NetOps Field

After choosing AAA during a security review, we needed a migration plan that kept the existing source of login authentication. The target was a Catalyst 9200L on IOS XE 17.18.4 using local accounts, with no RADIUS or TACACS+ server. AAA was disabled. The VTY configuration was recalled as login local , pending confirmation. The proposal moves login authentication into AAA while retaining local accounts. It has not been applied or tested on the target switch.

A security review required AAA on a Cisco device. The administrator asked why the existing management setup needed aaa new-model . We asked the security team which records they needed. Their concern was administrative access and activity, so we examined whether the existing logging features could meet the requirement. The documented coverage of login and configuration-change logs addressed parts of it. The unresolved requirement was evidence of prohibited command attempts and their authorization outcome. That requirement led us to choose AAA. Enabling aaa new-model alone does not establish that the required audit records are generated or retained.

An internal vulnerability assessment called for removing apparently unnecessary accounts from a Cisco Nexus switch. I found an SNMPv3 username listed as a local CLI user. From my experience with Cisco IOS, I initially treated the monitoring identity and the administrative login as separate objects. I paused the deletion to check NX-OS behavior. By default, NX-OS synchronizes SNMPv3 users with its security user database, so deleting the CLI account can also remove the SNMP user and interrupt monitoring. Environment Platform: Cisco Nexus C93180YC-FX3 Software: Cisco NX-OS 10.6(1) Context: Internal vulnerability assessment and account cleanup Change status: No account was deleted Usernames, passwords, customer information, and environment-specific details have been omitted. How I found the account I found the entries with: show running-config | include user The output included a local username and an snmp-server user entry for the same identity. The entries had this structu...