Using AAA Server VSAs with Cisco NX-OS Devices
You can use vendor-specific attributes (VSAs) to specify Cisco NX-OS user roles and SNMPv3 parameters
on AAA servers.
About VSAs
The Internet Engineering Task Force (IETF) draft standard specifies a method for communicating VSAs
between the network access server and the RADIUS server. The IETF uses attribute 26. VSAs allow vendors
to support their own extended attributes that are not suitable for general use. The Cisco RADIUS implementation
supports one vendor-specific option using the format recommended in the specification. The Cisco vendor
ID is 9, and the supported option is vendor type 1, which is named cisco-av-pair. The value is a string with
the following format:
protocol : attribute separator value *
The protocol is a Cisco attribute for a particular type of authorization, the separator is = (equal sign) for
mandatory attributes, and * (asterisk) indicates optional attributes.
When you use RADIUS servers for authentication on a Cisco NX-OS device, the RADIUS protocol directs
the RADIUS server to return user attributes, such as authorization information, along with authentication
results. This authorization information is specified through VSAs.
VSA Format
The following VSA protocol options are supported by the Cisco NX-OS software:
Shell
Protocol used in access-accept packets to provide user profile information.
Accounting
Protocol used in accounting-request packets. If a value contains any white spaces, put it within double
quotation marks.
The following attributes are supported by the Cisco NX-OS software:
roles
Lists all the roles assigned to the user. The value field is a string that stores the list of group names
delimited by white space. For example, if you belong to role network-operator and network-admin, the
value field would be network-operator network-admin. This subattribute is sent in the VSA portion of
the Access-Accept frames from the RADIUS server, and it can only be used with the shell protocol value.
These examples use the roles attribute:
shell:roles=network-operator network-admin
shell:roles*network-operator network-admin
The following examples show the roles attribute as supported by FreeRADIUS:
Cisco-AVPair = shell:roles=\network-operator network-admin\
Cisco-AVPair = shell:roles*\network-operator network-admin\
Cisco Nexus 9000 Series NX-OS Security Configuration Guide, Release 9.x
28
Configuring AAA
Using AAA Server VSAs with Cisco NX-OS Devices
