot1xAuthOrder>
        </If-list>
      </if-items>
    </inst-items>
  </dot1x-items>
  <intf-items>
    <phys-items>
      <PhysIf-list>
        <id>eth1/3</id>
      </PhysIf-list>
      <PhysIf-list>
        <id>eth1/2</id>
      </PhysIf-list>
    </phys-items>
  </intf-items>
</System>

Note: This example was added in Release 9.3(5).

CLI Commands

interface ethernet 1/2-3
no dot1x authentication order mab

Verifying a DME Configuration

MO	DN
topSystem	sys
dot1xEntity	sys/dot1x
dot1xInst	sys/dot1x/inst
dot1xIf	sys/dot1x/inst/if-[eth1/3]
dot1xIf	sys/dot1x/inst/if-[eth1/2]
interfaceEntity	sys/intf
l1PhysIf	sys/intf/phys-[eth1/3]
l1PhysIf	sys/intf/phys-[eth1/2]

dot1xIf Properties

Property Name	Data Type	Description	Values
dot1xAuthOrder	dot1x:Dot1xAuthOrder (scalar:Enum8)	Dot1x authentication order	SELECTION: 0 - default 1 - mab DEFAULT: default
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

dot1xIf Properties

Property Name	Data Type	Description	Values
dot1xAuthOrder	dot1x:Dot1xAuthOrder (scalar:Enum8)	Dot1x authentication order	SELECTION: 0 - default 1 - mab DEFAULT: default
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

l1PhysIf Properties

Property Name	Data Type	Description	Values
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

l1PhysIf Properties

Property Name	Data Type	Description	Values
id	nw:IfId (base:IfIndex)	An identifier .	Must match first field in the output of `show intf brief`. Example: Eth1/1 or Vlan100

Related Documentation

For other CLI options, see the Cisco Nexus 9000 Series NX-OS Command Reference:

http://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-command-reference-list.html

See the NX-API DME Model Reference for detailed information about classes and attributes described in the payload:

https://developer.cisco.com/site/nx-os/docs/nexus-model-reference/

For information about using the payloads, see the Cisco Nexus 9000 Series NX-OS Programmability Guide:

https://www.cisco.com/c/en/us/support/switches/nexus-9000-series-switches/products-programming-reference-guides-list.html