Question

A data center administrator is hardening the management plane of a Nexus 9000 switch after a security audit. The auditors require that administrative CLI access use public-key authentication (no passwords over the wire) and that only the dedicated management subnet 10.20.30.0/24 be permitted to reach the VTY lines. Which combination of configuration actions satisfies BOTH requirements?

Accepted Answer

Generate an RSA key pair, bind the user's SSH public key with 'username admin sshkey ...', and apply an inbound IP ACL permitting 10.20.30.0/24 to the VTY lines using 'line vty' with 'ip access-class ... in'

Answer

Enable the SNMPv3 user with authPriv, then apply a CoPP policy that rate-limits SSH from all subnets except 10.20.30.0/24

Answer

Disable the 'feature ssh', enable 'feature telnet' with an MD5-hashed password, and apply a port ACL (PACL) on the mgmt0 interface

Answer

Configure MACsec (CTS) on mgmt0 and set 'aaa authentication login default group tacacs+' so only the management subnet can authenticate