A government jump host cannot open NX-API on a Nexus switch. SSH to the same switch works, and show commands succeed on the CLI. What is missing on the switch?
Select an answer to reveal the explanation.
Short Explanation
The side door is locked even though the front door opens. SSH proves the switch is up and the path to it works. NX-API stays closed until you enable the NX-API feature, which is what listens for those requests.
Full Explanation
NX-API is a separate feature from the CLI. Until it is enabled, the switch does not accept NX-API calls, so the jump host sees a connection failure while SSH and local show commands still work. A guest shell route matters only after a guest shell is in use. It does not open the NX-API listener. The on-box cli module exists inside the switch Python interpreter. Importing it on the jump host does nothing, because that module is not how an off-box client talks to the switch. POAP runs at boot when startup configuration is missing. A switch that already accepts SSH and runs show commands is past day-0, and a DHCP option would not enable the API on a configured switch. Caveat: after the feature is enabled, the client still has to use a permitted username and the message type the call requires. A show command sent as a configuration request fails for a different reason. Operational check: enable the feature, then confirm the jump host receives a JSON or XML reply to a show command. Confirm the feature with a show command on the switch before you rewrite the client, because a closed listener and a bad password look different from the jump host.