Netforge.ai Docs
Open the app →
Docs/Guide/Device Configuration/Management

Management

Relevant for:Professional ServicesEnterprise / NetOps
Where to find itCanvas→Select a device→Management tab

Everything an operations team needs on-box: DNS/domain, AAA, local users with a Common-Criteria password policy, NTP, console/VTY line hardening, and global CDP/LLDP. Every section is site-inheritable — define once on the Site Area, override per device.

Credential vault#

Every secret a device needs — local-user passwords, the enable secret, TACACS+/RADIUS shared keys, SNMP community strings and v3 auth/priv keys, the NTP key, HSRP/VRRP auth, and the SD-WAN orchestrator key — is a reference to your organization's credential vault, not a value typed into the design. Pick an entry (or save a new one inline) from the 🔒 dropdown wherever a secret is asked for.

Why
Vault values are encrypted at rest and resolved server-side at generation: the rendered config carries the real secret, preceded by a ! vault: NAME marker, while the saved design and any public share carry only the reference. A field with no reference falls back to PLACEHOLDER, exactly as before, so nothing breaks. One consequence to respect: generated output and exports contain live secrets — treat them like device backups. Deleting a vault entry that a design still references raises a validation warning so it never silently renders a placeholder.

AAA — TACACS+ / RADIUS#

Choose the model, then add servers (more than one for redundancy) with per-server timeout, retransmit, and VRF; set a source interface and toggle authorization/accounting. Shared keys are vault references (or PLACEHOLDER when unset). A Test AAA panel provides the operational test aaa command to paste into a live session.

aaa new-model
tacacs server TACACS-1
 address ipv4 10.0.0.1
 key 7 PLACEHOLDER
 timeout 5
 retransmit 2
 ip vrf forwarding MGMT
aaa group server tacacs+ TAC-GRP
 server name TACACS-1
ip tacacs source-interface Loopback0
aaa authentication login default group TAC-GRP local
aaa authorization exec default group TAC-GRP local
aaa accounting exec default start-stop group TAC-GRP
Why
Centralized AAA gives per-engineer accountability (who ran what, when) and instant deprovisioning. The trailing local keeps a fallback path so you are not locked out when the TACACS+ servers are unreachable — pair it with a local user below.

Local users & password policy#

Local accounts (username + privilege/role) are the fallback when external AAA is down. A Common-Criteria password policy enforces length, character classes, change distance, and lifetime on those accounts.

aaa common-criteria policy CC-POLICY
 min-length 8
 max-length 127
 numeric-count 1
 upper-case-count 1
 lower-case-count 1
 special-case-count 1
 character-changes 4
 lifetime days 90
username netadmin privilege 15 common-criteria-policy CC-POLICY secret PLACEHOLDER
Important
NX-OS has no per-count Common-Criteria policy — it renders the closest equivalent (password strength-check) and validation notes which knobs are IOS-only.

NTP#

ntp authenticate
ntp authentication-key 7 hmac-sha2-256 <vault>
ntp trusted-key 7
ntp source Loopback0
ntp server 10.1.1.1 key 7 prefer
ntp server 10.1.1.2 key 7
ntp access-group peer NTP-ACL
Why
Authenticated NTP prevents a spoofed time source from skewing clocks — which would quietly break certificate validation, log correlation, and MFA. Choose the hashing algorithm (MD5, HMAC-SHA1, or HMAC-SHA2-256); HMAC-SHA is preferred where supported, and NX-OS — which is MD5-only — falls back to MD5 with a validation note. The key value comes from the credential vault. prefer pins the primary; the access-group ACL restricts who may sync at all. Accurate time is the prerequisite for every forensic timeline.

Console & VTY lines#

line con 0
 exec-timeout 5 0
 logging synchronous
line vty 0 15
 exec-timeout 10
 login authentication default
 transport input ssh
 access-class MGMT-IN in vrf-also
 privilege level 15
Why
transport input ssh shuts the cleartext telnet door; the access-class ACL restricts management to jump hosts; exec-timeout kills abandoned sessions. On NX-OS only exec-timeout applies — validation tells you which knobs are IOS-only rather than silently dropping your intent.

SSH host key & admin settings#

Where to find itCanvas→Select a device→Management tab→SSH

Every Cisco config generates the SSH host key explicitly — with a configurable key label and modulus (2048 default, 3072 or 4096). NX-OS uses its native form; labels are IOS-XE-only and validation says so. The same group carries the SSH admin knobs (all site-inheritable): a session timeout (1–120 s), authentication retries (0–5) and a version pin — version 2 is the default and always emitted unless you opt out with compat, which omits the pin (the device negotiates 1.99) and draws a security warning. NX-OS renders retries as ssh login-attempts only — it has no time-out equivalent and is SSHv2-only, so validation flags both rather than silently dropping your intent.

crypto key generate rsa general-keys label SSH-KEYS modulus 4096
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
Why
NIST SP 800-57 and the CIS Benchmarks set 2048 bits as the RSA floor — shorter keys are considered breakable and fail compliance scans; the platform will not generate below it. A distinct label keeps the SSH key separate from other RSA keypairs on the box (e.g. certificates), so re-generating one never silently invalidates the other. ip ssh version 2 stays on by default — SSHv1 is broken — and choosing compat is an explicit, validation-flagged opt-out for legacy clients. Tight time-out and retry ceilings shrink the window for brute-force and abandoned half-open sessions.

Discovery — CDP / LLDP#

Global enable/disable (cdp run / no cdp run, lldp run) on every Cisco router and switch (NX-OS: cdp enable / feature lldp), with per-interface overrides on the Interfaces tab. Arista EOS renders LLDP only — a CDP setting on an EOS or ArubaOS-CX device is omitted and flagged by validation (those platforms are LLDP-only).

Why
Discovery protocols are gold for operations but an information leak on untrusted edges. The usual posture: on globally, off per-interface toward the internet and third parties.