Cisco Nexus Switch Intersight Device Connector (NXDC) - Configuration and Claim Process

The Nexus Switch Intersight Device Connector (NXDC) is the embedded component in the Cisco NX-OS image through which a Nexus switch establishes a secure connection to the Cisco Intersight portal. Since Cisco NX-OS release 10.2(3)F, this functionality has been available as “Device Connector on NX-OS” and enables inventory, health, and telemetry data to be sent to Intersight while control commands can be received from it—all over an encrypted Internet connection.

This article shows how to configure and verify NXDC, and then how to claim a switch in Intersight. It is based on the official Cisco document Nexus Switch Intersight Device Connector from the NX-OS Fundamentals Configuration Guide.

What NXDC Does

NXDC is enabled by default on all Cisco Nexus switches and starts automatically during boot. The switch then independently attempts to establish a connection to the cloud service. Once the secure connection is established and the device connector is registered in Intersight, NXDC collects detailed inventory and health data and transmits telemetry data. The inventory is updated once a day.

Two other features are worth noting:

• AutoUpdate: NXDC automatically updates itself to the latest version when an Intersight connection is available.
• Connected TAC: Allows technical support data to be collected directly from claimed devices.

The purpose of the integration is to give standalone Nexus switches a fast, cloud-based way to collect baseline data, manage it securely, and easily leverage future enhancements such as upgrades.

Prerequisites

There are two key prerequisites for establishing an NXDC connection:

• DNS must be configured.
• The switch must be able to resolve svc.intersight.com and allow outbound HTTPS connections initiated by the switch on port 443.

If the environment requires a proxy for the HTTPS connection to svc.intersight.com, it can be configured directly in the NXDC configuration.

Configure NXDC

Because Intersight is enabled by default, no further steps are usually required for basic operation. The configuration becomes relevant when the switch does not have direct Internet access or a specific VRF/interface needs to be used. The following optional parameters are available:

switch# configure terminal
switch(config)#

1. Configure proxy (optional)

switch(config)# intersight proxy proxy.esl.cisco.com port 8080

• proxy-name: IPv4/IPv6 address or DNS name of the proxy server
• proxy-port: Port number (1–65535); the default is 8080

If a proxy is already configured through Smart Licensing, NXDC automatically uses this setting.

2. Configure VRF (optional)

switch(config)# intersight use-vrf blue

Intersight uses the Management VRF/namespace by default. If connectivity runs through a different VRF, adjust it here.

3. Configure trustpoint/certificate (optional)

switch(config)# intersight trustpoint test test

Specifies the certificate for the Intersight connection via a Crypto-CA trustpoint label. For details about trustpoint configuration, see the NX-OS Security Configuration Guide.

4. Specify source interface (optional)

switch(config)# intersight source-interface mgmt 0

Specifies the interface used for communication with Intersight.

5. Disable Intersight/NXDC (optional)

switch(config)# no feature intersight

Completely disables the Intersight process and removes all NXDC configuration and saved logs.

Check Status and Configuration

Two key Bash commands are available for verification:

Example – Switch Has Not Been Claimed Yet:

switch# show system device-connector claim-info
SerialNumber: FDO23021ZUJ
SecurityToken: 9FFD4FA94DCD
Duration: 599
Message:
Claim state: Not Claimed

The SecurityToken (claim code) is displayed only while the connection to Intersight is up and the device has not yet been claimed. The specified Duration (in seconds) indicates how long this token remains valid.

Example – Switch Has Already Been Claimed:

switch# show system device-connector claim-info
SerialNumber: ABCD12345E6
SecurityToken:
Duration: 0
Message: Cannot fetch claim code for already claimed device
Claim state: Claimed
Claim time: 2024-02-18T12:00:01.77Z
Claimed by: user@cisco.com
Account: dc-customer
Site name:
Site ID:

Once a device has been claimed, no token is issued. Instead, the claim timestamp, claiming user, and associated Intersight account are displayed.

Claim a Switch in Intersight

To use the Intersight features, the switch must be claimed through the Intersight web interface. There are two ways to do this:

1. Claim through the Intersight UI: Manually add the switch in the Intersight portal through the designated “Target Claim” process. This requires the serial number and claim code (Security Token), which can be read from the switch with show system device-connector claim-info.
2. Claim multiple switches with Ansible: An Ansible playbook is available for the automated registration of multiple Nexus switches at once.

Quick Process for a Manual Claim:

• Read the claim code on the switch: show system device-connector claim-info
• In the Intersight portal, select Targets → Claim a New Target and choose the device type Nexus Switch
• Enter the serial number and Security Token, then confirm the claim
• After the claim succeeds, run show system device-connector claim-info on the switch again to verify the Claimed status and the claiming account

Because the Security Token is valid only for the duration specified in Duration, perform the claim promptly after reading the token. If the time expires, run the command again to obtain a new code.

Additional: Enable NX-API

In addition to NXDC, the Nexus switch offers NX-API as a second, independent programming interface. While NXDC handles the cloud connection to Intersight for inventory, health monitoring, and remote control, NX-API is used to issue local CLI commands over HTTP/HTTPS—for example, for custom scripts or automation tools. The two features can be used independently.

Enable NX-API as follows:

configure terminal
feature nxapi
! For HTTP access (optional, default port 80):
nxapi http port 80
! For HTTPS access (recommended, default port 443):
nxapi https port 443
end
write memory

Run show nxapi to check the status; it displays port and certificate information. For more details about NX-API configuration, administration commands, and troubleshooting connection issues, see the separate article on NX-API.

Conclusion

NXDC runs largely automatically in the background and requires no mandatory configuration beyond working DNS and outbound HTTPS access to port 443. Proxy, VRF, trustpoint, and source interface settings can be customized as needed. The main benefit comes from claiming the switch in Intersight—only then are the inventory overview, health monitoring, and Connected TAC features available. NX-API complements this as a separate local API for direct CLI automation.

References

Nexus Switch Intersight Device Connector – Cisco NX-OS Fundamentals Configuration Guide